privateloader | 5c8dd6c1676d2c094b0ed7d36fb94e0993ccd7c74dc9f323e8fc98728ba27ef5

Sharing

Copy URL Twitter E-mail

General

Target
3a9ab32ea262a5def1a119b8ed5abce0_JaffaCakes118
Size 31.9MB
Sample240512-rw2ebsdf72
SHA256 5c8dd6c1676d2c094b0ed7d36fb94e0993ccd7c74dc9f323e8fc98728ba27ef5
MD5 3a9ab32ea262a5def1a119b8ed5abce0
SHA1 9498a36cfaebfae3221b66de19eb728794068668
SHA512 eaec68e7e920705027ad6d27a725d19309b2f083491dc80e9b75e718330164416d9104740da9b360f2ef6f8c301c9bf37fa54609100e2e495598f42bbb071275
SSDEEP 786432:5k2UClPdy6mPk51IbX1fecMcTom9C/ipn6DMjOFYWYh:22PQ61TAf2m8/KJjZZh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  3a9ab32ea262a5def1a119b8ed5abce0_JaffaCakes118
- Size 31.9MB
- SHA256 5c8dd6c1676d2c094b0ed7d36fb94e0993ccd7c74dc9f323e8fc98728ba27ef5
- MD5 3a9ab32ea262a5def1a119b8ed5abce0
- SHA1 9498a36cfaebfae3221b66de19eb728794068668
- SHA512 eaec68e7e920705027ad6d27a725d19309b2f083491dc80e9b75e718330164416d9104740da9b360f2ef6f8c301c9bf37fa54609100e2e495598f42bbb071275
- SSDEEP 786432:5k2UClPdy6mPk51IbX1fecMcTom9C/ipn6DMjOFYWYh:22PQ61TAf2m8/KJjZZh
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries the phone number (MSISDN for GSM devices)
  discovery
behavioral1 behavioral2
- Target
  bdxadsdk.jar
- Size 85KB
- SHA256 516023ce55fff40074d3c3d9016c023b1fc7dfba2b59c172f89141f1484d418e
- MD5 3c850ffec5bdd850f123077ca210a411
- SHA1 1c1ae4678b8a3b65640f047cb1bd72bc70d66f97
- SHA512 aa3611687b6140ee9214392a84bc1ef55a6425a84a4e413dfcb2e936a931b9015e1e4ec53ad73539d26622427f9e6da0eae5c58ffc18285de42fc15639d786dd
- SSDEEP 1536:E4A1vm52J1h/mgxeek9/Ckkf1THL8BNbM/DXO8Q/3yJ463v6hHA0UGcVrSj:e9mkJ1tmg/I/tkdP8sa80O42uXcVrE
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral3 behavioral4 behavioral5
- Target
  muzhiwanapp.apk
- Size 6.7MB
- SHA256 efa8e431c5d5b3bda3cfc0da4392d14ef447643412bbea22536a155c7aae82b4
- MD5 f166fff17a539f053550965c87c42054
- SHA1 8be071793576b6e324db218f02a017439fe826a3
- SHA512 26869689b5a58e52e63d95b07cf04f560c4580e9bd408a432a61acace492201ffe93cb7e4166a360530eff8fa3827ae0df83ee43e30daa7f670010d59a8bab8a
- SSDEEP 98304:thCSkJBDmTuhW+7eF0JUQ4KMB6NQP4WfxRENHpxPOJHMMC1dh4Zadvtvc8Y6dtR3:nru6wUQMBj4WfOHp+HPC1z4mkKdYIx
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

discovery evasion persistence banker collection credential_access impact
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Checks CPU information
  Checks CPU information which indicate if the system is an emulator.
  evasion discovery
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Registers a broadcast receiver at runtime (usually for listening for system events)
  persistence
- Acquires the wake lock
- Checks if the internet connection is available
  discovery
- Reads information about phone network operator.
  discovery
behavioral6 behavioral7
- Target
  mzw_d
- Size 59KB
- SHA256 2514431fe50d909ac1385e07341ed8878b5f2400df151df5a43a59b98a31ea02
- MD5 b2a8fd2dba92c8f75869f79c70d441da
- SHA1 faaf88b3c3653fc205a3a125ccb77fbc87b76215
- SHA512 a66893a5bb935dfefdc12ea32c2407cf9d8d040ff82852b415c599beb94d002ce77ec15bbac3f78ae6758a8c7f5e83c799ad84fb8ce2e6763da88a9bb20aa7b6
- SSDEEP 1536:zsgtqpcH/obgLKxe7wust6XTyLaFcBowg/pL2Nka2MXX3C:zsqqKH/BKxXMXTym/pyKiXnC
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral8
- Target
  mzw_g
- Size 42KB
- SHA256 7a28fd857e1283e351d37931cc6e23cd6de5ad2fd4d3d23337a6f162b07f3978
- MD5 c04d422c5a4bf58a127bbf2bf014965c
- SHA1 3b1f3f4ad21fe0febe567e5a56996a7e61658cf9
- SHA512 6cb2768a8344e3da470472ea906b5be2e33a24384efe35cdc3c0b0c24351c3b34444a4d2d6a9e21c48927b85554aaa3904fb0361071c0711841565222253e0a8
- SSDEEP 768:ccPeR+EU5maX9WkB/gUrXFWLKxe7X+Fu9hRv6Xf3QpD+X7aFkuzkjEC:ccPeRiNWkZbgLKxe7wuzt6XCyLaFm3
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10 behavioral11 behavioral9
- Target
  stasdk_core
- Size 2.1MB
- SHA256 8dc8a08cb4af889317d11fec26e2c1058f2af5056a4dbc25deaec8707073947f
- MD5 e1dd5bacfa75b9cf6abf6eaa1635e3c7
- SHA1 96a86954d989f634798c91523712c34eab06da3d
- SHA512 e62c106f91d7a7202411a6938ed721fa695257f205e93772a87c59804a899a1bafd4887d48f2c9f33e5fe3ab6965227beb3fee007515ceb926e83d0e990fcc37
- SSDEEP 49152:V1anRWSRRAeAOHy5mWr7cZVsjFrcZzVCuSlH7WKYnRgIpLLw:naRW0AqyJ0vsjFGzoNK7nRgIpLw
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

collection discovery evasion persistence
- Requests cell location
  Uses Android APIs to to get current cell location.
  collection discovery evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Queries information about the current nearby Wi-Fi networks
  Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
  discovery
- Registers a broadcast receiver at runtime (usually for listening for system events)
  persistence
- Checks if the internet connection is available
  discovery
behavioral12 behavioral13
- Target
  bdxadsdk.jar
- Size 85KB
- SHA256 516023ce55fff40074d3c3d9016c023b1fc7dfba2b59c172f89141f1484d418e
- MD5 3c850ffec5bdd850f123077ca210a411
- SHA1 1c1ae4678b8a3b65640f047cb1bd72bc70d66f97
- SHA512 aa3611687b6140ee9214392a84bc1ef55a6425a84a4e413dfcb2e936a931b9015e1e4ec53ad73539d26622427f9e6da0eae5c58ffc18285de42fc15639d786dd
- SSDEEP 1536:E4A1vm52J1h/mgxeek9/Ckkf1THL8BNbM/DXO8Q/3yJ463v6hHA0UGcVrSj:e9mkJ1tmg/I/tkdP8sa80O42uXcVrE
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral14 behavioral15 behavioral16
- Target
  gdtadv2.jar
- Size 142KB
- SHA256 8f109682334d43d811c7d56620c5eb30c9bc1a89f3f36b91232aeb142a6f6ba7
- MD5 f0b930680aa93a62bb77d1916e64a3d7
- SHA1 fc30b5641b8d32e4efeaf409d07a4d520a95a6da
- SHA512 2a503f3aefd5ed8634dbc85cd952d10625e4bc18badc0661c7cfcc3345cfb43ba1e153d9fb264703e4cf0d6c40ac601942e841b9537125072f884c283adb5b99
- SSDEEP 3072:mZmii8gAi97ZHbwRILfiNJkAzzBdtCQnm:m8B99TZA/3m
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral17 behavioral18 behavioral19