Overview

overview

10

Static

static

10

46a8237ecb...18.apk

android-9-x86

8

46a8237ecb...18.apk

android-11-x64

8

amap_resou..._0.apk

android-9-x86

amap_resou..._0.apk

android-10-x64

amap_resou..._0.apk

android-11-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    46a8237ecbe0e5917ef9ce670c7ce422_JaffaCakes118

  • Size

    24.1MB

  • MD5

    46a8237ecbe0e5917ef9ce670c7ce422

  • SHA1

    3842bc1cd7589b011e1e86289d18f6f3526b29f6

  • SHA256

    e4dda37c4136db759dbc72c3bf212957e981ddaa2f7fe2ad8e0d8f57a7b75484

  • SHA512

    8d25a58cffef4e5c78732e2cacd439acf67fa03cc584c340f3391623c876dd7c39bc5b6067b1e8eeed4f0cf7bf984254bce0b8ec4a1fe73849600b51388bc135

  • SSDEEP

    393216:07KWMxmZpoM2W+wO9JtjQ19ggc5KbK7ylv4Os1rgnp7h+FJhlsxbjCTASe+oqNhi:ZWHZ1UrF2g95OieSUN8PGxRF+owad

Score
10/10
upxjoker

Malware Config

Extracted

Family

joker

C2

http://abroad.apilocate.amap.com/mobile/binary

http://apilocate.amap.com/mobile/binary

Signatures

  • Joker family
    joker
  • Patched UPX-packed file 2 IoCs

    Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Requests dangerous framework permissions 10 IoCs

Files

  • 46a8237ecbe0e5917ef9ce670c7ce422_JaffaCakes118
    .apk android arch:arm arch:x86

    com.wendenggu.jiuchou

    io.dcloud.PandoraEntry


  • amap_resource1_0_0.png
    .apk android

    com.amap.api.map3d


Android Permissions

46a8237ecbe0e5917ef9ce670c7ce422_JaffaCakes118

Permissions

android.permission.INTERNET

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.ACCESS_NETWORK_STATE

android.permission.CHANGE_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.GET_TASKS

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACCESS_FINE_LOCATION

android.permission.CAMERA

android.permission.CHANGE_WIFI_STATE

android.permission.FLASHLIGHT

android.permission.MODIFY_AUDIO_SETTINGS

android.permission.MOUNT_UNMOUNT_FILESYSTEMS

android.permission.READ_LOGS

android.permission.RECORD_AUDIO

android.permission.USE_FINGERPRINT

android.permission.VIBRATE

android.permission.WAKE_LOCK

android.permission.WRITE_SETTINGS

android.permission.READ_PHONE_STATE

android.permission.READ_EXTERNAL_STORAGE

android.permission.ACCESS_LOCATION_EXTRA_COMMANDS

android.permission.BLUETOOTH

android.permission.BLUETOOTH_ADMIN

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.SYSTEM_ALERT_WINDOW

getui.permission.GetuiService.com.wendenggu.jiuchou

android.permission.BROADCAST_PACKAGE_ADDED

android.permission.BROADCAST_PACKAGE_CHANGED

android.permission.BROADCAST_PACKAGE_INSTALL

android.permission.BROADCAST_PACKAGE_REPLACED

android.permission.RESTART_PACKAGES

com.wendenggu.jiuchou.permission.MIPUSH_RECEIVE

com.meizu.flyme.push.permission.RECEIVE

com.meizu.c2dm.permission.RECEIVE

com.wendenggu.jiuchou.push.permission.MESSAGE

com.wendenggu.jiuchou.permission.C2D_MESSAGE

android.permission.REQUEST_INSTALL_PACKAGES

com.wendenggu.jiuchou.permission.PROCESS_PUSH_MSG

com.coloros.mcs.permission.RECIEVE_MCS_MESSAGE

com.asus.msa.SupplementaryDID.ACCESS

com.android.launcher.permission.UNINSTALL_SHORTCUT

com.huawei.android.launcher.permission.CHANGE_BADGE

com.android.launcher.permission.INSTALL_SHORTCUT

com.android.launcher.permission.READ_SETTINGS

com.android.launcher2.permission.READ_SETTINGS

com.android.launcher3.permission.READ_SETTINGS