Joker Playing Hide-and-Seek with Google Play

Zscaler ThreatLabZ analyzed multiple Joker malware variants found on Google Play (17 samples, ~120,000 downloads) that use varied staging techniques (direct, one-stage, two-stage), string obfuscation (custom separators), AES/DES encryption, and remote C2-hosted payloads to deliver a final payload that steals SMS, contacts and enrolls victims in premium WAP services; the report provides MD5s, package names, payload distribution URLs, final C2 IPs, and recommendations to review app permissions and user reviews.