joker | a88df36beb7dcd200c917fb29c0702333d1bdf78b7e1b67c7614e0caec81c50a

General

Target

a88df36beb7dcd200c917fb29c0702333d1bdf78b7e1b67c7614e0caec81c50a
Size

5.6MB
MD5

e1cf307b7f2c86aecb21467733430027
SHA1

c3ebdeab5e4ff2f5c94f587126df812f33294859
SHA256

a88df36beb7dcd200c917fb29c0702333d1bdf78b7e1b67c7614e0caec81c50a
SHA512

64a6c32930f5e54b9e4d6c5f43e13cb9c90896642fcbb838b88bdf5c92c3e569903f95fe29f30f351d2e61131ca01e8075ffe1e7acbecf2c5cb4092c29eb8b17
SSDEEP

98304:mlBcuJwRN0pxV2LYCO7SFHJ9vgYOr9po/LxyuUNyhXHcBSm0xDY5eFM1ZTVsEURe:m0StE9vglr9SLQuUNGX8MxDfM1ZpCPm

Score

10^/10

joker

Malware Config

Extracted

Family

joker

C2

http://www.o2omobi.com

Signatures

Joker family
joker
Declares services with permission to bind to the system 1 IoCs

Processes:

description ioc

Required by wallpaper services to bind with the system. Allows apps to provide live wallpapers. android.permission.BIND_WALLPAPER

description	ioc
Required by wallpaper services to bind with the system. Allows apps to provide live wallpapers.	android.permission.BIND_WALLPAPER

Requests dangerous framework permissions 5 IoCs

Processes:

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION

Files

a88df36beb7dcd200c917fb29c0702333d1bdf78b7e1b67c7614e0caec81c50a
.apk android arch:arm

com.lyhj.game.fruitsmasher

com.game.combo.GameMain

Activities

com.game.combo.GameMain

android.intent.action.MAIN

com.otomod.ad.AdActivity

com.otomod.ad.shortcut

Permissions

android.permission.INTERNET
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.READ_PHONE_STATE
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.GET_TASKS
android.permission.WAKE_LOCK
android.permission.ACCESS_COARSE_LOCATION
android.permission.SYSTEM_ALERT_WINDOW
android.permission.ACCESS_FINE_LOCATION
android.permission.RESTART_PACKAGES

Receivers

com.play.mylist.PlayReceiver

action.cust.point.process_main
action.cust.point.process_vip
action.cust.downloaded

com.otomod.ad.DownloadCompleteReceiver

android.intent.action.DOWNLOAD_COMPLETE

com.pubukeji.diandeows.reciever.AppInstalledReceiver

android.intent.action.PACKAGE_ADDED
android.intent.action.PACKAGE_REMOVED

com.game.fruit.MyWidgetProvider

android.appwidget.action.APPWIDGET_UPDATE

Services

org.OpenUDID.OpenUDID_service

org.openudid.GETUDID

com.game.fruit.MyWallpaper

android.service.wallpaper.WallpaperService

a88df36beb7dcd200c917fb29c0702333d1bdf78b7e1b67c7614e0caec81c50a

Permissions

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.READ_PHONE_STATE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.GET_TASKS

android.permission.WAKE_LOCK

android.permission.ACCESS_COARSE_LOCATION

android.permission.SYSTEM_ALERT_WINDOW

android.permission.ACCESS_FINE_LOCATION

android.permission.RESTART_PACKAGES

Sharing

General

Malware Config

Extracted

Signatures

Files

com.lyhj.game.fruitsmasher

com.game.combo.GameMain

Activities

com.game.combo.GameMain

com.otomod.ad.AdActivity

Permissions

Receivers

com.play.mylist.PlayReceiver

com.otomod.ad.DownloadCompleteReceiver

com.pubukeji.diandeows.reciever.AppInstalledReceiver

com.game.fruit.MyWidgetProvider

Services

org.OpenUDID.OpenUDID_service

com.game.fruit.MyWallpaper

Android Permissions

a88df36beb7dcd200c917fb29c0702333d1bdf78b7e1b67c7614e0caec81c50a