joker | 4828525495a571ba65feb6b0d941f42a_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
4828525495a571ba65feb6b0d941f42a_JaffaCakes118
Size 13.4MB
Sample240515-1h1ejsdf48
SHA256 4c8f2bd3a3d108d158e0ec8862b21404fc616d3d8ad0e5f8bf560089254a67c1
MD5 4828525495a571ba65feb6b0d941f42a
SHA1 5ffe68c387293380c776ded8003d7edb0457ee6b
SHA512 ef53ed394f91fda4e13b00b6ff52346be6f861fe1764784a6b03a9216936f522431c4b111294eecb998d99279fdc64a9d060ed564f467a9d2a26a9a6868922e9
SSDEEP 393216:GX6TlNm+RP+4KPN9aJIn8DeRBeVLYX9wE2G5WtL:u6Tlt+fmg79wo5i
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

joker

Malware Config

Extracted

Family

joker

http://adash.m.taobao.com/rest/sur
https://

Signatures

Joker family
joker

Requests dangerous framework permissions 9 IoCs

description	ioc
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE

File Explorer

4828525495a571ba65feb6b0d941f42a_JaffaCakes118

.apk 13.4MB

4828525495a571ba65feb6b0d941f42a_JaffaCakes118

SHA256 4c8f2bd3a3d108d158e0ec8862b21404fc616d3d8ad0e5f8bf560089254a67c1
MD5 4828525495a571ba65feb6b0d941f42a
SHA1 5ffe68c387293380c776ded8003d7edb0457ee6b
SHA512 ef53ed394f91fda4e13b00b6ff52346be6f861fe1764784a6b03a9216936f522431c4b111294eecb998d99279fdc64a9d060ed564f467a9d2a26a9a6868922e9
SSDEEP 393216:GX6TlNm+RP+4KPN9aJIn8DeRBeVLYX9wE2G5WtL:u6Tlt+fmg79wo5i
MD5 SHA1 SHA512 SSDEEP

android arch:arm64 arch:arm arch:x86 arch:x64

cn.win888.banying.dpl

cn.win888.banying.activity.SplashActivity

android.intent.action.MAIN android.intent.action.VIEW

cn.win888.banying.activity.AppLinkActivity

android.intent.action.VIEW

cn.win888.banying.activity.others.WelcomeActivity

cn.win888.banying.activity.bet.BKLotteryHomeActivity

cn.win888.banying.activity.web.LotteryWebActivity

cn.win888.banying.activity.web.CompetitionWebActivity

cn.win888.banying.activity.others.SearchActivity

cn.win888.banying.activity.bet.FBLotteryHomeActivity

cn.win888.banying.bjSingle.FBLotteryBJSingleActivity

cn.win888.banying.activity.order.UiOrderBk

cn.win888.banying.bk.activity.BkAddOrderActivty

cn.win888.banying.bjSingle.activity.order.BjSingleOrderActivity

cn.win888.banying.activity.bet.UiConfirm

cn.win888.banying.bk.activity.BkConfirmActivity

cn.win888.banying.activity.bet.UiConfirmFb

cn.win888.banying.bjSingle.activity.confirm.BjConfirmActivity

cn.win888.banying.activity.chh.UiChh

cn.win888.banying.activity.order.UiOrderFb

cn.win888.banying.activity.bet.FBLottery9And14Activity

cn.win888.banying.activity.order.UiOrder9And14

cn.win888.banying.activity.bet.UiConfirm9And14

cn.win888.banying.activity.others.HomeActivity

cn.win888.banying.activity.others.ZyLotteryAllPlaysActivity

cn.win888.banying.activity.others.UiLeagueFilterActivity

cn.win888.banying.activity.user.PayActivity

cn.win888.banying.activity.user.GetMoneyActivity

cn.win888.banying.activity.user.ChangePassWordActivity

cn.win888.banying.activity.user.LoginAndRegisterActivity

cn.win888.banying.activity.user.ThirdRegisterAndBindingActivity

cn.win888.banying.activity.user.AccountMessageActivity

cn.win888.banying.activity.user.UserSettingActivity

cn.win888.banying.activity.user.ChangeAccountMessageActivity

cn.win888.banying.activity.user.OpinionBackActivity

cn.win888.banying.activity.user.ZYFishBallDetailActivity

cn.win888.banying.activity.user.AccountDetailsActivity

cn.win888.banying.activity.user.LotteryRecordActivity

cn.win888.banying.activity.user.LotteryDetailsActivity

cn.win888.banying.activity.user.BackMoneyActivity

cn.win888.banying.activity.web.WebActivity

cn.win888.banying.activity.chh.UiConfirmChh

cn.win888.banying.activity.user.RechargeDetails

cn.win888.banying.activity.user.RechargeAmount

cn.win888.banying.activity.analystdetails.ZYAnalystDetailsActivity

cn.win888.banying.activity.british.ZYBritishTraderDetailsActivity

cn.win888.banying.activity.user.ExchangeRedPackageActivity

cn.win888.banying.activity.competition.GetFishBallActivity

cn.win888.banying.wxapi.WXEntryActivity

cn.win888.banying.wxapi.WXPayEntryActivity

cn.win888.banying.jrssport.wxapi.WXEntryActivity

cn.win888.banying.jrssport.wxapi.WXPayEntryActivity

cn.win888.banying.kxz.wxapi.WXEntryActivity

cn.win888.banying.kxz.wxapi.WXPayEntryActivity

com.umeng.qq.tencent.AuthActivity

android.intent.action.VIEW android.intent.action.VIEW

com.umeng.qq.tencent.AssistActivity

com.umeng.socialize.editorpage.ShareActivity

com.switfpass.pay.activity.QQWapPayWebView

cn.win888.banying.WBShareActivity

com.sina.weibo.sdk.action.ACTION_SDK_REQ_ACTIVITY

cn.win888.banying.activity.user.GetMoneyProgressActivity

cn.win888.banying.mvp.views.checklottery.ZYChecklotteryActivity

cn.win888.banying.activity.guess.H5WebCommonActivity

com.lotter.coupon.TestActivity

com.zy.zybkdatacenter.activity.BkDataCenterActivity

com.zy.zybkdatacenter.activity.charts.ShengfuActivity

com.zy.zybkdatacenter.activity.charts.FenShuActivity

com.zy.zybkdatacenter.activity.rank.BkTeamDetailsActivity

lotto.zy.com.zyfbdatacenter.activity.DataCenterActivity

lotto.zy.com.zyfbdatacenter.activity.charts.ZYAhpDetailsActivity

lotto.zy.com.zyfbdatacenter.activity.charts.ZYCpeDetailsActivity

com.zy.digitlotter.activity.BigLottoActivity

com.zy.digitlotter.activity.BetConfirmActivity

com.zy.digitlotter.activity.OrderVerifyActivity

com.zy.digitlotter.activity.BetHistoryActivity

com.zy.digitlotter.activity.BigLottoWebActivity

com.zy.digitlotter.ssq.activity.SsqActivity

com.zy.digitlotter.ssq.activity.SsqBetConfirmActivity

com.zy.digitlotter.ssq.activity.SsqOrderVerifyActivity

com.lotter.coupon.ZYCouponActivity

Android Permissions

4828525495a571ba65feb6b0d941f42a_JaffaCakes118

Permissions

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.WRITE_SETTINGS

android.permission.READ_PHONE_STATE

android.permission.FLASHLIGHT

android.permission.ACCESS_WIFI_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.MOUNT_UNMOUNT_FILESYSTEMS

android.permission.CHANGE_NETWORK_STATE

android.permission.WAKE_LOCK

android.permission.BROADCAST_PACKAGE_CHANGED

android.permission.BROADCAST_PACKAGE_REPLACED

android.permission.READ_LOGS

android.permission.SYSTEM_ALERT_WINDOW

android.permission.BLUETOOTH

android.permission.BLUETOOTH_ADMIN

android.permission.ACCESS_FINE_LOCATION

android.permission.ACCESS_COARSE_LOCATION

android.permission.SET_DEBUG_APP

android.permission.GET_ACCOUNTS

android.permission.USE_CREDENTIALS

android.permission.MANAGE_ACCOUNTS

.permission.MIPUSH_RECEIVE

android.permission.READ_SETTINGS

android.permission.READ_EXTERNAL_STORAGE

android.permission.GET_TASKS

android.permission.RESTART_PACKAGES

android.permission.CHANGEWIFISTATE

android.permission.KILL_BACKGROUND_PROCESSES

android.permission.READ_EXTERNAL_STORAGE