General

  • Target
    com.mini.screen.tvcast-32-apksos.com.apk
  • Size 6.5MB
  • Sample230108-jvdymsda79
  • SHA256 41298824cd00b282517c797830be2979ace038d26f39a4deab7fc2c4da716c4c
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • joker

C2
  • http://packup.oss-us-east-1.aliyuncs.com/miniscreen

  • https://cxjus.oss-ap-southeast-1.aliyuncs.com/af2

  • https://cxjus.oss-ap-southeast-1.aliyuncs.com/fbhx

Targets

    • Target
      com.mini.screen.tvcast-32-apksos.com.apk
    • Size 6.5MB
    • SHA256 41298824cd00b282517c797830be2979ace038d26f39a4deab7fc2c4da716c4c
    • MD5 SHA1 SHA512 SSDEEP
    • joker

      Joker is an Android malware that targets billing and SMS fraud.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Legitimate hosting services abused for malware hosting/C2

    • Reads information about phone network operator.

    • Removes a system notification.

    • Uses Crypto APIs (Might try to encrypt user data).

MITRE ATT&CK Enterprise v6

Tasks