Overview

overview

10

Static

static

7

Drink Wate...re.apk

android-9-x86

10

Drink Wate...re.apk

android-11-x64

1

Analysis

  • max time kernel
    3481051s
  • max time network
    130s
  • platform
    android_x86
  • resource
    android-x86-arm-20220823-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
  • submitted
    20/01/2023, 15:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Drink Water Clock_1.4_Apkpure.apk
  • Size 13.1MB
  • Sample230120-sdw8bsaf4y
  • SHA256 f0462f4d2b0cdb23b0aa43f0faf2194bc947e85b0963c95211560eebe3756595
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
jokerevasioninfostealerransomwaretrojan

Malware Config

Extracted

Family

  • joker

C2

  • https://weco.oss-eu-central-1.aliyuncs.com/simple

  • https://kbnt.oss-ap-southeast-1.aliyuncs.com/kbnt

Signatures

  • joker

    Joker is an Android malware that targets billing and SMS fraud.

    infostealertrojanjoker
  • Loads dropped Dex/Jar 5 IoCs

    Runs executable file dropped to the device during analysis.

  • Reads information about phone network operator.
  • Removes a system notification. 1 IoCs
    evasion
  • Uses Crypto APIs (Might try to encrypt user data). 1 IoCs
    ransomware

Processes

  • com.demash.drinkingclock
    1⤵
    • Loads dropped Dex/Jar
    • Removes a system notification.
    • Uses Crypto APIs (Might try to encrypt user data).
    PID:4111

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Web Data
        • Path /data/user/0/com.demash.drinkingclock/app_webview/Web Data
        • Size 104KB
        • SHA256 47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Web Data-journal
        • Path /data/user/0/com.demash.drinkingclock/app_webview/Web Data-journal
        • Size 1KB
        • SHA256 3344498905c05959941ec75e09835f8e60ac0dcb49b6760fb4fc0aae9666dcca
        • MD5 SHA1 SHA512
        Submit Download

        metrics_guid
        • Path /data/user/0/com.demash.drinkingclock/app_webview/metrics_guid
        • Size 36B
        • SHA256 f0990db47dfe9e1b81b5640b8be5aff729864327dbb22557770dc630368e5d99
        • MD5 SHA1 SHA512
        Submit Download

        google_app_measurement.db
        • Path /data/user/0/com.demash.drinkingclock/databases/google_app_measurement.db
        • Size 120KB
        • SHA256 fbc0ad75b89ef5b240f6a3943fb3218aa82c9ebf929978cd1a04670d2bfc34c3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        google_app_measurement.db-journal
        • Path /data/user/0/com.demash.drinkingclock/databases/google_app_measurement.db-journal
        • Size 524B
        • SHA256 caeaf981e0b8ac1e9691ea88f62b3b15ba1a2e72ce4e213b0d4ac32161c6e42e
        • MD5 SHA1 SHA512
        Submit Download

        google_app_measurement.db-shm
        • Path /data/user/0/com.demash.drinkingclock/databases/google_app_measurement.db-shm
        • Size 8B
        • SHA256 af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc
        • MD5 SHA1 SHA512
        Submit Download

        google_app_measurement.db-wal
        • Path /data/user/0/com.demash.drinkingclock/databases/google_app_measurement.db-wal
        • Size 607KB
        • SHA256 b9fe1be69624b724d4c2092b34be55916ca28b606f6ee0b80cca115168389e04
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        google_app_measurement_local.db
        • Path /data/user/0/com.demash.drinkingclock/databases/google_app_measurement_local.db
        • Size 20KB
        • SHA256 fcba6384af560e501a3fae9ffa613d5f9d08484ae6c759bf54ae4178d4c2d253
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        google_app_measurement_local.db-journal
        • Path /data/user/0/com.demash.drinkingclock/databases/google_app_measurement_local.db-journal
        • Size 524B
        • SHA256 af78643fb37a71eef5a2758136e393c97292fa3a14c47c872682015d92607d18
        • MD5 SHA1 SHA512
        Submit Download

        google_app_measurement_local.db-shm
        • Path /data/user/0/com.demash.drinkingclock/databases/google_app_measurement_local.db-shm
        • Size 8B
        • SHA256 af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc
        • MD5 SHA1 SHA512
        Submit Download

        google_app_measurement_local.db-shm
        • Path /data/user/0/com.demash.drinkingclock/databases/google_app_measurement_local.db-shm
        • Size 8B
        • SHA256 af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc
        • MD5 SHA1 SHA512
        Submit Download

        google_app_measurement_local.db-shm
        • Path /data/user/0/com.demash.drinkingclock/databases/google_app_measurement_local.db-shm
        • Size 8B
        • SHA256 af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc
        • MD5 SHA1 SHA512
        Submit Download

        google_app_measurement_local.db-shm
        • Path /data/user/0/com.demash.drinkingclock/databases/google_app_measurement_local.db-shm
        • Size 8B
        • SHA256 af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc
        • MD5 SHA1 SHA512
        Submit Download

        google_app_measurement_local.db-shm
        • Path /data/user/0/com.demash.drinkingclock/databases/google_app_measurement_local.db-shm
        • Size 8B
        • SHA256 af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc
        • MD5 SHA1 SHA512
        Submit Download

        google_app_measurement_local.db-shm
        • Path /data/user/0/com.demash.drinkingclock/databases/google_app_measurement_local.db-shm
        • Size 8B
        • SHA256 af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc
        • MD5 SHA1 SHA512
        Submit Download

        google_app_measurement_local.db-shm
        • Path /data/user/0/com.demash.drinkingclock/databases/google_app_measurement_local.db-shm
        • Size 8B
        • SHA256 af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc
        • MD5 SHA1 SHA512
        Submit Download

        google_app_measurement_local.db-shm
        • Path /data/user/0/com.demash.drinkingclock/databases/google_app_measurement_local.db-shm
        • Size 8B
        • SHA256 af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc
        • MD5 SHA1 SHA512
        Submit Download

        google_app_measurement_local.db-shm
        • Path /data/user/0/com.demash.drinkingclock/databases/google_app_measurement_local.db-shm
        • Size 8B
        • SHA256 af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc
        • MD5 SHA1 SHA512
        Submit Download

        google_app_measurement_local.db-wal
        • Path /data/user/0/com.demash.drinkingclock/databases/google_app_measurement_local.db-wal
        • Size 36KB
        • SHA256 a083912516c4a04bcc76d1e772a599f7be6da1f7191d5f35ed5ad1f9b5c3a77a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        google_app_measurement_local.db-wal
        • Path /data/user/0/com.demash.drinkingclock/databases/google_app_measurement_local.db-wal
        • Size 4KB
        • SHA256 3265bb18c9196d65e91d8d9d3e59aa774045bfe815b7e6d5a4deb6b95c4efaea
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        google_app_measurement_local.db-wal
        • Path /data/user/0/com.demash.drinkingclock/databases/google_app_measurement_local.db-wal
        • Size 4KB
        • SHA256 a353e099f7cd623ee2a4ceb46abac049773c44558c73bd281a3fd9042c0939ee
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        google_app_measurement_local.db-wal
        • Path /data/user/0/com.demash.drinkingclock/databases/google_app_measurement_local.db-wal
        • Size 4KB
        • SHA256 bfe5bf75f556d9d4b463a4e102c1cb43036946de9a1b150350b387b11dcaf8a0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        google_app_measurement_local.db-wal
        • Path /data/user/0/com.demash.drinkingclock/databases/google_app_measurement_local.db-wal
        • Size 4KB
        • SHA256 74ad075c83c9a6833c391bfbac29ed5353d020c8b662ac95351cf531755a922c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        google_app_measurement_local.db-wal
        • Path /data/user/0/com.demash.drinkingclock/databases/google_app_measurement_local.db-wal
        • Size 4KB
        • SHA256 29f9e19e159d2efc9bce4501b5d5ed89cf84116f9f702d665cb52dc9da7e30d7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        historyDatabase
        • Path /data/user/0/com.demash.drinkingclock/databases/historyDatabase
        • Size 4KB
        • SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
        • MD5 SHA1 SHA512
        Submit Download

        historyDatabase-journal
        • Path /data/user/0/com.demash.drinkingclock/databases/historyDatabase-journal
        • Size 524B
        • SHA256 bcc3affaea042a7b190649f8dd6f810fd87cc047666c3e360f70f94490179709
        • MD5 SHA1 SHA512
        Submit Download

        historyDatabase-shm
        • Path /data/user/0/com.demash.drinkingclock/databases/historyDatabase-shm
        • Size 8B
        • SHA256 af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc
        • MD5 SHA1 SHA512
        Submit Download

        historyDatabase-wal
        • Path /data/user/0/com.demash.drinkingclock/databases/historyDatabase-wal
        • Size 120KB
        • SHA256 6263ae65ae310e233808d918002a1d9385e3d3b4fd85740757a057fce9ef1f3a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        frc_1:216125644226:android:b13a3424ddc9182bc28a5b_firebase_activate.json
        • Path /data/user/0/com.demash.drinkingclock/files/frc_1:216125644226:android:b13a3424ddc9182bc28a5b_firebase_activate.json
        • Size 361B
        • SHA256 66c76cd6faaa2924c148b34d1ed6f0eae5c76c9a8ffa103769eaf33b4f7695b7
        • MD5 SHA1 SHA512
        Submit Download

        frc_1:216125644226:android:b13a3424ddc9182bc28a5b_firebase_defaults.json
        • Path /data/user/0/com.demash.drinkingclock/files/frc_1:216125644226:android:b13a3424ddc9182bc28a5b_firebase_defaults.json
        • Size 560B
        • SHA256 81bd4f47e8bbc888819fa4e4c1bbee3630c6cb5780fcac8c92bf25dfbf9424ab
        • MD5 SHA1 SHA512
        Submit Download

        frc_1:216125644226:android:b13a3424ddc9182bc28a5b_firebase_fetch.json
        • Path /data/user/0/com.demash.drinkingclock/files/frc_1:216125644226:android:b13a3424ddc9182bc28a5b_firebase_fetch.json
        • Size 361B
        • SHA256 66c76cd6faaa2924c148b34d1ed6f0eae5c76c9a8ffa103769eaf33b4f7695b7
        • MD5 SHA1 SHA512
        Submit Download

        google_app_measurement.db
        • Path /data/user/0/com.demash.drinkingclock/files/google_app_measurement.db
        • Size 4B
        • SHA256 21548c66b44347d877e7b405a250121cda87cd494b122f0324f7df3b6cd75f86
        • MD5 SHA1 SHA512
        Submit Download

        zzxqmsm
        • Path /data/user/0/com.demash.drinkingclock/files/zzxqmsm
        • Size 26KB
        • SHA256 5b8461ad3722b20598638abab3ec9f9c743b1feb0c848ed84ee7e1d34f28270f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        zzxqmsm
        • Path /data/user/0/com.demash.drinkingclock/files/zzxqmsm
        • Size 26KB
        • SHA256 5b8461ad3722b20598638abab3ec9f9c743b1feb0c848ed84ee7e1d34f28270f
        • MD5 SHA1 SHA512 SSDEEP
        Download

        zzxqmsm
        • Path /data/user/0/com.demash.drinkingclock/files/zzxqmsm
        • Size 26KB
        • SHA256 5b8461ad3722b20598638abab3ec9f9c743b1feb0c848ed84ee7e1d34f28270f
        • MD5 SHA1 SHA512 SSDEEP
        Download

        zzxqmsm
        • Path /data/user/0/com.demash.drinkingclock/files/zzxqmsm
        • Size 26KB
        • SHA256 5b8461ad3722b20598638abab3ec9f9c743b1feb0c848ed84ee7e1d34f28270f
        • MD5 SHA1 SHA512 SSDEEP
        Download

        zzxqmsm
        • Path /data/user/0/com.demash.drinkingclock/files/zzxqmsm
        • Size 26KB
        • SHA256 5b8461ad3722b20598638abab3ec9f9c743b1feb0c848ed84ee7e1d34f28270f
        • MD5 SHA1 SHA512 SSDEEP
        Download

        androidx.work.workdb
        • Path /data/user/0/com.demash.drinkingclock/no_backup/androidx.work.workdb
        • Size 4KB
        • SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
        • MD5 SHA1 SHA512
        Submit Download

        androidx.work.workdb-journal
        • Path /data/user/0/com.demash.drinkingclock/no_backup/androidx.work.workdb-journal
        • Size 524B
        • SHA256 7140eef4cc91b444b0ca9bbbe7dfb87aa29184d62bd713fa5dbea0f2e9f956b0
        • MD5 SHA1 SHA512
        Submit Download

        androidx.work.workdb-shm
        • Path /data/user/0/com.demash.drinkingclock/no_backup/androidx.work.workdb-shm
        • Size 8B
        • SHA256 af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc
        • MD5 SHA1 SHA512
        Submit Download

        androidx.work.workdb-wal
        • Path /data/user/0/com.demash.drinkingclock/no_backup/androidx.work.workdb-wal
        • Size 108KB
        • SHA256 f6bdbe2aa813156e82cac60e93ba7515c0a5b2e6557dc2aed71eabab13801693
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        .xml
        • Path /data/user/0/com.demash.drinkingclock/shared_prefs/.xml
        • Size 17KB
        • SHA256 3c724add8130c6cba5479f8c3463fe462b9f98b02e33587482e5b9f6258ebd81
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        FirebaseHeartBeatW0RFRkFVTFRd+MToyMTYxMjU2NDQyMjY6YW5kcm9pZDpiMTNhMzQyNGRkYzkxODJiYzI4YTVi.xml
        • Path /data/user/0/com.demash.drinkingclock/shared_prefs/FirebaseHeartBeatW0RFRkFVTFRd+MToyMTYxMjU2NDQyMjY6YW5kcm9pZDpiMTNhMzQyNGRkYzkxODJiYzI4YTVi.xml
        • Size 561B
        • SHA256 d1b4ab67599e6c6e7809d39b674a9c59512388068d5605fa9d2272d33d9400bd
        • MD5 SHA1 SHA512
        Submit Download

        FirebaseHeartBeatW0RFRkFVTFRd+MToyMTYxMjU2NDQyMjY6YW5kcm9pZDpiMTNhMzQyNGRkYzkxODJiYzI4YTVi.xml
        • Path /data/user/0/com.demash.drinkingclock/shared_prefs/FirebaseHeartBeatW0RFRkFVTFRd+MToyMTYxMjU2NDQyMjY6YW5kcm9pZDpiMTNhMzQyNGRkYzkxODJiYzI4YTVi.xml
        • Size 615B
        • SHA256 74eedfdc5b018db065362505435bd503f620f1b33fc338a83f926dabaaa39729
        • MD5 SHA1 SHA512
        Submit Download

        FirebaseHeartBeatW0RFRkFVTFRd+MToyMTYxMjU2NDQyMjY6YW5kcm9pZDpiMTNhMzQyNGRkYzkxODJiYzI4YTVi.xml
        • Path /data/user/0/com.demash.drinkingclock/shared_prefs/FirebaseHeartBeatW0RFRkFVTFRd+MToyMTYxMjU2NDQyMjY6YW5kcm9pZDpiMTNhMzQyNGRkYzkxODJiYzI4YTVi.xml
        • Size 178B
        • SHA256 b235ba0c58a0684bcadabe921b43605ab1b45c622030ca260ba1db58ff4fa6ea
        • MD5 SHA1 SHA512
        Submit Download

        WebViewChromiumPrefs.xml
        • Path /data/user/0/com.demash.drinkingclock/shared_prefs/WebViewChromiumPrefs.xml
        • Size 127B
        • SHA256 bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af
        • MD5 SHA1 SHA512
        Submit Download

        com.google.android.gms.measurement.prefs.xml
        • Path /data/user/0/com.demash.drinkingclock/shared_prefs/com.google.android.gms.measurement.prefs.xml
        • Size 395B
        • SHA256 ab3b94a66df9d5e3dd20957a59846e78fcdf7678aa2f90d1aec8e1f3e03a44b3
        • MD5 SHA1 SHA512
        Submit Download

        com.google.android.gms.measurement.prefs.xml
        • Path /data/user/0/com.demash.drinkingclock/shared_prefs/com.google.android.gms.measurement.prefs.xml
        • Size 557B
        • SHA256 3b5aa6da3316855fbc52a9c3d23449c801470cd4e87ad360ad3e6ea500ff4185
        • MD5 SHA1 SHA512
        Submit Download

        com.google.android.gms.measurement.prefs.xml
        • Path /data/user/0/com.demash.drinkingclock/shared_prefs/com.google.android.gms.measurement.prefs.xml
        • Size 558B
        • SHA256 02b024a7d477c7efa8a0a10f49a5be24b01bfc5ae6437b280d156ce5456a55a0
        • MD5 SHA1 SHA512
        Submit Download

        com.google.android.gms.measurement.prefs.xml
        • Path /data/user/0/com.demash.drinkingclock/shared_prefs/com.google.android.gms.measurement.prefs.xml
        • Size 754B
        • SHA256 193e1c221d0f6da1e185cbdbeedfd88e76595313639197e1f332fd02601f7764
        • MD5 SHA1 SHA512
        Submit Download

        com.google.android.gms.measurement.prefs.xml
        • Path /data/user/0/com.demash.drinkingclock/shared_prefs/com.google.android.gms.measurement.prefs.xml
        • Size 808B
        • SHA256 b42924b500a3e36ec40cfe8b9c981ce2443b8cdb93f81c9b05ead0ba22bbe91c
        • MD5 SHA1 SHA512
        Submit Download

        com.google.android.gms.measurement.prefs.xml
        • Path /data/user/0/com.demash.drinkingclock/shared_prefs/com.google.android.gms.measurement.prefs.xml
        • Size 862B
        • SHA256 9450840f7a8056c216456fb3bfa6ff4846a95d66151206584ab3e421bd1808c3
        • MD5 SHA1 SHA512
        Submit Download

        com.google.android.gms.measurement.prefs.xml
        • Path /data/user/0/com.demash.drinkingclock/shared_prefs/com.google.android.gms.measurement.prefs.xml
        • Size 915B
        • SHA256 15625a8d84cf0bb65c3f5f05321adfe82f4c2cbcceb85bc78123ddef7750cd23
        • MD5 SHA1 SHA512
        Submit Download

        com.google.android.gms.measurement.prefs.xml
        • Path /data/user/0/com.demash.drinkingclock/shared_prefs/com.google.android.gms.measurement.prefs.xml
        • Size 122B
        • SHA256 2478c97a377db9ce6a44977b4864a40af8b4f5e5c8f81892c424a608ddec911e
        • MD5 SHA1 SHA512
        Submit Download

        com.google.android.gms.measurement.prefs.xml
        • Path /data/user/0/com.demash.drinkingclock/shared_prefs/com.google.android.gms.measurement.prefs.xml
        • Size 998B
        • SHA256 c72997129a09e28accd0423d6a50be82828ff2fe2a40fcf5461fd7844a4b33a7
        • MD5 SHA1 SHA512
        Submit Download

        com.google.android.gms.measurement.prefs.xml
        • Path /data/user/0/com.demash.drinkingclock/shared_prefs/com.google.android.gms.measurement.prefs.xml
        • Size 1KB
        • SHA256 7d839c2eb49002c587daffdac575a59381aa4d69c7d66cf1439a887f39da7ef0
        • MD5 SHA1 SHA512
        Submit Download

        discount.xml
        • Path /data/user/0/com.demash.drinkingclock/shared_prefs/discount.xml
        • Size 113B
        • SHA256 781d7a108b47040bbf55405f9ab898ea91d3f55d9669b9e2608a95c7929dce52
        • MD5 SHA1 SHA512
        Submit Download

        frc_1:216125644226:android:b13a3424ddc9182bc28a5b_firebase_settings.xml
        • Path /data/user/0/com.demash.drinkingclock/shared_prefs/frc_1:216125644226:android:b13a3424ddc9182bc28a5b_firebase_settings.xml
        • Size 192B
        • SHA256 7f05d7cb45770366a9ff4cd979c8c75cc071c2bc506320281ab7885edaa059f5
        • MD5 SHA1 SHA512
        Submit Download

        frc_1:216125644226:android:b13a3424ddc9182bc28a5b_firebase_settings.xml
        • Path /data/user/0/com.demash.drinkingclock/shared_prefs/frc_1:216125644226:android:b13a3424ddc9182bc28a5b_firebase_settings.xml
        • Size 501B
        • SHA256 2c445a106fccb75f412425208a909a98b2456cc68f26262bca1ff482d21730a8
        • MD5 SHA1 SHA512
        Submit Download

        Anonymous-DexFile@0xe40f8000-0xe40fb4c0
        • Path Anonymous-DexFile@0xe40f8000-0xe40fb4c0
        • Size 13KB
        • SHA256 ce2da34c1eed6282cc177933f174800b8704d2a80c889fccd74908661e8876d2
        • MD5 SHA1 SHA512 SSDEEP
        Download