joker | 0ef1812b12b096aeea49493db5f8e144_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
0ef1812b12b096aeea49493db5f8e144_JaffaCakes118
Size 9.7MB
Sample240502-tetz2aed54
SHA256 2e812b6b5ef4b43cc457c609aa625924fcb9bae76175e4f5d355ee864c219198
MD5 0ef1812b12b096aeea49493db5f8e144
SHA1 c6019aa08f1158110c2738d7df0d63685660b5d8
SHA512 cf9b75cca98f755b6d196ad198b6170288ca934006ef794e4d3168cfca70e27402294866d7f245de24784031e7253bfc138457514401570a3ca4a6a2cce9dcb6
SSDEEP 196608:Dr21hKhjNcwKWfKr2CJgwW1UaxIDoRXKriz60rv6BsizddiU49q+P1:DrYQBxKfr2eZaxIDoRE/pdcfP1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

joker

Malware Config

Extracted

Family

joker

http://config.inmobi.com/config-server/v1/config/secure.cfg
http://i.w.inmobi.com/showad.asm

Signatures

Joker family
joker

Requests dangerous framework permissions 7 IoCs

description	ioc
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW

File Explorer

0ef1812b12b096aeea49493db5f8e144_JaffaCakes118

.apk 9.7MB
BannerPlugin-3.0.apk

.apk 44KB
CommonPlugin-4.6.apk

.apk 505KB
FrameworkPlugin-3.4.apk

.apk 18KB
__xadsdk__remote__final__.jar

.apk 83KB
gdtadv2.jar

.apk 128KB

0ef1812b12b096aeea49493db5f8e144_JaffaCakes118

SHA256 2e812b6b5ef4b43cc457c609aa625924fcb9bae76175e4f5d355ee864c219198
MD5 0ef1812b12b096aeea49493db5f8e144
SHA1 c6019aa08f1158110c2738d7df0d63685660b5d8
SHA512 cf9b75cca98f755b6d196ad198b6170288ca934006ef794e4d3168cfca70e27402294866d7f245de24784031e7253bfc138457514401570a3ca4a6a2cce9dcb6
SSDEEP 196608:Dr21hKhjNcwKWfKr2CJgwW1UaxIDoRXKriz60rv6BsizddiU49q+P1:DrYQBxKfr2eZaxIDoRE/pdcfP1
MD5 SHA1 SHA512 SSDEEP

android arch:arm

com.lemon.play.supertractor

Android Permissions

0ef1812b12b096aeea49493db5f8e144_JaffaCakes118

Permissions

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACCESS_FINE_LOCATION

android.permission.WRITE_SETTINGS

android.permission.READ_PHONE_STATE

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.CHANGE_CONFIGURATION

android.permission.CHANGE_WIFI_STATE

android.permission.CHANGE_NETWORK_STATE

android.permission.INTERNET

android.permission.READ_LOGS

android.permission.SYSTEM_ALERT_WINDOW

android.permission.INTERACT_ACROSS_USERS_FULL

android.permission.VIBRATE

0ef1812b12b096aeea49493db5f8e144_JaffaCakes118

.MainUI

.Settings

com.alimama.mobile.sdk.shell.MMUDetail

com.alimama.mobile.sdk.shell.MMUBrowserWebView

com.baidu.mobads.AppActivity

com.qq.e.ads.ADActivity

com.inmobi.rendering.InMobiAdActivity

com.alimama.mobile.sdk.shell.DownloadingService

com.qq.e.comm.DownloadService

BannerPlugin-3.0.apk

com.alimama.mobile.plugin.banner.service.MainActivity

CommonPlugin-4.6.apk

com.taobao.test.MainActivity

FrameworkPlugin-3.4.apk

xadsdkremotefinal.jar

gdtadv2.jar

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

0ef1812b12b096aeea49493db5f8e144_JaffaCakes118

.MainUI

.Settings

com.alimama.mobile.sdk.shell.MMUDetail

com.alimama.mobile.sdk.shell.MMUBrowserWebView

com.baidu.mobads.AppActivity

com.qq.e.ads.ADActivity

com.inmobi.rendering.InMobiAdActivity

com.alimama.mobile.sdk.shell.DownloadingService

com.qq.e.comm.DownloadService

BannerPlugin-3.0.apk

com.alimama.mobile.plugin.banner.service.MainActivity

CommonPlugin-4.6.apk

com.taobao.test.MainActivity

FrameworkPlugin-3.4.apk

__xadsdk__remote__final__.jar

gdtadv2.jar

Android Permissions

0ef1812b12b096aeea49493db5f8e144_JaffaCakes118

xadsdkremotefinal.jar