joker | 4c4aee3edfc39d75267829eabe749f40

General

Target
4c4aee3edfc39d75267829eabe749f40
Size 6.9MB
Sample240108-ye5traghe2
SHA256 a3b2242a29ffb44a1ccfab7034828f0e00194148b0947797b1c9a9363f5844b9
MD5 4c4aee3edfc39d75267829eabe749f40
SHA1 375c1000beeabccc3c69ffe800780fe6bfc1e0bd
SHA512 89a4c60c56f18f6de0e739ceeb1ac724f6d553692ecfebaa8cc1f054c5629cd8c90717a4d0858ab3829ab2cead9fc55828ad69e009a8a4f33025cb7f04e88326
SSDEEP 196608:c5HODLoLEFcJdfVE5tag5PAMZ5njILPfnuGILZwW4eAP8:cZODML4cJdfVOQsA6n2P2GIVVH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

joker

Malware Config

Extracted

Family

joker

C2

http://www.o2omobi.com

Signatures

Joker family
joker

Requests dangerous framework permissions 4 IoCs

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW

File Explorer

4c4aee3edfc39d75267829eabe749f40

.apk 6.9MB

4c4aee3edfc39d75267829eabe749f40

SHA256 a3b2242a29ffb44a1ccfab7034828f0e00194148b0947797b1c9a9363f5844b9
MD5 4c4aee3edfc39d75267829eabe749f40
SHA1 375c1000beeabccc3c69ffe800780fe6bfc1e0bd
SHA512 89a4c60c56f18f6de0e739ceeb1ac724f6d553692ecfebaa8cc1f054c5629cd8c90717a4d0858ab3829ab2cead9fc55828ad69e009a8a4f33025cb7f04e88326
SSDEEP 196608:c5HODLoLEFcJdfVE5tag5PAMZ5njILPfnuGILZwW4eAP8:cZODML4cJdfVOQsA6n2P2GIVVH
MD5 SHA1 SHA512 SSDEEP

android arch:arm

com.zl.game.petline

Android Permissions

4c4aee3edfc39d75267829eabe749f40

Permissions

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.READ_PHONE_STATE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.GET_TASKS

android.permission.WAKE_LOCK

android.permission.ACCESS_COARSE_LOCATION

android.permission.SYSTEM_ALERT_WINDOW

4c4aee3edfc39d75267829eabe749f40

com.game.combo.GameMain

com.play.mylist.SmartListActivity

com.play.mylist.MoreActivity

com.otomod.ad.AdActivity

com.qihoo.gamead.activity.LightAppActivity

com.qihoo.gamead.activity.AppDetailActivity

com.qihoo.psdk.app.QStatActivity

org.OpenUDID.OpenUDID_service

com.qihoo.gamead.download.DownloadService

com.qihoo.gamead.event.QEventService

com.qihoo.psdk.remote.QRemoteService

com.qihoo.psdk.local.QLocalService

com.play.mylist.PlayReceiver

com.otomod.ad.DownloadCompleteReceiver

com.qihoo.psdk.local.QBootReceiver

com.otomod.ad.provider.ImageProvider

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

4c4aee3edfc39d75267829eabe749f40

com.game.combo.GameMain

com.play.mylist.SmartListActivity

com.play.mylist.MoreActivity

com.otomod.ad.AdActivity

com.qihoo.gamead.activity.LightAppActivity

com.qihoo.gamead.activity.AppDetailActivity

com.qihoo.psdk.app.QStatActivity

org.OpenUDID.OpenUDID_service

com.qihoo.gamead.download.DownloadService

com.qihoo.gamead.event.QEventService

com.qihoo.psdk.remote.QRemoteService

com.qihoo.psdk.local.QLocalService

com.play.mylist.PlayReceiver

com.otomod.ad.DownloadCompleteReceiver

com.qihoo.psdk.local.QBootReceiver

com.otomod.ad.provider.ImageProvider

Android Permissions

4c4aee3edfc39d75267829eabe749f40