General

  • Target

    com.viewcastv.vanscreen.apk

  • Size

    7.8MB

  • Sample

    230126-v6j5ksee96

  • MD5

    dea8911e2f66aad91aaa2c1afb40c697

  • SHA1

    6aed964342314fc7fd5c0c3cb6f2ef1814472916

  • SHA256

    78ac85085e2f01f0f2ac6d0c48865bbc060847241db7fddf4706d058a2d29f52

  • SHA512

    5143cdeba9b75c657a567ddd350049c806f886557eb0480457fd43fd47bdcca7cdd169d2d6560427a3b56139371119b3247eaeff6a9c4affc0519cac30f10658

  • SSDEEP

    196608:uW8ue33R0MzwyB2gof+ZXqzlEGKN9UGa5Qep:IZ33RZFhokahEG5

Malware Config

Extracted

Family

joker

C2

https://weco.oss-eu-central-1.aliyuncs.com/simple

https://weco.oss-eu-central-1.aliyuncs.com/test_kbnt

Targets

    • Target

      com.viewcastv.vanscreen.apk

    • Size

      7.8MB

    • MD5

      dea8911e2f66aad91aaa2c1afb40c697

    • SHA1

      6aed964342314fc7fd5c0c3cb6f2ef1814472916

    • SHA256

      78ac85085e2f01f0f2ac6d0c48865bbc060847241db7fddf4706d058a2d29f52

    • SHA512

      5143cdeba9b75c657a567ddd350049c806f886557eb0480457fd43fd47bdcca7cdd169d2d6560427a3b56139371119b3247eaeff6a9c4affc0519cac30f10658

    • SSDEEP

      196608:uW8ue33R0MzwyB2gof+ZXqzlEGKN9UGa5Qep:IZ33RZFhokahEG5

    • joker

      Joker is an Android malware that targets billing and SMS fraud.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Queries the unique device ID (IMEI, MEID, IMSI).

    • Legitimate hosting services abused for malware hosting/C2

    • Reads information about phone network operator.

    • Removes a system notification.

    • Uses Crypto APIs (Might try to encrypt user data).

MITRE ATT&CK Enterprise v6

Tasks