f09322c9ab1aec2c9d163ec706c3324faa7092192c94704ccda487105ac373b1

General

Target

f8eb4b89117f15999186267bbe6f083b_JaffaCakes118
Size

23.7MB
Sample

240418-2rhrjaaa9t
MD5

f8eb4b89117f15999186267bbe6f083b
SHA1

2106092baca993e9943719e2fffa98fc0d51edcf
SHA256

f09322c9ab1aec2c9d163ec706c3324faa7092192c94704ccda487105ac373b1
SHA512

989978ca92582402d8c8c19caaadab699e8548ae94b004e48b846771406745d822130737a3807af910012b73484bd8d875b72c2cd4f0d0200e567d4163c542e6
SSDEEP

393216:vQQcUwk3/eg3WW20KFDlamjk9phMs1+rO+T+Mn3CHdkLwTAkWlQTfvPKqb6um3N1:vFcUw0+WYFDlah9N+rOC+Mn3udkLKzre

Score

8^/10

Malware Config

Targets

- Target
  
  f8eb4b89117f15999186267bbe6f083b_JaffaCakes118
- Size
  
  23.7MB
- MD5
  
  f8eb4b89117f15999186267bbe6f083b
- SHA1
  
  2106092baca993e9943719e2fffa98fc0d51edcf
- SHA256
  
  f09322c9ab1aec2c9d163ec706c3324faa7092192c94704ccda487105ac373b1
- SHA512
  
  989978ca92582402d8c8c19caaadab699e8548ae94b004e48b846771406745d822130737a3807af910012b73484bd8d875b72c2cd4f0d0200e567d4163c542e6
- SSDEEP
  
  393216:vQQcUwk3/eg3WW20KFDlamjk9phMs1+rO+T+Mn3CHdkLwTAkWlQTfvPKqb6um3N1:vFcUw0+WYFDlah9N+rOC+Mn3udkLKzre
Score

8^/10

banker collection discovery evasion persistence
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Requests cell location
  Uses Android APIs to to get current cell location.
  collection discovery
- Checks CPU information
  Checks CPU information which indicate if the system is an emulator.
  evasion discovery
- Checks known Qemu pipes.
  Checks for known pipes used by the Android emulator to communicate with the host.
  evasion
- Checks memory information
  Checks memory information which indicate if the system is an emulator.
  evasion discovery
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Queries information about running processes on the device.
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries information about the current Wi-Fi connection.
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Reads information about phone network operator.
  discovery
- Checks the presence of a debugger
  evasion
behavioral1