New Wave of Joker Android Malware in the Wild
After a period of lull, the Joker billing fraud malware is back on the Google Play store. Researchers working with mobile security company Zimperium published a report on the new uptick of apps carrying the Joker malware.
The Joker mobile malware is usually classified as fleeceware or billing fraud malware. It piggy-backs inside legitimate applications of all kinds, ranging from photo manipulation apps to mobile games and messaging apps. Once the app is installed, Joker starts quietly execute clicks, without any sort of user permission or consent, and subscribes the user to all sorts of paid premium services that are run and operated by the threat actors behind the malware.
In most cases, the victim has no idea what is going on, as everything is executed silently, and the realization that something is very wrong comes along with the phone bill for the respective month, but by that time it's a little late. Joker can also intercept and steal SMS texts and can scrape contacts and information about the infected device.
As with most mobile malware, you are a lot more likely to run into an app package that carries Joker if you fish for .apk application packages outside the official Google Play store, but there have been enough instances of apps on the official store carrying Joker too. Zimperium stated that over the course of the past four years a total of 1800 applications carrying Joker have been taken down from the Google Play store.
Despite the multiple waves of removals, the bad actors behind Joker keep tweaking and improving the malware and even though malware-infested apps never manage to survive security sweeps for too long, the simple fact that something like Joker keeps coming back shows just how persistent and stubborn the hackers behind it are.
One of the latest tricks that Joker uses to evade detection, both locally on devices and on the Play Store, is dropping the payload inside a .dex file that is obfuscated using either encryption or stored inside an image file using steganography techniques. The cherry on top is that the image file may also be hosted on a remote, legitimate cloud service or even on the command and control servers of the malware.
Joker can also check whether the environment it has landed on is an emulator used for sandboxing and research.
