General

  • Target

    2825d07c0c22ce7163b02e33383d3ff3_JaffaCakes118

  • Size

    31.7MB

  • Sample

    240509-d91s3abf38

  • MD5

    2825d07c0c22ce7163b02e33383d3ff3

  • SHA1

    682ac969938da916aa2ed75a729a1e6973c0601c

  • SHA256

    10eff7323ac2e20362ed7595ab089bb8c13079565991cd29e579563e5939bbf0

  • SHA512

    1c7bd56af0fb75fb0cf5185112f1097f4cdb4b5e65d91f010d9ba212f3808a8cb57bb8bb21112848215134a9fa2c4bb3781e4b0b3b065758274ba75e504b3d2c

  • SSDEEP

    786432:uNKDyd9wNtfzhsfsZ1AToR7XVp8ZWy+p480NpDv/ZdH3uggw+DsKAZrD:ucDcfsZiTS7VpmH+p48qXODmP

Malware Config

Targets

    • Target

      2825d07c0c22ce7163b02e33383d3ff3_JaffaCakes118

    • Size

      31.7MB

    • MD5

      2825d07c0c22ce7163b02e33383d3ff3

    • SHA1

      682ac969938da916aa2ed75a729a1e6973c0601c

    • SHA256

      10eff7323ac2e20362ed7595ab089bb8c13079565991cd29e579563e5939bbf0

    • SHA512

      1c7bd56af0fb75fb0cf5185112f1097f4cdb4b5e65d91f010d9ba212f3808a8cb57bb8bb21112848215134a9fa2c4bb3781e4b0b3b065758274ba75e504b3d2c

    • SSDEEP

      786432:uNKDyd9wNtfzhsfsZ1AToR7XVp8ZWy+p480NpDv/ZdH3uggw+DsKAZrD:ucDcfsZiTS7VpmH+p48qXODmP

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Requests cell location

      Uses Android APIs to to get current cell information.

    • Requests cell location

      Uses Android APIs to to get current cell location.

    • Checks CPU information

      Checks CPU information which indicate if the system is an emulator.

    • Checks known Qemu files.

      Checks for known Qemu files that exist on Android virtual device images.

    • Checks known Qemu pipes.

      Checks for known pipes used by the Android emulator to communicate with the host.

    • Checks memory information

      Checks memory information which indicate if the system is an emulator.

    • Queries information about running processes on the device

      Application may abuse the framework's APIs to collect information about running processes on the device.

    • Queries the mobile country code (MCC)

    • Registers a broadcast receiver at runtime (usually for listening for system events)

    • Checks if the internet connection is available

    • Queries the unique device ID (IMEI, MEID, IMSI)

    • Reads information about phone network operator.

    • Listens for changes in the sensor environment (might be used to detect emulation)

    • Target

      vivounionapk_v4.2.4.0_d74cb3a_201808271150_signed_aligned.vua

    • Size

      4.2MB

    • MD5

      3200674229ed57cf762fc3d8c5137b55

    • SHA1

      0896d5f138545dc9ddbf0003518880d745c8fe0e

    • SHA256

      333ee74803ab4b114d6217250623869c751a00f4748c826c19ffcd7b29476195

    • SHA512

      31c96314a2b0d80ef3d6c04c0a6894b6a8ebff7e501fd48499ea0e12969ba4ac00cdd844caf839a16cdcffa5b51ee2f33af36a578dfd450c79c7e2bbc0c521ff

    • SSDEEP

      98304:aQn4W5hESDzkY18DTTcDPPIKGPBhFI+sqFkSOO:aQ4W5hEIkg8DTTcDPPIK+HFknO

    Score
    7/10
    • Queries information about running processes on the device

      Application may abuse the framework's APIs to collect information about running processes on the device.

    • Queries the unique device ID (IMEI, MEID, IMSI)

    • Target

      vivounionsdk.res

    • Size

      29KB

    • MD5

      7a92466708fa1ae45c5585a5b986f5aa

    • SHA1

      e9e8e0dc60208b7a8b64a65550442a73f1166c30

    • SHA256

      cc8416f87003538f2c8ea5280a7eaebfb40597b6ebdcc33c4fa64b0cf08d3b73

    • SHA512

      026dec17ed60d89257c8cb7873a0ccc0de910aad6706f1bbb7936229d7074b9542b7b80a2040f466c64e6cf8896e8531ee01ed7acbfa6a7ed90637a5fe2d477d

    • SSDEEP

      384:RAhiLwh2JKStCYi7PSSDq41bVjDIcRy3ftLYHiLaBsKFj+C:RAV2wYnSDqojDIcsfiHiG3l

    Score
    1/10

MITRE ATT&CK Mobile v15

Tasks