General

  • Target

    1432f13c0215b7974a935e32b0c6c40e_JaffaCakes118

  • Size

    7.1MB

  • MD5

    1432f13c0215b7974a935e32b0c6c40e

  • SHA1

    62d2fe12da304c8d9a4036410165abbb5485645c

  • SHA256

    00246372aec3d68e060bb2596ce28717e1108ff664b96ab3f8a526c093e2ff86

  • SHA512

    0702703fcf474fe263ad481c184ed6f0c1fea04b4835f10bf9c36c05559ab07394440b38548aa45de16a4256537000c88d9baf0c1b810dd3f581190a33361044

  • SSDEEP

    196608:2IuRriC65Ct5rLjAO/9E9ZM+YOP+Rp00yk1STcyHlNUeVEOH0RdeQsbB8l:Xu835C7PZlELM+YOP+Rp00ye0HlNUeDI

Score
10/10

Malware Config

Extracted

Family

joker

C2

http://www.appshare.cn/

Signatures

  • Joker family
  • Requests dangerous framework permissions 11 IoCs

Files

  • 1432f13c0215b7974a935e32b0c6c40e_JaffaCakes118
    .apk android arch:arm

    com.appshare.android.istory

    com.appshare.android.istory.WelcomeActivity


  • CommonPlugin-4.3.apk
    .apk android

    com.taobao.munion.plugin.cm

    com.taobao.test.MainActivity


  • FrameworkPlugin-3.3.apk
    .apk android

    com.taobao.munion.plugin.framework


  • WelcomePlugin-2.9.apk
    .apk android

    com.alimama.mobile.sdk.welcome


  • __xadsdk__remote__final__.jar
    .apk android

Android Permissions

1432f13c0215b7974a935e32b0c6c40e_JaffaCakes118

Permissions

android.permission.ACCESS_WIFI_STATE

android.permission.ACCESS_NETWORK_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.INTERNET

android.permission.ACCESS_WIFI_STATE

android.permission.ACCESS_NETWORK_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.READ_PHONE_STATE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.INTERNET

android.permission.MOUNT_UNMOUNT_FILESYSTEMS

android.permission.READ_LOGS

android.permission.WRITE_SETTINGS

android.permission.VIBRATE

android.permission.GET_TASKS

android.permission.CHANGE_CONFIGURATION

com.android.launcher.permission.READ_SETTINGS

android.permission.INTERNET

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.REORDER_TASKS

android.permission.ACCESS_WIFI_STATE

android.permission.READ_PHONE_STATE

android.permission.ACCESS_NETWORK_STATE

android.permission.READ_LOGS

com.android.launcher.permission.INSTALL_SHORTCUT

android.permission.PROCESS_OUTGOING_CALLS

android.permission.RECORD_AUDIO

android.permission.CHANGE_NETWORK_STATE

android.permission.WAKE_LOCK

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.BROADCAST_PACKAGE_ADDED

android.permission.BROADCAST_PACKAGE_CHANGED

android.permission.BROADCAST_PACKAGE_INSTALL

android.permission.BROADCAST_PACKAGE_REPLACED

android.permission.RESTART_PACKAGES

android.permission.GET_ACCOUNTS

android.permission.SEND_SMS

android.permission.RECEIVE_SMS

android.permission.READ_SMS