d0db237d5540228656ed531e989217abd81b365b4f20427621cbc1d4b138f17b

General

Target

035e6a60d981819a3e6cb98f12ce9547_JaffaCakes118
Size

1.3MB
Sample

240427-qxvshabe56
MD5

035e6a60d981819a3e6cb98f12ce9547
SHA1

3572b9a6c68a1e290e47d8e94632678b00ec51fe
SHA256

d0db237d5540228656ed531e989217abd81b365b4f20427621cbc1d4b138f17b
SHA512

29e547fbfc7525c25e6cb71461d3879735c41ed524c9f861869f6aee7c537a6ecc25e972b7d3f4944e0193841431dfcfc3d7e325ad0cebffd0f399e8289d9b73
SSDEEP

24576:woL0otaYtXMjGxdJZXs+bS8oaPnDAUCxFM3jbo+gAjIb8q/13tdHbZKm51Ob83AT:/Q7Yt5dJZJboaPDAUcFAj3djIb8q/1Xo

Score

8^/10

Malware Config

Targets

- Target
  
  035e6a60d981819a3e6cb98f12ce9547_JaffaCakes118
- Size
  
  1.3MB
- MD5
  
  035e6a60d981819a3e6cb98f12ce9547
- SHA1
  
  3572b9a6c68a1e290e47d8e94632678b00ec51fe
- SHA256
  
  d0db237d5540228656ed531e989217abd81b365b4f20427621cbc1d4b138f17b
- SHA512
  
  29e547fbfc7525c25e6cb71461d3879735c41ed524c9f861869f6aee7c537a6ecc25e972b7d3f4944e0193841431dfcfc3d7e325ad0cebffd0f399e8289d9b73
- SSDEEP
  
  24576:woL0otaYtXMjGxdJZXs+bS8oaPnDAUCxFM3jbo+gAjIb8q/13tdHbZKm51Ob83AT:/Q7Yt5dJZJboaPDAUcFAj3djIb8q/1Xo
Score

8^/10

banker collection discovery evasion persistence stealth trojan
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Removes its main activity from the application launcher
  stealth trojan evasion
- Checks CPU information
  Checks CPU information which indicate if the system is an emulator.
  evasion discovery
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries account information for other applications stored on the device
  Application may abuse the framework's APIs to collect account information stored on the device.
  collection
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Registers a broadcast receiver at runtime (usually for listening for system events)
  persistence
- Checks if the internet connection is available
  discovery
- Queries the unique device ID (IMEI, MEID, IMSI)
  discovery
- Reads information about phone network operator.
  discovery
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Targets

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Removes its main activity from the application launcher

Checks CPU information

Loads dropped Dex/Jar

Queries account information for other applications stored on the device

Queries information about running processes on the device

Queries information about the current Wi-Fi connection

Registers a broadcast receiver at runtime (usually for listening for system events)

Checks if the internet connection is available

Queries the unique device ID (IMEI, MEID, IMSI)

Reads information about phone network operator.

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

behavioral3