General

  • Target

    Photo Voice Translator_2.6.3.apk

  • Size

    16.3MB

  • Sample

    230109-msw8zshd5w

  • MD5

    6c1797c5a0b5d5d07fc74f474c9498d3

  • SHA1

    69a884bbee18c8ebee0c329c14f58728c51c58f2

  • SHA256

    6eb6fb045c1b68d090095cc9e1f617c6b11202cbbe7f0ef93221d4c9ab62a387

  • SHA512

    beed2958a850b761382b0f37c11233d48e3ab2cccf1c1ee3b3887e864fd366d98dce705c941a76a3d6ba4a4a91f06b8083d9a223733af3087c4030eb57192a1f

  • SSDEEP

    393216:L4u71DlnRJ5tpkAEQgzIOhV/Hwj0v1ro96cabi13ykOuF1DYO:ku7T/5LpEzjJH1Nro9HhLkO

Malware Config

Extracted

Family

joker

C2

https://adcbk.oss-eu-central-1.aliyuncs.com/af2

https://adcbk.oss-eu-central-1.aliyuncs.com/fbhx

Targets

    • Target

      Photo Voice Translator_2.6.3.apk

    • Size

      16.3MB

    • MD5

      6c1797c5a0b5d5d07fc74f474c9498d3

    • SHA1

      69a884bbee18c8ebee0c329c14f58728c51c58f2

    • SHA256

      6eb6fb045c1b68d090095cc9e1f617c6b11202cbbe7f0ef93221d4c9ab62a387

    • SHA512

      beed2958a850b761382b0f37c11233d48e3ab2cccf1c1ee3b3887e864fd366d98dce705c941a76a3d6ba4a4a91f06b8083d9a223733af3087c4030eb57192a1f

    • SSDEEP

      393216:L4u71DlnRJ5tpkAEQgzIOhV/Hwj0v1ro96cabi13ykOuF1DYO:ku7T/5LpEzjJH1Nro9HhLkO

    • joker

      Joker is an Android malware that targets billing and SMS fraud.

    • Acquires the wake lock.

    • Checks Android system properties for emulator presence.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Reads information about phone network operator.

    • Removes a system notification.

    • Uses Crypto APIs (Might try to encrypt user data).

MITRE ATT&CK Matrix

Tasks