General

  • Target

    Perfect Face Swap_4.1.1.apk

  • Size

    30.2MB

  • Sample

    230114-q83bqagh72

  • MD5

    ecf015e1258bfacdc7fc5de16d088f9b

  • SHA1

    701a2fa2bda95136115961a1e6e0b913199e6775

  • SHA256

    59e8f0f03dfdc2a63d68b387457a2bae00ee054d2300b776db65dc1368c29d77

  • SHA512

    015744471b3e706b7b96af065d35edcccc27665069749fa7ed17f1cccf6c5e3a2159654fcc766f25e8390f39423e52d1244284d362dccfe82a27605683833488

  • SSDEEP

    786432:A4rRyaNOTJ3M1DuTIMlg+XPvVhdHIDaDwQ9G:/rD/uTM0P9htIDeG

Malware Config

Extracted

Family

joker

C2

https://adcbk.oss-eu-central-1.aliyuncs.com/af2

https://adcbk.oss-eu-central-1.aliyuncs.com/fbhx

Targets

    • Target

      Perfect Face Swap_4.1.1.apk

    • Size

      30.2MB

    • MD5

      ecf015e1258bfacdc7fc5de16d088f9b

    • SHA1

      701a2fa2bda95136115961a1e6e0b913199e6775

    • SHA256

      59e8f0f03dfdc2a63d68b387457a2bae00ee054d2300b776db65dc1368c29d77

    • SHA512

      015744471b3e706b7b96af065d35edcccc27665069749fa7ed17f1cccf6c5e3a2159654fcc766f25e8390f39423e52d1244284d362dccfe82a27605683833488

    • SSDEEP

      786432:A4rRyaNOTJ3M1DuTIMlg+XPvVhdHIDaDwQ9G:/rD/uTM0P9htIDeG

    • joker

      Joker is an Android malware that targets billing and SMS fraud.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).

    • Checks Android system properties for emulator presence.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Reads information about phone network operator.

    • Removes a system notification.

    • Uses Crypto APIs (Might try to encrypt user data).

MITRE ATT&CK Matrix

Tasks