joker | 8c2e3c0c7fd591f1377e9318fbcfbcae85db4875a2f405b99da46edf9b70eefc

Analysis

max time kernel
3574106s
max time network
131s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
21-01-2023 16:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Phone Cleaner Lite_2.1.1.apk
Size

3.9MB
MD5

017613c945f5b8f07ea88dce7629a1ff
SHA1

5da104368c047b40ba07aace5bf21f38ed10aec7
SHA256

8c2e3c0c7fd591f1377e9318fbcfbcae85db4875a2f405b99da46edf9b70eefc
SHA512

7708f0ed3bb2a8f09be525519ef30c6d47b406088fb1e2906852028b490777efce8cdf4765546c6f35870b544e6349f2d87254a55f8c100b5c665abdc823cbad
SSDEEP

98304:ZalsueP6Gt15eSye4RHIKWLdNA3u/l7JMTndWvfrBwJ:ysuXy1wq4RHInLM+/l7I2w

Score

10^/10

joker evasion infostealer trojan

Malware Config

Extracted

Family

joker

https://weco.oss-eu-central-1.aliyuncs.com/simple

https://weco.oss-eu-central-1.aliyuncs.com/test_kbnt

Signatures

joker
Joker is an Android malware that targets billing and SMS fraud.
infostealer trojan joker

Loads dropped Dex/Jar 5 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
Anonymous-DexFile@0xe34b8000-0xe34bb4c0	4092	com.skyclean.clearlite
/data/user/0/com.skyclean.clearlite/files/zzxqmsm	4092	com.skyclean.clearlite
/data/user/0/com.skyclean.clearlite/files/zzxqmsm	4092	com.skyclean.clearlite
/data/user/0/com.skyclean.clearlite/files/zzxqmsm	4092	com.skyclean.clearlite
/data/user/0/com.skyclean.clearlite/files/zzxqmsm	4092	com.skyclean.clearlite

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Reads information about phone network operator.

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.skyclean.clearlite

com.skyclean.clearlite
1⤵
- Loads dropped Dex/Jar
- Removes a system notification.
PID:4092

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.skyclean.clearlite/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.skyclean.clearlite/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
80b501a0c514d410ce490da8e8a31263

SHA1
5bcaa4802ff3b0c785612b315d6f42f7f7889337

SHA256
d895c145d9f083659183bb5e627b5a9d1851ecddce8bab94d6f771322615b1da

SHA512
a48c341d0a5352725f32271a480d8b5553958f6a814cf10d4fd2ecf3b4ac657005b629a8da33642afa1fef27be09b1c627755264fd41c899ab5613320247bb32

Download Submit
/data/user/0/com.skyclean.clearlite/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/com.skyclean.clearlite/app_webview/Web Data-journal

Filesize
1KB

MD5
3162e43a14bb15545b86503586f84e10

SHA1
b31da9466b0e1cc5e4d165f9273757b5f6d5497e

SHA256
954fd69bb86baabf37b0e2c3543463f20420ed8bc8ec27470a48e6670cfeaec9

SHA512
36827d6ae8fc2af584c8cc390c227a107fcc0101db41d020503c5de4cb258fc94ceac316fe03f3cc5161aa48917166ca6715b904aac0c874b89173a4d330a0c5

Download Submit
/data/user/0/com.skyclean.clearlite/app_webview/metrics_guid

Filesize
36B

MD5
1b0a9af5b037744b01839ab3c14a3822

SHA1
30ea7da9128f06b795ae23cb345c18fefa483320

SHA256
c73dccbb8a41da5cd61ba174797956aa257b025a6daebb3543af777db6bcde46

SHA512
2f90534247e6426a854166043df322f5325a163104cebcbcad85830a505bdfa5c9d7d49cb5a58b132ae269fce4c3f7bb27e97676e2dd81581a9eece1d8cb9e60

Download Submit
/data/user/0/com.skyclean.clearlite/files/UnityAdsStorage-private-data.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
/data/user/0/com.skyclean.clearlite/files/UnityAdsStorage-public-data.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
/data/user/0/com.skyclean.clearlite/files/zzxqmsm

Filesize
26KB

MD5
3e314b1a29a1fa6ec13b1ff61e491df3

SHA1
b3aab4df657ca4bb2b44407fbc770433bb44affa

SHA256
5b8461ad3722b20598638abab3ec9f9c743b1feb0c848ed84ee7e1d34f28270f

SHA512
3e2d6f1997f3647aa5a6a400f97f1a08f8456b777d733efc9084de9a8dff9ba8f55dc9e4b3b4cf378da1ce2446dbca9efaa2e3d4c14eebf6e5da92751b2697d4

Download Submit
/data/user/0/com.skyclean.clearlite/files/zzxqmsm

Filesize
26KB

MD5
3e314b1a29a1fa6ec13b1ff61e491df3

SHA1
b3aab4df657ca4bb2b44407fbc770433bb44affa

SHA256
5b8461ad3722b20598638abab3ec9f9c743b1feb0c848ed84ee7e1d34f28270f

SHA512
3e2d6f1997f3647aa5a6a400f97f1a08f8456b777d733efc9084de9a8dff9ba8f55dc9e4b3b4cf378da1ce2446dbca9efaa2e3d4c14eebf6e5da92751b2697d4

Download Submit
/data/user/0/com.skyclean.clearlite/files/zzxqmsm

Filesize
26KB

MD5
3e314b1a29a1fa6ec13b1ff61e491df3

SHA1
b3aab4df657ca4bb2b44407fbc770433bb44affa

SHA256
5b8461ad3722b20598638abab3ec9f9c743b1feb0c848ed84ee7e1d34f28270f

SHA512
3e2d6f1997f3647aa5a6a400f97f1a08f8456b777d733efc9084de9a8dff9ba8f55dc9e4b3b4cf378da1ce2446dbca9efaa2e3d4c14eebf6e5da92751b2697d4

Download Submit
/data/user/0/com.skyclean.clearlite/files/zzxqmsm

Filesize
26KB

MD5
3e314b1a29a1fa6ec13b1ff61e491df3

SHA1
b3aab4df657ca4bb2b44407fbc770433bb44affa

SHA256
5b8461ad3722b20598638abab3ec9f9c743b1feb0c848ed84ee7e1d34f28270f

SHA512
3e2d6f1997f3647aa5a6a400f97f1a08f8456b777d733efc9084de9a8dff9ba8f55dc9e4b3b4cf378da1ce2446dbca9efaa2e3d4c14eebf6e5da92751b2697d4

Download Submit
/data/user/0/com.skyclean.clearlite/files/zzxqmsm

Filesize
26KB

MD5
3e314b1a29a1fa6ec13b1ff61e491df3

SHA1
b3aab4df657ca4bb2b44407fbc770433bb44affa

SHA256
5b8461ad3722b20598638abab3ec9f9c743b1feb0c848ed84ee7e1d34f28270f

SHA512
3e2d6f1997f3647aa5a6a400f97f1a08f8456b777d733efc9084de9a8dff9ba8f55dc9e4b3b4cf378da1ce2446dbca9efaa2e3d4c14eebf6e5da92751b2697d4

Download Submit
/data/user/0/com.skyclean.clearlite/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit
/storage/emulated/0/Android/data/com.skyclean.clearlite/cache/UnityAdsCache/UnityAdsCache-5d4b0588fcfd4168e5a4415df66f95364f3101a47843d76e0f4d1d94873843f7.mp4

Filesize
3.4MB

MD5
8df2fcf71a5d4f4468f1874b94e9219e

SHA1
cf2e3eb5f4101c1c40539bd04cb204a72e83f645

SHA256
1cb9e1d27d3a289fef1d86fddd21462074266364989b7aaf40741fe90bca60e6

SHA512
c03312d7fae6b39a52755a09ea47a6cecdb84d0c9f64e58a243a3332895782a6fc6d5515d80acdd1d925d0d377f244cd73df7d781107f452349d1bd4ac0e0d36

Download Submit
/storage/emulated/0/Android/data/com.skyclean.clearlite/cache/UnityAdsCache/UnityAdsCache-a0a4a2de6bffab62c83b55c9dcf9383d4d3018463924a0f9d375146b9fe57906.jpg

Filesize
10KB

MD5
9fd624de1ef80a5a49046ef3d02eafe6

SHA1
b2ef49e28757bbd481036bd64b20267becb67e28

SHA256
be88733b4829dcd977105d4b3fae9f4f175c77547192c8a58362d6ea8534b43b

SHA512
bac7c58dddde9179b52b9a80dc92ab51fd986d629a20ccae8b0575ff1355a749bcb542c42b0ee854fdc002e4cf760681f2c495c7e6cb7636cb37a8415e3e9000

Download Submit
/storage/emulated/0/Android/data/com.skyclean.clearlite/cache/UnityAdsCache/UnityAdsTest.txt

Filesize
4B

MD5
098f6bcd4621d373cade4e832627b4f6

SHA1
a94a8fe5ccb19ba61c4c0873d391e987982fbbd3

SHA256
9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08

SHA512
ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

Download Submit
/storage/emulated/0/Android/data/com.skyclean.clearlite/cache/UnityAdsCache/UnityAdsTest.txt

Filesize
4B

MD5
098f6bcd4621d373cade4e832627b4f6

SHA1
a94a8fe5ccb19ba61c4c0873d391e987982fbbd3

SHA256
9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08

SHA512
ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

Download Submit
/storage/emulated/0/Android/data/com.skyclean.clearlite/cache/UnityAdsCache/UnityAdsWebApp.html

Filesize
1.8MB

MD5
6e932cff883464988485f22f1b7280de

SHA1
392b18b6b6172edbb1ae57456054a34479947e1c

SHA256
a1508dd6363c9eda0757890b6f6d800a01a9520354074da1eb15b5142ecbe354

SHA512
9de1d67b4c66ce102139e0d8b1b1e110426ec590e9e62e20b56de46adafe70474df2e062381a4b0185800b0208306678c6282237935885d5a5414d9021e36b43

Download Submit
Anonymous-DexFile@0xe34b8000-0xe34bb4c0

Filesize
13KB

MD5
665767f2c11ef8f609ed38bf23d5db97

SHA1
cf7ee39599a508e83a9dc49e55c48bc8c2846591

SHA256
dca2d34d6881cfa25c089d49e7f0e4b4fed7851e8443eae4ac3ddf9b4fa5107b

SHA512
4353f7c251a065fbd28ee71b1d0193b2cd2e8f57d2ef6e2bc6a1b7be65fb01f4415b14a8303970f183ee02635b97b0a3f26df22fa5ee58f722ec7895db907511

Download Submit