General

  • Target

    2ad78c5008f6b68da62c9f3c2cacb020_JaffaCakes118

  • Size

    276KB

  • Sample

    240509-txqekabc2z

  • MD5

    2ad78c5008f6b68da62c9f3c2cacb020

  • SHA1

    bbe638a415c8b36c211c52162c3bc9768ff941c6

  • SHA256

    f41f2554eb20d8e85fee974faec1ff6e59334ae45b54a2b0256975d6e8798bfd

  • SHA512

    145e422473ea9ccbee11441a728ced92cd57d19d48ade4e89efa4c1f8d977725c67e990e94862702332960391a750db06f28411523a6adddf3cbede41e9a852c

  • SSDEEP

    6144:ypJaoopV3qfmQdns9Ci51ga+eueyAwv49pKGWWwg:+gooH3quQdHi5yTJeyAwvApKGqg

Malware Config

Targets

    • Target

      2ad78c5008f6b68da62c9f3c2cacb020_JaffaCakes118

    • Size

      276KB

    • MD5

      2ad78c5008f6b68da62c9f3c2cacb020

    • SHA1

      bbe638a415c8b36c211c52162c3bc9768ff941c6

    • SHA256

      f41f2554eb20d8e85fee974faec1ff6e59334ae45b54a2b0256975d6e8798bfd

    • SHA512

      145e422473ea9ccbee11441a728ced92cd57d19d48ade4e89efa4c1f8d977725c67e990e94862702332960391a750db06f28411523a6adddf3cbede41e9a852c

    • SSDEEP

      6144:ypJaoopV3qfmQdns9Ci51ga+eueyAwv49pKGWWwg:+gooH3quQdHi5yTJeyAwvApKGqg

    • XLoader payload

    • XLoader, MoqHao

      An Android banker and info stealer.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Removes its main activity from the application launcher

    • Requests changing the default SMS application.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Queries the phone number (MSISDN for GSM devices)

    • Reads the content of the MMS message.

    • Registers a broadcast receiver at runtime (usually for listening for system events)

    • Acquires the wake lock

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

MITRE ATT&CK Matrix

Tasks