joker | e1f2ea8188f875f18a03c17014a4d772050846c0578b87f3fcf877e18049f7b1

Sharing

Copy URL Twitter E-mail

General

Target
e1f2ea8188f875f18a03c17014a4d772050846c0578b87f3fcf877e18049f7b1
Size 7.2MB
Sample240515-yr8feahf93
SHA256 e1f2ea8188f875f18a03c17014a4d772050846c0578b87f3fcf877e18049f7b1
MD5 47c3afe0e694eb4d16fa8a16f8e98a1b
SHA1 a321504d96043583c15ab12f6d185aa4658b334a
SHA512 f3adf8c38f691f7f36522f38282d5df098d646691cd47c1f30c700595599dcfc2a0c0aaabb6ca86a8525d86da594636e6696ada6a5a457226a14da4a5a4916d0
SSDEEP 196608:vZ0CCV27+Ps5LxIKQ7wCgWOwrvKCiI8M6sow2:vOCC65nCbOwrvKzA6sow2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

joker

Malware Config

Extracted

Family

joker

http://api.exc.mob.com:80
http://loc.map.baidu.com/offline_loc
https://www.itoumi.com/

Signatures

Joker family
joker

Requests dangerous framework permissions 7 IoCs

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS

File Explorer

e1f2ea8188f875f18a03c17014a4d772050846c0578b87f3fcf877e18049f7b1

.apk 7.2MB
UPPayPluginExPro.apk

.apk 657KB

e1f2ea8188f875f18a03c17014a4d772050846c0578b87f3fcf877e18049f7b1

SHA256 e1f2ea8188f875f18a03c17014a4d772050846c0578b87f3fcf877e18049f7b1
MD5 47c3afe0e694eb4d16fa8a16f8e98a1b
SHA1 a321504d96043583c15ab12f6d185aa4658b334a
SHA512 f3adf8c38f691f7f36522f38282d5df098d646691cd47c1f30c700595599dcfc2a0c0aaabb6ca86a8525d86da594636e6696ada6a5a457226a14da4a5a4916d0
SSDEEP 196608:vZ0CCV27+Ps5LxIKQ7wCgWOwrvKCiI8M6sow2:vOCC65nCbOwrvKzA6sow2
MD5 SHA1 SHA512 SSDEEP

android arch:arm

com.yixin.itoumi

com.yixin.itoumi.SplashActivity

android.intent.action.MAIN

com.yixin.itoumi.MainTabActivity

com.yixin.itoumi.GuideActivity

com.yixin.itoumi.IdentifyBondingActivity

com.yixin.itoumi.IdentifyBuyZeroActivity

com.yixin.itoumi.IdentifyBuyZeroPlusActivity

com.yixin.itoumi.IdentifyBuyDailyActivity

com.yixin.itoumi.IdentifyBuyTrialActivity

com.yixin.itoumi.IdentifySmsActivity

com.yixin.itoumi.IdentifyVerActivity

com.yixin.itoumi.IdentifyLoginMobileActivity

com.yixin.itoumi.IdentifyLoginPasswordActivity

com.yixin.itoumi.IdentifyRegisterActivity

com.yixin.itoumi.IdentifyFindActivity

com.yixin.itoumi.BuyVerifyBankPhoneActivity

com.yixin.itoumi.BuyRealizeComputeActivity

com.yixin.itoumi.MoreLockActivity

com.yixin.itoumi.MoreLockSetupActivity

com.mob.tools.MobUIShell

android.intent.action.VIEW

com.yixin.itoumi.tools.share.ShareActivity

com.yixin.itoumi.MoreMyAccountActivity

com.yixin.itoumi.MoreAboutToumiActivity

com.yixin.itoumi.MoreClientServiceActivity

com.yixin.itoumi.MoreShareActivity

com.yixin.itoumi.MoreBankCardActivity

com.yixin.itoumi.MoreUpdateLoginPasswordActivity

com.yixin.itoumi.BuyEnterZeroActivity

com.yixin.itoumi.BuyEnterZeroPlusActivity

com.yixin.itoumi.BuyEnterDailyActivity

com.yixin.itoumi.BuyEnterTrialActivity

com.yixin.itoumi.BuyEnterRealizeActivity

com.yixin.itoumi.BuyEnterVirtualActivity

com.yixin.itoumi.BuyEnterGetCashDailyActivity

com.yixin.itoumi.BuyEnterGetCashVirtualActivity

com.yixin.itoumi.BuyVerifyPasswordZeroActivity

com.yixin.itoumi.BuyVerifyPasswordDailyActivity

com.yixin.itoumi.BuyVerifyPasswordVirtualActivity

com.yixin.itoumi.BuyVerifyPasswordGetCashActivity

com.yixin.itoumi.BuyVerifyPasswordGetCashVirtualActivity

com.yixin.itoumi.BuyVerifyPasswordRealizeActivity

com.yixin.itoumi.BuyVerifySmsZeroActivity

com.yixin.itoumi.BuyVerifySmsDailyActivity

com.yixin.itoumi.BuyVerifySmsVirtualActivity

com.yixin.itoumi.BuyVerifySmsGetCashVirtualActivity

com.yixin.itoumi.BuyFinishGetCashDailyActivity

com.yixin.itoumi.BuyFinishGetCashVirtualActivity

com.yixin.itoumi.BuyFinishGetCashRealizeActivity

com.yixin.itoumi.BuyFinishGetCashRealizeErrorActivity

com.yixin.itoumi.BuyFinishZeroActivity

com.yixin.itoumi.BuyFinishDailyActivity

com.yixin.itoumi.BuyFinishTrialActivity

com.yixin.itoumi.BuyFinishVirtualActivity

com.unionpay.uppay.PayActivity

com.yixin.itoumi.WebPageActivity

com.yixin.itoumi.WebPageActivity_SingTask

com.yixin.itoumi.ProductZeroActivity

com.yixin.itoumi.ProductZeroPlusActivity

com.yixin.itoumi.ProductDailyActivity

com.yixin.itoumi.ProductCashActivity

com.yixin.itoumi.ProductCashAreaActivity

com.yixin.itoumi.ProductVouchersActivity

com.yixin.itoumi.ApkUpdateActivity

com.yixin.itoumi.WebPageCheckIdentityActivity

com.yixin.itoumi.BuySelectVoucherActivity

com.yixin.itoumi.BankcardEditReturnedMoneyActivity

com.yixin.itoumi.BankcardSelectReturnedMoneyActivity

com.yixin.itoumi.BankcardPasswordVerifyActivity

com.yixin.itoumi.BankcardGetSmsVerifyCodeActivity

com.yixin.itoumi.BuyProtocolZeroActivity

com.yixin.itoumi.BuyProtocolDailyActivity

com.yixin.itoumi.BankcardMyPaymentActivity

com.yixin.itoumi.BankcardAddPaymentActivity

com.yixin.itoumi.BankcardSelectPaymentActivity

com.yixin.itoumi.CenterVirtualActivity

com.yixin.itoumi.CenterVirtualDealActivity

com.yixin.itoumi.CenterDailyActivity

com.yixin.itoumi.CenterZeroActivity

com.yixin.itoumi.CenterZeroPlusActivity

com.yixin.itoumi.CenterCashActivity

com.yixin.itoumi.CenterCashDetailActivity

com.yixin.itoumi.CenterCashRecordActivity

com.yixin.itoumi.CenterCashRecordDetailsActivity

com.yixin.itoumi.CenterDailyTransacFlowActivity

com.yixin.itoumi.CenterDailyProfitAmountActivity

com.yixin.itoumi.CenterNoPayListActivity

com.yixin.itoumi.CenterNoPayZeroActivity

com.yixin.itoumi.CenterNoPayDailyActivity

com.yixin.itoumi.CenterNoPayCashActivity

com.yixin.itoumi.CenterCashRecordDetailsCancelActivity

com.yixin.itoumi.CenterVoucherActivity

com.yixin.itoumi.AppIpAddChangerActivity

UPPayPluginExPro.apk

SHA256 2097dfea31969ce031131ad4830a8c1c93caf231048fec9c2a68ee94bfe9416d
MD5 c51fa8f0e3934ccf55e2e7aa0442bf0e
SHA1 3e8fea3099028ecd23fa8679db4827b2d1c07a46
SHA512 622be5e4ae2321486f34581a0cd7e2a0477c3d79fe677010ed02a7948ba21c15517f634f74b4a88aae9e54963df1e012063861ccece04994bce34e8dbb2a166d
SSDEEP 12288:dfYWNM0QfgMak+PUMMOjhZiHb6L2mjNQ+cSeWrCiCqMMeYWLbnhkG:dfTN/BMzRMMOjhZiHGym2+cSlAMeY4KG
MD5 SHA1 SHA512 SSDEEP

android arch:arm arch:mips arch:x86

com.unionpay.uppay

Android Permissions

e1f2ea8188f875f18a03c17014a4d772050846c0578b87f3fcf877e18049f7b1

Permissions

android.permission.INTERNET

android.permission.READ_PHONE_STATE

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.GET_TASKS

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACCESS_FINE_LOCATION

android.permission.READ_LOGS

android.permission.CALL_PHONE

android.permission.RUN_INSTRUMENTATION

com.android.launcher.permission.READ_SETTINGS

com.android.launcher.permission.INSTALL_SHORTCUT

android.permission.RECEIVE_USER_PRESENT

android.permission.MOUNT_UNMOUNT_FILESYSTEMS

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.WRITE_SETTINGS

android.permission.MEDIA_CONTENT_CONTROL

android.permission.VIBRATE

android.permission.BLUETOOTH_ADMIN

android.permission.BLUETOOTH

com.yixin.itoumi.permission.MIPUSH_RECEIVE