joker | 246497a50586703fe1b19858946d0998_JaffaCakes118

General

Target
246497a50586703fe1b19858946d0998_JaffaCakes118
Size 30.8MB
Sample240508-mdbzhaff4v
SHA256 aeacd50cf503033b844c1d556830e23067a9af8e05f79d3a9448e2fc2835190f
MD5 246497a50586703fe1b19858946d0998
SHA1 854762a7dec7f3fba875e3173ba5b3456aa10df3
SHA512 2ff6b858836795f5970bf667a9e734da96dccfd2df68484a56bb7ac5d1464694a6a1c0e27c67703c765d5298c3dd157a1378c729d1e18a98148b806601edf792
SSDEEP 786432:AyqW7k8Vjuekf1Gi+cqA59rXodRZ12nzS7P5Thbrf0PD:TI8Vjlkf1S0Xkd52nzcbrsPD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

joker

Malware Config

Extracted

Family

joker

C2

https://open.weixin.qq.com/connect/sdk/qrconnect?appid=%s&noncestr=%s&timestamp=%s&scope=%s&signature=%s

Signatures

Joker family
joker

Requests dangerous framework permissions 15 IoCs

description	ioc
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to write the user's contacts data.	android.permission.WRITE_CONTACTS
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Required to be able to access the camera device.	android.permission.CAMERA
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows an application to write and read the user's call log data.	android.permission.WRITE_CALL_LOG

File Explorer

246497a50586703fe1b19858946d0998_JaffaCakes118

.apk 30.8MB

246497a50586703fe1b19858946d0998_JaffaCakes118

SHA256 aeacd50cf503033b844c1d556830e23067a9af8e05f79d3a9448e2fc2835190f
MD5 246497a50586703fe1b19858946d0998
SHA1 854762a7dec7f3fba875e3173ba5b3456aa10df3
SHA512 2ff6b858836795f5970bf667a9e734da96dccfd2df68484a56bb7ac5d1464694a6a1c0e27c67703c765d5298c3dd157a1378c729d1e18a98148b806601edf792
SSDEEP 786432:AyqW7k8Vjuekf1Gi+cqA59rXodRZ12nzS7P5Thbrf0PD:TI8Vjlkf1S0Xkd52nzcbrsPD
MD5 SHA1 SHA512 SSDEEP

android arch:arm arch:x86

io.dcloud.H5ECEDBEC

android.permission.INTERNET android.permission.WRITE_EXTERNAL_STORAGE android.permission.ACCESS_NETWORK_STATE android.permission.CHANGE_NETWORK_STATE android.permission.ACCESS_WIFI_STATE android.permission.GET_TASKS android.permission.MOUNT_UNMOUNT_FILESYSTEMS android.permission.READ_CONTACTS android.permission.VIBRATE android.permission.READ_LOGS android.permission.WRITE_CONTACTS android.permission.SYSTEM_ALERT_WINDOW android.permission.RECEIVE_BOOT_COMPLETED com.android.launcher.permission.UNINSTALL_SHORTCUT android.permission.CAMERA android.permission.GET_ACCOUNTS android.permission.RECORD_AUDIO android.permission.MODIFY_AUDIO_SETTINGS com.android.launcher.permission.INSTALL_SHORTCUT android.permission.READ_PHONE_STATE android.permission.CHANGE_WIFI_STATE android.permission.WAKE_LOCK android.permission.FLASHLIGHT android.permission.CALL_PHONE android.permission.ACCESS_COARSE_LOCATION android.permission.ACCESS_FINE_LOCATION android.permission.RECEIVE_USER_PRESENT android.permission.WRITE_SETTINGS android.permission.READ_EXTERNAL_STORAGE android.permission.READ_CALL_LOG android.permission.WRITE_CALL_LOG com.huawei.android.launcher.permission.CHANGE_BADGE com.android.launcher.permission.READ_SETTINGS com.android.launcher2.permission.READ_SETTINGS com.android.launcher3.permission.READ_SETTINGS com.yulong.android.launcherL.permission.READ_SETTINGS com.meizu.flyme.launcher.permission.READ_SETTINGS com.bbk.launcher2.permission.READ_SETTINGS com.oppo.launcher.permission.READ_SETTINGS com.htc.launcher.permission.READ_SETTINGS com.qiku.launcher.permission.READ_SETTINGS com.huawei.android.launcher.permission.READ_SETTINGS com.zte.mifavor.launcher.permission.READ_SETTINGS com.lenovo.launcher.permission.READ_SETTINGS com.google.android.launcher.permission.READ_SETTINGS com.yulong.android.launcher3.READ_SETTINGS org.adw.launcher.permission.READ_SETTINGS com.qihoo360.launcher.permission.READ_SETTINGS com.lge.launcher.permission.READ_SETTINGS net.qihoo.launcher.permission.READ_SETTINGS org.adwfreak.launcher.permission.READ_SETTINGS org.adw.launcher_donut.permission.READ_SETTINGS com.huawei.launcher3.permission.READ_SETTINGS com.fede.launcher.permission.READ_SETTINGS com.sec.android.app.twlauncher.settings.READ_SETTINGS com.tencent.qqlauncher.permission.READ_SETTINGS com.huawei.launcher2.permission.READ_SETTINGS com.ebproductions.android.launcher.permission.READ_SETTINGS com.nd.android.launcher.permission.READ_SETTINGS com.yulong.android.launcher.permission.READ_SETTINGS com.android.mylauncher.permission.READ_SETTINGS com.ztemt.launcher.permission.READ_SETTINGS cn.nubia.launcher.permission.READ_SETTINGS com.gionee.amisystem.permission.READ_SHORTCUT

Android Permissions

246497a50586703fe1b19858946d0998_JaffaCakes118

Permissions

android.permission.INTERNET

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.ACCESS_NETWORK_STATE

android.permission.CHANGE_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.GET_TASKS

android.permission.MOUNT_UNMOUNT_FILESYSTEMS

android.permission.READ_CONTACTS

android.permission.VIBRATE

android.permission.READ_LOGS

android.permission.WRITE_CONTACTS

android.permission.SYSTEM_ALERT_WINDOW

android.permission.RECEIVE_BOOT_COMPLETED

com.android.launcher.permission.UNINSTALL_SHORTCUT

android.permission.CAMERA

android.permission.GET_ACCOUNTS

android.permission.RECORD_AUDIO

android.permission.MODIFY_AUDIO_SETTINGS

com.android.launcher.permission.INSTALL_SHORTCUT

android.permission.READ_PHONE_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.WAKE_LOCK

android.permission.FLASHLIGHT

android.permission.CALL_PHONE

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACCESS_FINE_LOCATION

android.permission.RECEIVE_USER_PRESENT

android.permission.WRITE_SETTINGS

android.permission.READ_EXTERNAL_STORAGE

android.permission.READ_CALL_LOG

android.permission.WRITE_CALL_LOG

com.huawei.android.launcher.permission.CHANGE_BADGE

com.android.launcher.permission.READ_SETTINGS

com.android.launcher2.permission.READ_SETTINGS

com.android.launcher3.permission.READ_SETTINGS

com.yulong.android.launcherL.permission.READ_SETTINGS

com.meizu.flyme.launcher.permission.READ_SETTINGS

com.bbk.launcher2.permission.READ_SETTINGS

com.oppo.launcher.permission.READ_SETTINGS

com.htc.launcher.permission.READ_SETTINGS

com.qiku.launcher.permission.READ_SETTINGS

com.huawei.android.launcher.permission.READ_SETTINGS

com.zte.mifavor.launcher.permission.READ_SETTINGS

com.lenovo.launcher.permission.READ_SETTINGS

com.google.android.launcher.permission.READ_SETTINGS

com.yulong.android.launcher3.READ_SETTINGS

org.adw.launcher.permission.READ_SETTINGS

com.qihoo360.launcher.permission.READ_SETTINGS

com.lge.launcher.permission.READ_SETTINGS

net.qihoo.launcher.permission.READ_SETTINGS

246497a50586703fe1b19858946d0998_JaffaCakes118

io.dcloud.PandoraEntry

io.dcloud.PandoraEntryActivity

io.dcloud.H5ECEDBEC.wxapi.WXEntryActivity

io.dcloud.H5ECEDBEC.wxapi.WXPayEntryActivity

com.tencent.tauth.AuthActivity

com.tencent.connect.common.AssistActivity

com.dmcbig.mediapicker.PickerActivity

com.dmcbig.mediapicker.PreviewActivity

com.igexin.sdk.PushActivity

com.igexin.sdk.GActivity

io.dcloud.imagepick.CustomGalleryActivity

io.dcloud.feature.nativeObj.photoview.PhotoActivity

io.dcloud.appstream.StreamAppMainActivity

io.dcloud.WebAppActivity

io.dcloud.multiprocess.activity.WebAppActivity1

io.dcloud.appstream.OpenStreamAppTransferActivity

io.dcloud.ProcessMediator

io.dcloud.WebviewActivity

com.alipay.sdk.app.H5PayActivity

com.alipay.sdk.auth.AuthActivity

com.baidu.location.f

io.dcloud.feature.aps.ApsActionService

com.igexin.sdk.PushService

io.dcloud.feature.apsGt.GTNormalIntentService

io.dcloud.feature.apsGt.GTNormalPushService

io.dcloud.common.adapter.io.MiniServerService

io.dcloud.streamdownload.DownloadService

io.dcloud.appstream.service.DaemonService

io.dcloud.appstream.service.ProtectService

io.dcloud.multiprocess.service.MultiProcessService

com.igexin.sdk.PushReceiver

io.dcloud.feature.apsGt.GTNotificationReceiver

io.dcloud.common.adapter.io.PushReceiver

io.dcloud.common.adapter.io.DownloadReceiver

android.support.v4.content.FileProvider

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

246497a50586703fe1b19858946d0998_JaffaCakes118

io.dcloud.PandoraEntry

io.dcloud.PandoraEntryActivity

io.dcloud.H5ECEDBEC.wxapi.WXEntryActivity

io.dcloud.H5ECEDBEC.wxapi.WXPayEntryActivity

com.tencent.tauth.AuthActivity

com.tencent.connect.common.AssistActivity

com.dmcbig.mediapicker.PickerActivity

com.dmcbig.mediapicker.PreviewActivity

com.igexin.sdk.PushActivity

com.igexin.sdk.GActivity

io.dcloud.imagepick.CustomGalleryActivity

io.dcloud.feature.nativeObj.photoview.PhotoActivity

io.dcloud.appstream.StreamAppMainActivity

io.dcloud.WebAppActivity

io.dcloud.multiprocess.activity.WebAppActivity1

io.dcloud.appstream.OpenStreamAppTransferActivity

io.dcloud.ProcessMediator

io.dcloud.WebviewActivity

com.alipay.sdk.app.H5PayActivity

com.alipay.sdk.auth.AuthActivity

com.baidu.location.f

io.dcloud.feature.aps.ApsActionService

com.igexin.sdk.PushService

io.dcloud.feature.apsGt.GTNormalIntentService

io.dcloud.feature.apsGt.GTNormalPushService

io.dcloud.common.adapter.io.MiniServerService

io.dcloud.streamdownload.DownloadService

io.dcloud.appstream.service.DaemonService

io.dcloud.appstream.service.ProtectService

io.dcloud.multiprocess.service.MultiProcessService

com.igexin.sdk.PushReceiver

io.dcloud.feature.apsGt.GTNotificationReceiver

io.dcloud.common.adapter.io.PushReceiver

io.dcloud.common.adapter.io.DownloadReceiver

android.support.v4.content.FileProvider

Android Permissions

246497a50586703fe1b19858946d0998_JaffaCakes118