General

  • Target

    03ea051c729ff412cfa56fe95b16b492_JaffaCakes118

  • Size

    17.9MB

  • Sample

    240427-3xlk2sbf6z

  • MD5

    03ea051c729ff412cfa56fe95b16b492

  • SHA1

    3056d89dbb740dec8439e8e07617099e24bcaa20

  • SHA256

    479e965bd87a9436f5f0fe72d42c39f9ae97984b9bd3bb1f6f814068ba4c05a1

  • SHA512

    51fe78c82d3a0272db370a9f721bb90c72212cfc68d4e05388602bc7a3f6fa1b8619a0f69204e8d96d4dd20d6b095c95b36b97b828e6174f3f1a339f0e9318f6

  • SSDEEP

    393216:lbgSb13prSesBFNcVF03yw66Rkcm53V32nRJBA7PqHW/y9irf0qsBL:r132BFaXoywVbm5J2nzS7Pd/brf0Pt

Malware Config

Extracted

Family

joker

C2

https://open.weixin.qq.com/connect/sdk/qrconnect?appid=%s&noncestr=%s&timestamp=%s&scope=%s&signature=%s

Targets

    • Target

      03ea051c729ff412cfa56fe95b16b492_JaffaCakes118

    • Size

      17.9MB

    • MD5

      03ea051c729ff412cfa56fe95b16b492

    • SHA1

      3056d89dbb740dec8439e8e07617099e24bcaa20

    • SHA256

      479e965bd87a9436f5f0fe72d42c39f9ae97984b9bd3bb1f6f814068ba4c05a1

    • SHA512

      51fe78c82d3a0272db370a9f721bb90c72212cfc68d4e05388602bc7a3f6fa1b8619a0f69204e8d96d4dd20d6b095c95b36b97b828e6174f3f1a339f0e9318f6

    • SSDEEP

      393216:lbgSb13prSesBFNcVF03yw66Rkcm53V32nRJBA7PqHW/y9irf0qsBL:r132BFaXoywVbm5J2nzS7Pd/brf0Pt

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Checks CPU information

      Checks CPU information which indicate if the system is an emulator.

    • Checks memory information

      Checks memory information which indicate if the system is an emulator.

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    • Queries information about running processes on the device

      Application may abuse the framework's APIs to collect information about running processes on the device.

    • Queries information about the current Wi-Fi connection

      Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    • Queries the mobile country code (MCC)

    • Registers a broadcast receiver at runtime (usually for listening for system events)

    • Checks if the internet connection is available

    • Queries the unique device ID (IMEI, MEID, IMSI)

    • Reads information about phone network operator.

    • Target

      gdtadv2.jar

    • Size

      590KB

    • MD5

      a20b450b9eddfc89b600595f52e69835

    • SHA1

      8fac99e31e63859f9779ce28e526b7a7bd5e1033

    • SHA256

      cbece95c97f4e62939f1623c2cbdd9c3271a6600d35d756a0cd9795bb264b690

    • SHA512

      c135b78fa9105bcd61807c52fb3bee327bf000b8d88676be69f6128062cc53fcb2ebb866e8cfabfb2afb3fc96b06ca9394bf60648eec7e783ecdb7862bd45a59

    • SSDEEP

      12288:PX9lN1F524rzvxSbYm5iabo/GaQIcTlwK9Cp3ZUbRkQiQ0747vBDZ:lf1bfrzO5o/GaYcp3vQB04vhZ

    Score
    1/10

MITRE ATT&CK Mobile v15

Tasks