General

  • Target

    f754fdb148454e2aaeac021374e7cd03_JaffaCakes118

  • Size

    3.0MB

  • Sample

    240418-fv7zyaca79

  • MD5

    f754fdb148454e2aaeac021374e7cd03

  • SHA1

    5eaaca3b46cc0b7027c8cf5cb30be9d270315da3

  • SHA256

    1101d16bdbd021d03cec94ac05abce0498ea5766923ac060caf6fa5d95ba98ca

  • SHA512

    ad8579d62005d129e5428e080f75799ab82ebe0e191648a2607c04d4649e5b48770a29f49611a2745e9b24419e1d3c34de7cb381976bdc9593014256c19a3412

  • SSDEEP

    49152:9/gDaS7maqfziYeH0Yf4l1pEH4Ct45d93ByYO9RGy1kz/KqD533nzQ4HXu:9/gDaS6Jzq04yu3tU939O9RXk/pJW

Malware Config

Targets

    • Target

      f754fdb148454e2aaeac021374e7cd03_JaffaCakes118

    • Size

      3.0MB

    • MD5

      f754fdb148454e2aaeac021374e7cd03

    • SHA1

      5eaaca3b46cc0b7027c8cf5cb30be9d270315da3

    • SHA256

      1101d16bdbd021d03cec94ac05abce0498ea5766923ac060caf6fa5d95ba98ca

    • SHA512

      ad8579d62005d129e5428e080f75799ab82ebe0e191648a2607c04d4649e5b48770a29f49611a2745e9b24419e1d3c34de7cb381976bdc9593014256c19a3412

    • SSDEEP

      49152:9/gDaS7maqfziYeH0Yf4l1pEH4Ct45d93ByYO9RGy1kz/KqD533nzQ4HXu:9/gDaS6Jzq04yu3tU939O9RXk/pJW

    • Hydra

      Android banker and info stealer.

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Reads information about phone network operator.

MITRE ATT&CK Matrix

Tasks