9db73fbfd159dbb6079c686525c13fe4f0170cc03fd6ccfdc16c1ba629e85831 | Triage

Sharing

General

Target

3255f86d597b1bb2ecf4664c6c03db04_JaffaCakes118
Size

4.4MB
Sample

240511-daxx5aha5x
MD5

3255f86d597b1bb2ecf4664c6c03db04
SHA1

e01f374c7be2e2421b94923bd78f14e6d83c5f62
SHA256

9db73fbfd159dbb6079c686525c13fe4f0170cc03fd6ccfdc16c1ba629e85831
SHA512

c5ed735a1bd8aa11f0a7e6baf868ba69fa470381fc96a3145de9b18168dfc0ae70df6b35bf5abd660ba88613b4172924cc603867f2cfbeffcd25fab41ae4f456
SSDEEP

98304:VXF7rWKYbgC4Y7ur1mtYXIPa/fjsllHlT8zQX/A6/kC0hz3RObFX:NQKYbgVYiAtYX5/ri+I/A6c7ROF

Score

8^/10

android banker discovery evasion persistence

Malware Config

Targets

- Target
  
  3255f86d597b1bb2ecf4664c6c03db04_JaffaCakes118
- Size
  
  4.4MB
- MD5
  
  3255f86d597b1bb2ecf4664c6c03db04
- SHA1
  
  e01f374c7be2e2421b94923bd78f14e6d83c5f62
- SHA256
  
  9db73fbfd159dbb6079c686525c13fe4f0170cc03fd6ccfdc16c1ba629e85831
- SHA512
  
  c5ed735a1bd8aa11f0a7e6baf868ba69fa470381fc96a3145de9b18168dfc0ae70df6b35bf5abd660ba88613b4172924cc603867f2cfbeffcd25fab41ae4f456
- SSDEEP
  
  98304:VXF7rWKYbgC4Y7ur1mtYXIPa/fjsllHlT8zQX/A6/kC0hz3RObFX:NQKYbgVYiAtYX5/ri+I/A6c7ROF
Score

8^/10

banker discovery evasion persistence
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Checks CPU information
  Checks CPU information which indicate if the system is an emulator.
  evasion discovery
- Checks memory information
  Checks memory information which indicate if the system is an emulator.
  evasion discovery
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries the mobile country code (MCC)
  discovery
- Registers a broadcast receiver at runtime (usually for listening for system events)
  persistence
- Checks if the internet connection is available
  discovery
- Queries the unique device ID (IMEI, MEID, IMSI)
  discovery
behavioral1

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

Broadcast Receivers

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

System Checks

Credential Access

Discovery

Process Discovery

Software Discovery

Security Software Discovery

System Information Discovery

System Network Configuration Discovery

System Network Connections Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bankerdiscoveryevasionpersistence