General
-
Target
4e7d171fcdcc00e1882872750b1f8fe6_JaffaCakes118
-
Size
5.8MB
-
Sample
240517-fhbqzaac65
-
MD5
4e7d171fcdcc00e1882872750b1f8fe6
-
SHA1
e71bc1f849bd0afb0b36a3ee3574577cedb90cdb
-
SHA256
8386715c5fc28c0c5de37fbde8004c29ad1022b15141107633b2b48799fa0df7
-
SHA512
43be43293f73d18ae861109e11c7afbc8759819ca01431ac5b3720da52db320b661acb87dfa666ac490c907e0fe383e87911af9bef9b9979eeb8ce6042c503ff
-
SSDEEP
98304:M0XCcDlfLwJ55mHgLljLWH6yE6eQTsddYU46uR3M13PxuqUsRt/OI5w5tPP:9XCcDljwfJLWH68pKcRhqUGUUw5dP
Behavioral task
behavioral1
Sample
4e7d171fcdcc00e1882872750b1f8fe6_JaffaCakes118.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral2
Sample
4e7d171fcdcc00e1882872750b1f8fe6_JaffaCakes118.apk
Resource
android-x64-20240514-en
Behavioral task
behavioral3
Sample
4e7d171fcdcc00e1882872750b1f8fe6_JaffaCakes118.apk
Resource
android-x64-arm64-20240514-en
Malware Config
Targets
-
-
Target
4e7d171fcdcc00e1882872750b1f8fe6_JaffaCakes118
-
Size
5.8MB
-
MD5
4e7d171fcdcc00e1882872750b1f8fe6
-
SHA1
e71bc1f849bd0afb0b36a3ee3574577cedb90cdb
-
SHA256
8386715c5fc28c0c5de37fbde8004c29ad1022b15141107633b2b48799fa0df7
-
SHA512
43be43293f73d18ae861109e11c7afbc8759819ca01431ac5b3720da52db320b661acb87dfa666ac490c907e0fe383e87911af9bef9b9979eeb8ce6042c503ff
-
SSDEEP
98304:M0XCcDlfLwJ55mHgLljLWH6yE6eQTsddYU46uR3M13PxuqUsRt/OI5w5tPP:9XCcDljwfJLWH68pKcRhqUGUUw5dP
-
Checks if the Android device is rooted.
-
Checks the application is allowed to request package installs through the package installer
Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).
-
Queries information about the current Wi-Fi connection
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries information about the current nearby Wi-Fi networks
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
-
Registers a broadcast receiver at runtime (usually for listening for system events)
-
Acquires the wake lock
-
Checks if the internet connection is available
-
Queries the unique device ID (IMEI, MEID, IMSI)
-
Reads information about phone network operator.
-
Schedules tasks to execute at a specified time
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Scheduled Task/Job
1Defense Evasion
Execution Guardrails
1Geofencing
1Subvert Trust Controls
1Code Signing Policy Modification
1