General

  • Target

    50c05abf202aab569a598af71270ff00_JaffaCakes118

  • Size

    31.6MB

  • Sample

    240517-wj8ebsbe5z

  • MD5

    50c05abf202aab569a598af71270ff00

  • SHA1

    2a3277b82e478643c4ace9d2037cbe5bf01cc5e8

  • SHA256

    229a4459d93ca271b1af41c2d6c79ef7cdd8ddbff8251ee72796619745758faf

  • SHA512

    2c7989856bb8363a2e08cc4cd370f6b0bfa696cd5b5d1a00f7dcbc9720ca61d20c6e32cbb8e3d7b281cc97d008cfcb9104f4dafbe054db5e29422fe485c729e3

  • SSDEEP

    786432:UR3AWyiIacB3T6lx3Q88iWrONIb8Xz2qHGBcnFi3:UNAPiITB3T6bQl/b8D2qHGyo3

Malware Config

Extracted

Family

joker

C2

https://api.weibo.com/2/proxy/sdk/statistic.json

Targets

    • Target

      50c05abf202aab569a598af71270ff00_JaffaCakes118

    • Size

      31.6MB

    • MD5

      50c05abf202aab569a598af71270ff00

    • SHA1

      2a3277b82e478643c4ace9d2037cbe5bf01cc5e8

    • SHA256

      229a4459d93ca271b1af41c2d6c79ef7cdd8ddbff8251ee72796619745758faf

    • SHA512

      2c7989856bb8363a2e08cc4cd370f6b0bfa696cd5b5d1a00f7dcbc9720ca61d20c6e32cbb8e3d7b281cc97d008cfcb9104f4dafbe054db5e29422fe485c729e3

    • SSDEEP

      786432:UR3AWyiIacB3T6lx3Q88iWrONIb8Xz2qHGBcnFi3:UNAPiITB3T6bQl/b8D2qHGyo3

    • Requests cell location

      Uses Android APIs to to get current cell location.

    • Queries information about the current Wi-Fi connection

      Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    • Registers a broadcast receiver at runtime (usually for listening for system events)

    • Checks if the internet connection is available

    • Target

      1

    • Size

      70KB

    • MD5

      f9c5abc0635b6c6fcf841a06f18ec033

    • SHA1

      e3fb0e05c45c5d8aa2d6f8fbb26cdadbbd3b4999

    • SHA256

      d30beaae9bbb021429ac8e496f130a2a7ebd0f26f5956320c49081e4b162c9ec

    • SHA512

      55af060c8dba8e890354b11bfc65d578e60d40636bbeb1899733d293774a0c16c25bd5ef1e3339ed28554739c06155ed9d83d14ccfea1f224495f8e9aa15cdfb

    • SSDEEP

      1536:A4YeLHvFYLSHMU8zhSETpo8z0J8bcWtE5amVpZFF1FAgmObWb:A4YejSL0MU8V/oK0JYcpgOpHFrbWb

    Score
    1/10
    • Target

      9

    • Size

      5KB

    • MD5

      65881be88e0f72930678e6b931ab0130

    • SHA1

      a824bbe5e40010cb3b4e28c02d4885a9cfaa62a4

    • SHA256

      5ec62950e82db472f773321ae49bc2d02bf915788314ebaa898b5598017f37c1

    • SHA512

      d3ff334a50928b811dbc03533d559ad462483477359fb9141b46f2146c6b17d0fb4aef2e875a02d610a0ffd37eb51ba943b5308739a462a5f7af9dbdf1f38482

    • SSDEEP

      96:kAfr547juoLAy+ZRZtdG9vFyf0H9vfc+FtEmP8aTnn8ZtblhaHgmVllpu9:kACPuoLEZFYM0xFtEmEan8Ztb7agcQ9

    Score
    1/10
    • Target

      hackdex.jar

    • Size

      1KB

    • MD5

      0a53db95371adcc92d85253aac16bca7

    • SHA1

      2eec4b620fcf0bd5bc020dc1f230e3fdf6615e12

    • SHA256

      b90650d8dc095d2c3802fda82320e865c1c368e193466bd99706c1c77ee74c20

    • SHA512

      90a9f29b8fc6baf34463f518e111531591d9137b4b2b8ff2578547cb894eea9523dc7d894c9b428b17c3a01453e42ac0ba30804b7b89b834675a2469d567e917

    Score
    1/10
    • Target

      talkback_classes_dex.jar

    • Size

      47KB

    • MD5

      7a266933c50d7cd73d7ddaeb0ca109af

    • SHA1

      97553fd3ca3cc9ce32fe3b87cdd3b8bb7de772b5

    • SHA256

      943155e791dd857e4d10c8e5b24f74e476ba5d0c8f45e34e0e0c351f3f6be25a

    • SHA512

      3996410d5f267e6de9ddbffb5037c415992af3480e95e70b1e0f8754a4ff5562947f3b9976b2daa79a762d0b349922031ce5ccba4bbd43e050b41b2c8fb1583f

    • SSDEEP

      768:GcTVO+s4/RKQoYuDG7ha1tfX8jzntSMz3f4EQWF6hDn8A4WNnqwaHAEbp9u:VxshQruDGATfXUntSq3f4EQ1h8DctfkG

    Score
    1/10

MITRE ATT&CK Mobile v15

Tasks