General

  • Target

    23de146d15a74316c9a3739a2c48535a_JaffaCakes118

  • Size

    23.0MB

  • MD5

    23de146d15a74316c9a3739a2c48535a

  • SHA1

    a5da6b2777537835e391f1708c543fd40b27494f

  • SHA256

    6be5484d167ba3fadf873b0344fc1d9246644ad85bcffc7a37b21faa0bee62fc

  • SHA512

    b18395845c9f9a569efe4d53865f779787dfa3d5cb0baa2754f7a878e2cb58178c62db9af53fe4881859124ad19ff5cdb7434e5bc07423bad4efdb31d8b33b3f

  • SSDEEP

    393216:pBpgP9fjk6C3ZH0lRkdTQs5ptyonvxUxFSVoL4ro:pIFkfZU7kHsonvCxk+L4ro

Score
10/10

Malware Config

Extracted

Family

joker

C2

http://192.168.1.35:8090/

Signatures

  • Joker family
  • Requests dangerous framework permissions 9 IoCs

Files

  • 23de146d15a74316c9a3739a2c48535a_JaffaCakes118
    .apk android arch:arm

    com.happyteam.dubbingshow

    .ui.StartActivity


  • CommonPlugin-3.3.apk
    .apk android

    com.taobao.munion.plugin.cm

    com.taobao.newxp.view.UMDetail


  • FrameworkPlugin-3.0.apk
    .apk android

    com.example.bizplugin


  • WelcomePlugin-2.3.apk
    .apk android

    com.alimama.mobile.sdk.welcome


  • __pasys_remote_banner.jar
    .apk android
  • gdtad.jar
    .apk android

Android Permissions

23de146d15a74316c9a3739a2c48535a_JaffaCakes118

Permissions

android.permission.MOUNT_UNMOUNT_FILESYSTEMS

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.RECORD_AUDIO

android.permission.READ_EXTERNAL_STORAGE

android.permission.MODIFY_AUDIO_SETTINGS

android.permission.INTERACT_ACROSS_USERS_FULL

android.permission.INTERNET

android.permission.READ_PHONE_STATE

android.permission.ACCESS_NETWORK_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.WAKE_LOCK

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.VIBRATE

android.permission.ACCESS_WIFI_STATE

getui.permission.GetuiService.com.happyteam.dubbingshow

android.permission.GET_TASKS

android.permission.ACCESS_COARSE_LOCATION

android.permission.READ_LOGS

android.permission.WRITE_SETTINGS

android.permission.ACCESS_COARSE_LOCATION

android.permission.CAMERA

android.permission.ACCESS_MOCK_LOCATION

android.permission.ACCESS_COARSE_UPDATES

com.android.launcher.permission.INSTALL_SHORTCUT

android.permission.ACCESS_FINE_LOCATION