SSL Certificate Analysis Uncovers 77 Servers Linked to Joker Android Malware

Feb 27, 2025 · Original article ↗

Summary

Researchers traced Joker Android malware infrastructure by pivoting on reused SSL certificates, identifying 77 linked Alibaba-hosted servers and malicious APKs. The malware can steal SMS and device data and enroll victims in premium services.

Key points

Joker Android malware disguises itself as legitimate apps and can intercept SMS, collect contacts and device information, and subscribe victims to premium services.
Researchers analyzed a wallpaper APK flagged as Joker by six of 47 VirusTotal vendors and observed it communicating with hdphoto[.]uno.
The APK retrieved encoded files containing a Joker DEX payload and made repeated POST requests to the C2 server.
Reused Let's Encrypt certificates linked 77 IP addresses across Alibaba-hosted infrastructure; the newer certificate's IPs overlapped with the older set and included additional servers.
Researchers identified Joker-associated APKs and domains on active servers, including cgan[.]info and kuen[.]work.
The article recommends using certificate history and related infrastructure indicators for threat hunting, and advises users to review app permissions and download apps only from official stores.

Article Details

Attack Vectors: Joker is distributed in Android applications masquerading as legitimate apps; the article says it is frequently distributed through the Google Play Store, although the analyzed app was not hosted there at the time of writing.
The malware communicates with C2 infrastructure using HTTP POST requests and retrieves payload files, including a base64-encoded DEX payload.
Once installed, Joker intercepts SMS messages, harvests contacts and device information, and subscribes victims to premium services.
Defensive Notes: Use SSL certificate history and certificate-IP pivots to identify infrastructure reuse and related servers.
Hunt for the listed Joker-related IPs, domains, and file hashes; the article notes that certificate reuse and uncommon TLDs can support infrastructure hunting but that TLDs alone are not strong indicators.
Users can reduce risk by downloading apps only from official stores, reviewing app permissions, checking for inflated reviews, and searching for information about apps with large download counts.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`ablefee[.]wiki`	Domain named in a certificate observed across Joker-linked infrastructure.
DOMAIN	`airsound[.]fit`	Domain named in a certificate observed across Joker-linked infrastructure.
DOMAIN	`amazingcam[.]xyz`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`appapi[.]cepatcairc[.]cc`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`artistchoice[.]fit`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`atck[.]wang`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`bsjk-jp[.]82021819[.]com`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`cetalpre[.]me`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`cgan[.]info`	Domain resolving to a server associated with a Joker APK.
DOMAIN	`cirlate[.]work`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`colamati[.]fun`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`colorfulmsg[.]store`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`denlaje[.]art`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`diycont[.]art`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`easdr[.]cyou`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`easytexting[.]art`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`edcious[.]shop`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`effeai[.]me`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`enchan[.]cloud`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`eqim[.]club`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`eureca[.]fit`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`fartsounds[.]xyz`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`feltwod[.]fun`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`femk[.]top`	Domain resolving to a reported Joker-linked server.
DOMAIN	`gasu[.]pw`	Domain resolving to an IP identified as Joker-linked infrastructure.
DOMAIN	`gbclm[.]info`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`goldseek[.]cc`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`goodivew[.]store`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`gordid[.]work`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`graffity[.]fun`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`gumblerumble[.]art`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`hdphoto[.]uno`	Domain used by Joker for C2 requests and payload retrieval.
DOMAIN	`helljni[.]com`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`hoful[.]homes`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`inspd[.]club`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`intoxit[.]club`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`jevq[.]art`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`jkicker[.]art`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`jueo[.]quest`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`kdo[.]monster`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`kefu[.]esgxiehui[.]com`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`kuen[.]work`	Domain resolving to a server associated with a Joker APK.
DOMAIN	`kxnwf[.]fun`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`lads[.]cc`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`likeand[.]cloud`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`lushere[.]host`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`mablefam[.]art`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`mannada[.]cc`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`me-east-1[.]oss[.]aliyuncs[.]com`	Host identified in the IOC table as resolving to a Joker-linked IP.
DOMAIN	`mer[.]college`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`micap[.]top`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`mojifu3d[.]wiki`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`monitor-hospot[.]rinjanihost[.]com`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`ngxs[.]work`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`nowaute[.]top`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`oneyipose[.]vip`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`ooouni[.]com`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`paltric[.]xin`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`panel[.]goepos[.]id`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`passroad[.]beauty`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`petiver[.]art`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`photopal[.]art`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`photy[.]top`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`pianomaster[.]store`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`plusonepic[.]cloud`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`pnidh[.]fun`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`pojys[.]vip`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`polar[.]info`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`politan[.]site`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`pranfun[.]cc`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`pugoy[.]vip`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`qidakan[.]com`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`qigu[.]black`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`richus[.]top`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`rophatic[.]website`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`rumblesc[.]fun`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`ryowzs[.]fit`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`screenlocker[.]art`	Domain listed among Joker-linked infrastructure.
DOMAIN	`securemsg[.]store`	Domain listed among Joker-linked infrastructure.
DOMAIN	`senspom[.]info`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`shpum[.]work`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`soundbutton[.]art`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`tamf[.]top`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`teyvata[.]com`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`timeschord[.]co`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`timestampmark[.]me`	Domain listed among Joker-linked infrastructure.
DOMAIN	`tmvp[.]xin`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`tomomsg[.]xyz`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`toniben[.]space`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`tuatol[.]store`	Domain resolving to a reported Joker-linked server.
DOMAIN	`umerz[.]info`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`valenstickers[.]me`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`vocall[.]club`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`vokepru[.]art`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`wanis[.]cc`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`wetanra[.]fit`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`yamibox[.]store`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`ynur[.]online`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`youngerpiano[.]xyz`	Domain listed as resolving to Joker network infrastructure.
DOMAIN	`ytky[.]tech`	Domain listed as resolving to Joker network infrastructure.
IPV4	`47[.]236[.]13[.]64`	IP listed as Joker network infrastructure.
IPV4	`47[.]236[.]132[.]59`	IP listed as Joker network infrastructure.
IPV4	`47[.]236[.]136[.]254`	IP listed as Joker network infrastructure.
IPV4	`47[.]236[.]140[.]108`	IP listed as Joker network infrastructure.
IPV4	`47[.]236[.]142[.]61`	IP listed as Joker network infrastructure.
IPV4	`47[.]236[.]152[.]0`	IP listed as Joker network infrastructure.
IPV4	`47[.]236[.]184[.]154`	IP listed as Joker network infrastructure.
IPV4	`47[.]236[.]185[.]226`	IP listed as Joker network infrastructure.
IPV4	`47[.]236[.]232[.]241`	IP listed as Joker network infrastructure.
IPV4	`47[.]236[.]241[.]158`	IP listed as Joker network infrastructure.
IPV4	`47[.]236[.]254[.]202`	IP listed as Joker network infrastructure.
IPV4	`47[.]236[.]31[.]185`	IP listed as Joker network infrastructure.
IPV4	`47[.]236[.]42[.]182`	IP listed as Joker network infrastructure.
IPV4	`47[.]236[.]48[.]123`	IP listed as Joker network infrastructure.
IPV4	`47[.]236[.]48[.]202`	IP listed as Joker network infrastructure.
IPV4	`47[.]236[.]49[.]195`	Joker-linked C2 server that initially resolved for hdphoto[.]uno.
IPV4	`47[.]236[.]50[.]129`	IP listed as Joker network infrastructure.
IPV4	`47[.]236[.]52[.]163`	IP listed as Joker network infrastructure.
IPV4	`47[.]236[.]56[.]63`	IP listed as Joker network infrastructure.
IPV4	`47[.]236[.]58[.]7`	IP listed as Joker network infrastructure.
IPV4	`47[.]236[.]60[.]207`	IP listed as Joker network infrastructure.
IPV4	`47[.]236[.]63[.]223`	IP listed as Joker network infrastructure.
IPV4	`47[.]236[.]64[.]124`	IP listed as Joker network infrastructure.
IPV4	`47[.]236[.]66[.]130`	IP listed as Joker network infrastructure.
IPV4	`47[.]236[.]70[.]132`	IP listed as Joker network infrastructure.
IPV4	`47[.]236[.]70[.]252`	IP listed as Joker network infrastructure.
IPV4	`47[.]236[.]89[.]240`	IP listed as Joker network infrastructure.
IPV4	`47[.]236[.]99[.]235`	IP explicitly listed in the article's Joker network observables.
IPV4	`47[.]237[.]106[.]43`	IP listed as Joker network infrastructure.
IPV4	`47[.]237[.]132[.]7`	IP listed as Joker network infrastructure.
IPV4	`47[.]237[.]14[.]161`	IP listed as Joker network infrastructure.
IPV4	`47[.]237[.]14[.]179`	IP listed as Joker network infrastructure.
IPV4	`47[.]237[.]165[.]56`	IP listed as Joker network infrastructure.
IPV4	`47[.]237[.]23[.]24`	IP listed as Joker network infrastructure.
IPV4	`47[.]237[.]68[.]12`	IP listed as Joker network infrastructure.
IPV4	`47[.]237[.]68[.]53`	Joker-linked C2 server to which the reported domain later moved.
IPV4	`47[.]237[.]71[.]26`	IP listed as Joker network infrastructure.
IPV4	`47[.]241[.]220[.]222`	IP listed as Joker network infrastructure.
IPV4	`47[.]245[.]106[.]232`	IP listed as Joker network infrastructure.
IPV4	`47[.]245[.]112[.]50`	IP listed as Joker network infrastructure.
IPV4	`47[.]245[.]123[.]233`	IP listed as Joker network infrastructure.
IPV4	`47[.]245[.]126[.]152`	IP listed as Joker network infrastructure.
IPV4	`47[.]84[.]37[.]53`	IP listed as Joker network infrastructure.
IPV4	`47[.]84[.]44[.]76`	IP listed as Joker network infrastructure.
IPV4	`47[.]84[.]46[.]127`	IP listed as Joker network infrastructure.
IPV4	`47[.]84[.]49[.]230`	IP listed as Joker network infrastructure.
IPV4	`47[.]91[.]99[.]31`	Alibaba-hosted server whose VirusTotal results showed APKs communicating with it, including maliciously detected files.
IPV4	`8[.]219[.]0[.]154`	IP listed as Joker network infrastructure.
IPV4	`8[.]219[.]116[.]53`	IP listed as Joker network infrastructure.
IPV4	`8[.]219[.]124[.]253`	IP listed as Joker network infrastructure.
IPV4	`8[.]219[.]126[.]140`	IP listed as Joker network infrastructure.
IPV4	`8[.]219[.]132[.]122`	IP listed as Joker network infrastructure.
IPV4	`8[.]219[.]135[.]184`	IP listed as Joker network infrastructure.
IPV4	`8[.]219[.]145[.]123`	IP listed as Joker network infrastructure.
IPV4	`8[.]219[.]208[.]157`	IP listed as Joker network infrastructure.
IPV4	`8[.]219[.]221[.]185`	IP listed as Joker network infrastructure.
IPV4	`8[.]219[.]230[.]140`	IP listed as Joker network infrastructure.
IPV4	`8[.]219[.]246[.]210`	IP listed as Joker network infrastructure.
IPV4	`8[.]219[.]63[.]9`	IP listed as Joker network infrastructure.
IPV4	`8[.]219[.]71[.]57`	IP listed as Joker network infrastructure.
IPV4	`8[.]219[.]77[.]97`	IP listed as Joker network infrastructure.
IPV4	`8[.]219[.]85[.]251`	IP listed as Joker network infrastructure.
IPV4	`8[.]219[.]92[.]109`	IP listed as Joker network infrastructure.
IPV4	`8[.]222[.]161[.]7`	IP listed as Joker network infrastructure.
IPV4	`8[.]222[.]164[.]8`	IP listed as Joker network infrastructure.
IPV4	`8[.]222[.]167[.]209`	IP listed as Joker network infrastructure.
IPV4	`8[.]222[.]176[.]193`	IP listed as Joker network infrastructure.
IPV4	`8[.]222[.]195[.]150`	Joker-linked server resolving to kuen[.]work and associated with a Joker APK.
IPV4	`8[.]222[.]203[.]59`	IP listed as Joker network infrastructure.
IPV4	`8[.]222[.]204[.]79`	IP listed as Joker network infrastructure.
IPV4	`8[.]222[.]227[.]247`	IP listed as Joker network infrastructure.
IPV4	`8[.]222[.]232[.]224`	IP listed as Joker network infrastructure.
IPV4	`8[.]222[.]237[.]93`	IP listed as Joker network infrastructure.
IPV4	`8[.]222[.]238[.]142`	IP listed as Joker network infrastructure.
IPV4	`8[.]222[.]246[.]250`	Joker-linked server resolving to cgan[.]info and associated with a Joker APK.
SHA256	`2766ce69097ccb0cd9b4a7f3cf6eac19d76db2acf7d1b6844cc10d5460528138`	SHA-256 of the text file containing the Joker DEX payload.
SHA256	`2c0845ff2ef220b6fcdd57c30471ee854bcd886b5c7d78c468bef47436197f36`	SHA-256 of an APK identified in the article as a Joker payload.
SHA256	`4000d8110f92d5622a19a75d85c7af38fef810cecfe054e02779da9c1e218e5d`	SHA-256 of a file described as likely the second stage of the attack.
SHA256	`5848152508acc864869500c0dfff20723a087019eb717131dc6d7df51fbd75e6`	SHA-256 of a certificate observed on Joker-linked infrastructure.
SHA256	`7f186746152d9569421a88e506c89844eaf0c2036ab5dbe0edb0775a79d9bb9d`	SHA-256 of the APK identified by the researchers as a Joker sample.
SHA256	`95f845f390269a3805657c9f544719c937fd458966818fadcbad7d4cc05b69ff`	SHA-256 of a certificate observed on Joker-linked infrastructure.
SHA256	`a5aa7e18aa8e0473d37661830eaf9ccd0401ee4c44de426e53e39fe47fa06ed4`	SHA-256 of an APK identified in the article as a Joker payload.
URL	`hxxp[:]//hdphoto[.]uno/conf/vcheck`	Joker sample's HTTP POST endpoint on its reported C2 domain.
URL	`hxxps[:]//hdphoto[.]uno/1VybiUSr`	Repeated POST endpoint contacted by the Joker sample.
URL	`hxxps[:]//hdphotouno[.]oss-me-east-1[.]aliyuncs[.]com/dex1_v16[.]txt`	Specific cloud-hosted resource returned by the Joker-related endpoint and identified as containing a Joker payload.