The newest Joker IOCs are not hashes. They are behavior patterns. Joker, also tracked as Bread, re-signs and repackages itself constantly, so a SHA-256 printed in a blog post last Tuesday is mostly useful for retro-hunting, not for detection. What still holds up is a cluster of traits: SMS permission abuse, a dropper that decrypts and loads DEX at runtime, premium shortcode and WAP billing fraud, and disguises that make the app look like a flashlight, a scanner, or a wallpaper pack. I look for those clusters, then pivot to hashes and domains from the samples I find.

more on this topic

Why the file-level IOCs rot so fast

Every Joker build can carry a different certificate, a different package name, and a different obfuscation layer. The payload that actually does the damage often arrives after install, pulled from a remote host or unpacked from assets. That means the APK on disk may not contain the real logic at all. If your IOC feed is nothing but hashes, you are always one repackage behind. Weight behavior more heavily than signatures.

Joker IOC URLs: A Threat Intelligence Guide for Defenders

Host and device indicators worth hunting

• Manifest combines SMS reading, SMS receiving, and sending in one app that has no obvious SMS purpose. This trio is the single strongest Joker signal.
• Requests for notification access or accessibility service that are never explained in the UI, often asked for in a second screen after launch.
• Launcher activity hides itself after activation, or the app renames its own label to something generic.
• DEX or JAR files written into the app's private data directory, then loaded with a class loader. Any dynamic code loading from writable storage is a red flag.
• Encrypted or base64 blobs in assets that decrypt to a sub-app image on first run.
• Outbound SMS without user confirmation, especially to shortcodes, along with silent carrier billing flows.
• Traffic to messaging app APIs used as a C2 channel. Several Joker variants have blended command and control into Telegram Bot API calls, which looks like ordinary chat traffic to most monitors.
• Beacons carrying device fingerprint fields, carrier code, and locale, used for targeting.

Static indicators to check first

Start with the manifest and the assets folder. I want to see the permission set, the exported components, and anything unpacked after install. Then look at the certificate, since Joker samples frequently use freshly generated signing keys and generic organization fields. Finally, scan for packers and the usual obfuscation tooling. A terse package that requests SMS rights, ships an encrypted asset, and has a fresh cert deserves a sandbox run even if no signature fires.

How to Find Joker IOC URLs: A Practical Threat-Intel Workflow

Getting fresh indicators yourself

Static feeds lag. Dynamic analysis does not. Run suspected APKs in a sandbox that captures SMS activity, file writes, and network calls, and let it sit for several minutes so a second stage can drop. Google's Play Protect and Android security telemetry have driven large cleanup waves against this family, and Google has publicly described removing more than 1,700 apps tied to Bread across a multi-year takedown effort. Vendor research from Kaspersky and from mobile fraud teams at Cleafy and ThreatFabric stays current on the family's evolution, and MITRE ATT&CK Mobile maps the behaviors to techniques you can turn into detections. Pull the domains, package names, and cert fingerprints out of each fresh sample and seed your own blocklist.

related article

Triage checklist

1. Confirm permission abuse before anything else.
2. Inspect assets for encrypted or encoded payloads.
3. Check for DEX or JAR writes into app storage.
4. Diff the certificate against known-good publishers.
5. Watch outbound SMS and shortcode activity in the sandbox.
6. Capture C2 hosts and any messaging API endpoints.
7. Push resulting hashes, domains, and certs into retro-hunting.

Caveats

Joker is a moving target, and any indicator list is a snapshot. Treat the behavioral patterns above as durable and the technical artifacts as perishable. If you only remember one thing, remember the SMS permission trio. It catches more real samples than any hash list I have used.