General

  • Target

    com.currentapp.excsmartcurrencyexchange.apk

  • Size

    11.7MB

  • Sample

    230408-rg93xsfe8w

  • MD5

    2e1536e5c416ab1ea2669003d370e12a

  • SHA1

    eaf941d0901703333432180e3ed99af62bc8bde6

  • SHA256

    f769f559b6f99497590aaeb316e9c0991cc29b1009fb29fee14444b22505ea76

  • SHA512

    be1ede2df396e5d0d307c7dcd6b5c872746d59454e69def3ce1adeaa903327086dd40fe66cdc3b82fd77a755cb1500fa60fd805f8bec90aad0134b7b29f764d5

  • SSDEEP

    196608:5eSu/WALr3vVUXl/TzoKSuxfvDeXY7nIyggTMqUYIRCNJcHZ9rxy2d:gSKP32BzjS8jeaTggTUY+0Jcdy4

Malware Config

Extracted

Family

joker

C2

https://adcbk.oss-eu-central-1.aliyuncs.com/af2

https://adcbk.oss-eu-central-1.aliyuncs.com/fbhx

Targets

    • Target

      com.currentapp.excsmartcurrencyexchange.apk

    • Size

      11.7MB

    • MD5

      2e1536e5c416ab1ea2669003d370e12a

    • SHA1

      eaf941d0901703333432180e3ed99af62bc8bde6

    • SHA256

      f769f559b6f99497590aaeb316e9c0991cc29b1009fb29fee14444b22505ea76

    • SHA512

      be1ede2df396e5d0d307c7dcd6b5c872746d59454e69def3ce1adeaa903327086dd40fe66cdc3b82fd77a755cb1500fa60fd805f8bec90aad0134b7b29f764d5

    • SSDEEP

      196608:5eSu/WALr3vVUXl/TzoKSuxfvDeXY7nIyggTMqUYIRCNJcHZ9rxy2d:gSKP32BzjS8jeaTggTUY+0Jcdy4

    • joker

      Joker is an Android malware that targets billing and SMS fraud.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Reads information about phone network operator.

MITRE ATT&CK Matrix

Tasks