joker | bed7b8533e3e362abd7cc9ab81bda4e67102387008edc6f9027cac6a9f7d392a

General

Target
bed7b8533e3e362abd7cc9ab81bda4e67102387008edc6f9027cac6a9f7d392a
Size 8.9MB
Sample240514-kfk9vagg7w
SHA256 bed7b8533e3e362abd7cc9ab81bda4e67102387008edc6f9027cac6a9f7d392a
MD5 3d6d77eae43417a8010a901756cc0c8e
SHA1 c33a5e1297f183b38c803f7f78149c99d6f8d303
SHA512 ce50953c629d9ad616f5dc6084a3ef5ff6abc1bc7dbe4f31758a3281dcfbcda191093b8143c3a8a318d6e33ca49e889e6cd31547c6d9d47e4c63997aba945331
SSDEEP 196608:sDLUhZJ5y1Pt1vju+pf2ukxD0wWxdsNMGj6tiE4LL3p29/62vUqhJsL3p29/TCkp:sMhZJ5in5pfYD0wGi56eL3062vUqhJsW
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

joker

Malware Config

Extracted

Family

joker

C2

http://abroad.apilocate.amap.com/mobile/binary
http://apiinit.amap.com/v3/log/init
http://lbs.amap.com/api/android-sdk/guide/error/
http://logs.amap.com/ws/log/upload?product=%s&type=%s&platform=%s&channel=%s&sign=%s
http://open.weixin.qq.com/connect/sdk/qrconnect?appid=%s&noncestr=%s&timestamp=%s&scope=%s&signature=%s
http://wke.openspeech.cn/wakeup/

Signatures

Joker family
joker

Requests dangerous framework permissions 17 IoCs

description	ioc
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to write the user's contacts data.	android.permission.WRITE_CONTACTS
Required to be able to access the camera device.	android.permission.CAMERA
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows an application to read SMS messages.	android.permission.READ_SMS

File Explorer

bed7b8533e3e362abd7cc9ab81bda4e67102387008edc6f9027cac6a9f7d392a

.apk 8.9MB
tcore.jar

.apk 142KB

bed7b8533e3e362abd7cc9ab81bda4e67102387008edc6f9027cac6a9f7d392a

SHA256 bed7b8533e3e362abd7cc9ab81bda4e67102387008edc6f9027cac6a9f7d392a
MD5 3d6d77eae43417a8010a901756cc0c8e
SHA1 c33a5e1297f183b38c803f7f78149c99d6f8d303
SHA512 ce50953c629d9ad616f5dc6084a3ef5ff6abc1bc7dbe4f31758a3281dcfbcda191093b8143c3a8a318d6e33ca49e889e6cd31547c6d9d47e4c63997aba945331
SSDEEP 196608:sDLUhZJ5y1Pt1vju+pf2ukxD0wWxdsNMGj6tiE4LL3p29/62vUqhJsL3p29/TCkp:sMhZJ5in5pfYD0wGi56eL3062vUqhJsW
MD5 SHA1 SHA512 SSDEEP

android arch:arm arch:x86

com.qingxi.yuefuxinyun

android.permission.WRITE_EXTERNAL_STORAGE android.permission.INTERNET android.permission.READ_PHONE_STATE android.permission.ACCESS_WIFI_STATE android.permission.ACCESS_NETWORK_STATE android.permission.GET_TASKS android.permission.CHANGE_NETWORK_STATE android.permission.READ_CONTACTS android.permission.MOUNT_UNMOUNT_FILESYSTEMS android.permission.GET_TASKS android.permission.VIBRATE android.permission.READ_LOGS android.permission.ACCESS_WIFI_STATE android.permission.WRITE_EXTERNAL_STORAGE android.permission.SYSTEM_ALERT_WINDOW android.permission.WRITE_CONTACTS android.permission.GET_TOP_ACTIVITY_INFO android.permission.ACCESS_NETWORK_STATE android.permission.RECEIVE_BOOT_COMPLETED android.permission.CAMERA android.permission.GET_ACCOUNTS android.permission.RECORD_AUDIO android.permission.MODIFY_AUDIO_SETTINGS android.permission.SEND_SMS android.permission.INTERNET android.permission.READ_PHONE_STATE android.permission.CHANGE_WIFI_STATE android.permission.WAKE_LOCK android.permission.FLASHLIGHT android.permission.CALL_PHONE android.permission.ACCESS_COARSE_LOCATION android.permission.INTERACT_ACROSS_USERS_FULL android.permission.ACCESS_FINE_LOCATION android.permission.WRITE_EXTERNAL_STORAGE android.permission.RECEIVE_USER_PRESENT android.permission.WRITE_SETTINGS android.permission.WRITE_SMS android.permission.READ_SMS com.android.launcher.permission.INSTALL_SHORTCUT com.android.launcher.permission.UNINSTALL_SHORTCUT com.android.launcher.permission.READ_SETTINGS com.android.launcher2.permission.READ_SETTINGS com.android.launcher3.permission.READ_SETTINGS com.yulong.android.launcherL.permission.READ_SETTINGS com.meizu.flyme.launcher.permission.READ_SETTINGS com.bbk.launcher2.permission.READ_SETTINGS com.oppo.launcher.permission.READ_SETTINGS com.htc.launcher.permission.READ_SETTINGS com.qiku.launcher.permission.READ_SETTINGS com.huawei.android.launcher.permission.READ_SETTINGS com.zte.mifavor.launcher.permission.READ_SETTINGS com.lenovo.launcher.permission.READ_SETTINGS com.google.android.launcher.permission.READ_SETTINGS com.yulong.android.launcher3.READ_SETTINGS org.adw.launcher.permission.READ_SETTINGS com.qihoo360.launcher.permission.READ_SETTINGS com.lge.launcher.permission.READ_SETTINGS net.qihoo.launcher.permission.READ_SETTINGS org.adwfreak.launcher.permission.READ_SETTINGS org.adw.launcher_donut.permission.READ_SETTINGS com.huawei.launcher3.permission.READ_SETTINGS com.fede.launcher.permission.READ_SETTINGS com.sec.android.app.twlauncher.settings.READ_SETTINGS com.tencent.qqlauncher.permission.READ_SETTINGS com.huawei.launcher2.permission.READ_SETTINGS com.ebproductions.android.launcher.permission.READ_SETTINGS com.nd.android.launcher.permission.READ_SETTINGS com.yulong.android.launcher.permission.READ_SETTINGS com.android.mylauncher.permission.READ_SETTINGS com.ztemt.launcher.permission.READ_SETTINGS cn.nubia.launcher.permission.READ_SETTINGS com.gionee.amisystem.permission.READ_SHORTCUT getui.permission.GetuiService.com.qingxi.yuefuxinyun

Android Permissions

bed7b8533e3e362abd7cc9ab81bda4e67102387008edc6f9027cac6a9f7d392a

Permissions

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.INTERNET

android.permission.READ_PHONE_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.ACCESS_NETWORK_STATE

android.permission.GET_TASKS

android.permission.CHANGE_NETWORK_STATE

android.permission.READ_CONTACTS

android.permission.MOUNT_UNMOUNT_FILESYSTEMS

android.permission.GET_TASKS

android.permission.VIBRATE

android.permission.READ_LOGS

android.permission.ACCESS_WIFI_STATE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.SYSTEM_ALERT_WINDOW

android.permission.WRITE_CONTACTS

android.permission.GET_TOP_ACTIVITY_INFO

android.permission.ACCESS_NETWORK_STATE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.CAMERA

android.permission.GET_ACCOUNTS

android.permission.RECORD_AUDIO

android.permission.MODIFY_AUDIO_SETTINGS

android.permission.SEND_SMS

android.permission.INTERNET

android.permission.READ_PHONE_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.WAKE_LOCK

android.permission.FLASHLIGHT

android.permission.CALL_PHONE

android.permission.ACCESS_COARSE_LOCATION

android.permission.INTERACT_ACROSS_USERS_FULL

android.permission.ACCESS_FINE_LOCATION

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.RECEIVE_USER_PRESENT

android.permission.WRITE_SETTINGS

android.permission.WRITE_SMS

android.permission.READ_SMS

com.android.launcher.permission.INSTALL_SHORTCUT

com.android.launcher.permission.UNINSTALL_SHORTCUT

com.android.launcher.permission.READ_SETTINGS

com.android.launcher2.permission.READ_SETTINGS

com.android.launcher3.permission.READ_SETTINGS

com.yulong.android.launcherL.permission.READ_SETTINGS

com.meizu.flyme.launcher.permission.READ_SETTINGS

com.bbk.launcher2.permission.READ_SETTINGS

com.oppo.launcher.permission.READ_SETTINGS

com.htc.launcher.permission.READ_SETTINGS

com.qiku.launcher.permission.READ_SETTINGS

com.huawei.android.launcher.permission.READ_SETTINGS

bed7b8533e3e362abd7cc9ab81bda4e67102387008edc6f9027cac6a9f7d392a

io.dcloud.PandoraEntry

io.dcloud.PandoraEntryActivity

io.dcloud.imagepick.CustomGalleryActivity

io.dcloud.feature.nativeObj.photoview.PhotoActivity

io.dcloud.appstream.StreamAppMainActivity

io.dcloud.appstream.StreamAppsAbout

io.dcloud.WebAppActivity

io.dcloud.multiprocess.activity.WebAppActivity1

io.dcloud.appstream.OpenStreamAppTransferActivity

io.dcloud.ProcessMediator

com.qingxi.yuefuxinyun.wxapi.WXPayEntryActivity

com.qingxi.yuefuxinyun.wxapi.WXEntryActivity

com.qingxi.yuefuxinyun.wxapi.WXEntryActivity

com.igexin.sdk.PushActivity

com.igexin.sdk.GActivity

io.dcloud.WebviewActivity

com.ak.torch.shell.landingpage.TorchActivity

io.dcloud.adapter.io.MiniServerService

io.dcloud.streamdownload.DownloadService

io.dcloud.appstream.service.DaemonService

io.dcloud.appstream.service.ProtectService

io.dcloud.multiprocess.service.MultiProcessService

com.igexin.sdk.PushService

io.dcloud.feature.apsGt.GTNormalIntentService

io.dcloud.feature.apsGt.GTNormalPushService

com.amap.api.location.APSService

io.dcloud.common.adapter.io.PushReceiver

io.dcloud.common.adapter.io.DownloadReceiver

io.dcloud.appstream.receiver.DaemonReceiver

com.igexin.sdk.PushReceiver

io.dcloud.feature.apsGt.GTNotificationReceiver

com.ak.torch.shell.provider.TorchProvider

tcore.jar

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

bed7b8533e3e362abd7cc9ab81bda4e67102387008edc6f9027cac6a9f7d392a

io.dcloud.PandoraEntry

io.dcloud.PandoraEntryActivity

io.dcloud.imagepick.CustomGalleryActivity

io.dcloud.feature.nativeObj.photoview.PhotoActivity

io.dcloud.appstream.StreamAppMainActivity

io.dcloud.appstream.StreamAppsAbout

io.dcloud.WebAppActivity

io.dcloud.multiprocess.activity.WebAppActivity1

io.dcloud.appstream.OpenStreamAppTransferActivity

io.dcloud.ProcessMediator

com.qingxi.yuefuxinyun.wxapi.WXPayEntryActivity

com.qingxi.yuefuxinyun.wxapi.WXEntryActivity

com.qingxi.yuefuxinyun.wxapi.WXEntryActivity

com.igexin.sdk.PushActivity

com.igexin.sdk.GActivity

io.dcloud.WebviewActivity

com.ak.torch.shell.landingpage.TorchActivity

io.dcloud.adapter.io.MiniServerService

io.dcloud.streamdownload.DownloadService

io.dcloud.appstream.service.DaemonService

io.dcloud.appstream.service.ProtectService

io.dcloud.multiprocess.service.MultiProcessService

com.igexin.sdk.PushService

io.dcloud.feature.apsGt.GTNormalIntentService

io.dcloud.feature.apsGt.GTNormalPushService

com.amap.api.location.APSService

io.dcloud.common.adapter.io.PushReceiver

io.dcloud.common.adapter.io.DownloadReceiver

io.dcloud.appstream.receiver.DaemonReceiver

com.igexin.sdk.PushReceiver

io.dcloud.feature.apsGt.GTNotificationReceiver

com.ak.torch.shell.provider.TorchProvider

tcore.jar

Android Permissions

bed7b8533e3e362abd7cc9ab81bda4e67102387008edc6f9027cac6a9f7d392a