General

  • Target

    eaaa603ceed4c9a3d707b552b6a895a3_JaffaCakes118

  • Size

    3.3MB

  • Sample

    240410-kgztmacf9z

  • MD5

    eaaa603ceed4c9a3d707b552b6a895a3

  • SHA1

    7e0ddc97f948d5aee4042a62d82b89131a063f02

  • SHA256

    4ee193d7a93bbf1d0ae9ea86d775eee37f9e4fde4b9f025aa7c8e102dbfebfc7

  • SHA512

    c57fd3b3d9f578020ee045fd64f41085380630af1087a59391f372db2f1c11594e093d472ede474de6722150db25872f475afe8120b6d77d55e80b11d24d307f

  • SSDEEP

    98304:f59Wa3YxQjLWETO2eN/lAbOanVclzzbMI0sp6s:fPWRmL9Ttcan6DMI0y6s

Malware Config

Targets

    • Target

      eaaa603ceed4c9a3d707b552b6a895a3_JaffaCakes118

    • Size

      3.3MB

    • MD5

      eaaa603ceed4c9a3d707b552b6a895a3

    • SHA1

      7e0ddc97f948d5aee4042a62d82b89131a063f02

    • SHA256

      4ee193d7a93bbf1d0ae9ea86d775eee37f9e4fde4b9f025aa7c8e102dbfebfc7

    • SHA512

      c57fd3b3d9f578020ee045fd64f41085380630af1087a59391f372db2f1c11594e093d472ede474de6722150db25872f475afe8120b6d77d55e80b11d24d307f

    • SSDEEP

      98304:f59Wa3YxQjLWETO2eN/lAbOanVclzzbMI0sp6s:fPWRmL9Ttcan6DMI0y6s

    • Hydra

      Android banker and info stealer.

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Reads information about phone network operator.

MITRE ATT&CK Mobile v15

Tasks