joker | 4e8f5d0c00af93a28cf25d0348b1487c_JaffaCakes118

General

Target

4e8f5d0c00af93a28cf25d0348b1487c_JaffaCakes118
Size

16.6MB
MD5

4e8f5d0c00af93a28cf25d0348b1487c
SHA1

ada606e3527a5acdbb28de2ffa0460af81738f62
SHA256

f9c7061c1be0f9038c5e3cc6a6ca9b22ba610341239ed4075bbac6a230fe53e4
SHA512

8976b3c8fcc20cc6983057516973a50b15dbcec5be8783800db693912d8dddd18cc00d32a9c6d29ab0a95499b0c2be5b5eaa6a27a0bee6a01ad5b6d5e0e7bc04
SSDEEP

393216:OKG4a7wlrqXkjkAmFcCkz0XUSQ0CjDKrVNDL30fL30xq:N/vrkWkAnCYn5jfCVNPEjE8

Score

10^/10

joker

Malware Config

Extracted

Family

joker

C2

http://open.weixin.qq.com/connect/sdk/qrconnect?appid=%s&noncestr=%s&timestamp=%s&scope=%s&signature=%s

http://wke.openspeech.cn/wakeup/

https://api.weibo.com/2/proxy/sdk/statistic.json

Signatures

Joker family
joker

Requests dangerous framework permissions 15 IoCs

description	ioc
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to write the user's contacts data.	android.permission.WRITE_CONTACTS
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Required to be able to access the camera device.	android.permission.CAMERA
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS

Files

4e8f5d0c00af93a28cf25d0348b1487c_JaffaCakes118
.apk android arch:arm arch:x86

com.wckj.hnzf

io.dcloud.PandoraEntry

Activities

io.dcloud.PandoraEntry

android.intent.action.MAIN

io.dcloud.PandoraEntryActivity

android.intent.action.VIEW

com.wckj.hnzf.wxapi.WXEntryActivity

android.intent.action.VIEW

com.tencent.tauth.AuthActivity

android.intent.action.VIEW

com.wckj.hnzf.wxapi.WXEntryActivity

android.intent.action.VIEW

com.tencent.tauth.AuthActivity

android.intent.action.VIEW

com.sina.weibo.sdk.share.WbShareTransActivity

com.sina.weibo.sdk.action.ACTION_SDK_REQ_ACTIVITY

Permissions

android.permission.WRITE_EXTERNAL_STORAGE
android.permission.INTERNET
android.permission.READ_PHONE_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.ACCESS_NETWORK_STATE
android.permission.GET_TASKS
android.permission.CHANGE_NETWORK_STATE
android.permission.READ_CONTACTS
android.permission.MOUNT_UNMOUNT_FILESYSTEMS
android.permission.VIBRATE
android.permission.READ_LOGS
android.permission.ACCESS_WIFI_STATE
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.WRITE_CONTACTS
android.permission.SYSTEM_ALERT_WINDOW
android.permission.ACCESS_NETWORK_STATE
android.permission.RECEIVE_BOOT_COMPLETED
com.android.launcher.permission.UNINSTALL_SHORTCUT
android.permission.CAMERA
android.permission.GET_ACCOUNTS
android.permission.RECORD_AUDIO
com.android.launcher.permission.INSTALL_SHORTCUT
android.permission.MODIFY_AUDIO_SETTINGS
android.permission.INTERNET
android.permission.READ_PHONE_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.WAKE_LOCK
android.permission.CALL_PHONE
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_FINE_LOCATION
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.WRITE_SETTINGS
com.android.launcher.permission.INSTALL_SHORTCUT
com.android.launcher.permission.UNINSTALL_SHORTCUT
com.android.launcher.permission.READ_SETTINGS
com.android.launcher2.permission.READ_SETTINGS
com.android.launcher3.permission.READ_SETTINGS
com.yulong.android.launcherL.permission.READ_SETTINGS
com.meizu.flyme.launcher.permission.READ_SETTINGS
com.bbk.launcher2.permission.READ_SETTINGS
com.oppo.launcher.permission.READ_SETTINGS
com.htc.launcher.permission.READ_SETTINGS
com.qiku.launcher.permission.READ_SETTINGS
com.huawei.android.launcher.permission.READ_SETTINGS
com.zte.mifavor.launcher.permission.READ_SETTINGS
com.lenovo.launcher.permission.READ_SETTINGS
com.google.android.launcher.permission.READ_SETTINGS
com.yulong.android.launcher3.READ_SETTINGS
org.adw.launcher.permission.READ_SETTINGS
com.qihoo360.launcher.permission.READ_SETTINGS
com.lge.launcher.permission.READ_SETTINGS
net.qihoo.launcher.permission.READ_SETTINGS
org.adwfreak.launcher.permission.READ_SETTINGS
org.adw.launcher_donut.permission.READ_SETTINGS
com.huawei.launcher3.permission.READ_SETTINGS
com.fede.launcher.permission.READ_SETTINGS
com.sec.android.app.twlauncher.settings.READ_SETTINGS
com.tencent.qqlauncher.permission.READ_SETTINGS
com.huawei.launcher2.permission.READ_SETTINGS
com.ebproductions.android.launcher.permission.READ_SETTINGS
com.nd.android.launcher.permission.READ_SETTINGS
com.yulong.android.launcher.permission.READ_SETTINGS
com.android.mylauncher.permission.READ_SETTINGS
com.ztemt.launcher.permission.READ_SETTINGS
cn.nubia.launcher.permission.READ_SETTINGS
com.gionee.amisystem.permission.READ_SHORTCUT
getui.permission.GetuiService.com.wckj.hnzf

Receivers

io.dcloud.common.adapter.io.PushReceiver

dcloud.push.broswer

io.dcloud.common.adapter.io.DownloadReceiver

android.intent.action.DOWNLOAD_COMPLETE
android.intent.action.PACKAGE_ADDED

io.dcloud.appstream.receiver.DaemonReceiver

android.intent.action.BOOT_COMPLETED
android.net.conn.CONNECTIVITY_CHANGE
android.intent.action.USER_PRESENT

com.igexin.sdk.PushReceiver

android.intent.action.BOOT_COMPLETED
android.net.conn.CONNECTIVITY_CHANGE
android.intent.action.USER_PRESENT
com.igexin.sdk.action.refreshls
android.intent.action.MEDIA_MOUNTED
android.intent.action.ACTION_POWER_CONNECTED
android.intent.action.ACTION_POWER_DISCONNECTED

io.dcloud.feature.apsGt.GTNotificationReceiver

android.intent.action.BOOT_COMPLETED
com.wckj.hnzf.__CREATE_NOTIFICATION
com.wckj.hnzf.__REMOVE_NOTIFICATION
com.wckj.hnzf.__CLEAR_NOTIFICATION
com.wckj.hnzf.__CLILK_NOTIFICATION

Services

io.dcloud.streamdownload.DownloadService

com.qihoo.life.plugin.streamapp.ACTION_PUSH_TO_PLUGIN

com.igexin.sdk.PushService

com.igexin.sdk.action.service.message
tcore.jar
.apk android

Android Permissions

4e8f5d0c00af93a28cf25d0348b1487c_JaffaCakes118

Permissions

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.INTERNET

android.permission.READ_PHONE_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.ACCESS_NETWORK_STATE

android.permission.GET_TASKS

android.permission.CHANGE_NETWORK_STATE

android.permission.READ_CONTACTS

android.permission.MOUNT_UNMOUNT_FILESYSTEMS

android.permission.VIBRATE

android.permission.READ_LOGS

android.permission.ACCESS_WIFI_STATE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.WRITE_CONTACTS

android.permission.SYSTEM_ALERT_WINDOW

android.permission.ACCESS_NETWORK_STATE

android.permission.RECEIVE_BOOT_COMPLETED

com.android.launcher.permission.UNINSTALL_SHORTCUT

android.permission.CAMERA

android.permission.GET_ACCOUNTS

android.permission.RECORD_AUDIO

com.android.launcher.permission.INSTALL_SHORTCUT

android.permission.MODIFY_AUDIO_SETTINGS

android.permission.INTERNET

android.permission.READ_PHONE_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.WAKE_LOCK

android.permission.CALL_PHONE

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACCESS_FINE_LOCATION

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.WRITE_SETTINGS

com.android.launcher.permission.INSTALL_SHORTCUT

com.android.launcher.permission.UNINSTALL_SHORTCUT

com.android.launcher.permission.READ_SETTINGS

com.android.launcher2.permission.READ_SETTINGS

com.android.launcher3.permission.READ_SETTINGS

com.yulong.android.launcherL.permission.READ_SETTINGS

com.meizu.flyme.launcher.permission.READ_SETTINGS

com.bbk.launcher2.permission.READ_SETTINGS

com.oppo.launcher.permission.READ_SETTINGS

com.htc.launcher.permission.READ_SETTINGS

com.qiku.launcher.permission.READ_SETTINGS

com.huawei.android.launcher.permission.READ_SETTINGS

com.zte.mifavor.launcher.permission.READ_SETTINGS

com.lenovo.launcher.permission.READ_SETTINGS

com.google.android.launcher.permission.READ_SETTINGS

com.yulong.android.launcher3.READ_SETTINGS

org.adw.launcher.permission.READ_SETTINGS

com.qihoo360.launcher.permission.READ_SETTINGS

Sharing

General

Malware Config

Extracted

Signatures

Files

com.wckj.hnzf

io.dcloud.PandoraEntry

Activities

io.dcloud.PandoraEntry

io.dcloud.PandoraEntryActivity

com.wckj.hnzf.wxapi.WXEntryActivity

com.tencent.tauth.AuthActivity

com.wckj.hnzf.wxapi.WXEntryActivity

com.tencent.tauth.AuthActivity

com.sina.weibo.sdk.share.WbShareTransActivity

Permissions

Receivers

io.dcloud.common.adapter.io.PushReceiver

io.dcloud.common.adapter.io.DownloadReceiver

io.dcloud.appstream.receiver.DaemonReceiver

com.igexin.sdk.PushReceiver

io.dcloud.feature.apsGt.GTNotificationReceiver

Services

io.dcloud.streamdownload.DownloadService

com.igexin.sdk.PushService

Android Permissions

4e8f5d0c00af93a28cf25d0348b1487c_JaffaCakes118