e4ca8b1332fa508a7c6001728851ae53939ff0816066a062197fa79f04186f24

General

Target
52610838efa32adca4b7c848af3a4665_JaffaCakes118
Size 17.0MB
Sample240518-bfhz2sce45
SHA256 e4ca8b1332fa508a7c6001728851ae53939ff0816066a062197fa79f04186f24
MD5 52610838efa32adca4b7c848af3a4665
SHA1 1b6ed1acc52cab13f24c7498f317ec3c5d57f87f
SHA512 29530c8ed9773a1076af7fe2a16b4c4fb2b16cd4c4ad2c3519bd7f04d2b086ad531a2df30fb40892a051ae29562d3781505a7d45d425abdee25f4f2d5ec70215
SSDEEP 393216:T/BDo31ukcdx1gyGjpWxqmeJE3DZrj+O0Vm7zL49k9o5DYosPH:T/BqokcXKyGjpWxqme+39n+tVm7X49m9
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Targets

- Target
  52610838efa32adca4b7c848af3a4665_JaffaCakes118
- Size 17.0MB
- SHA256 e4ca8b1332fa508a7c6001728851ae53939ff0816066a062197fa79f04186f24
- MD5 52610838efa32adca4b7c848af3a4665
- SHA1 1b6ed1acc52cab13f24c7498f317ec3c5d57f87f
- SHA512 29530c8ed9773a1076af7fe2a16b4c4fb2b16cd4c4ad2c3519bd7f04d2b086ad531a2df30fb40892a051ae29562d3781505a7d45d425abdee25f4f2d5ec70215
- SSDEEP 393216:T/BDo31ukcdx1gyGjpWxqmeJE3DZrj+O0Vm7zL49k9o5DYosPH:T/BqokcXKyGjpWxqme+39n+tVm7X49m9
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

banker collection discovery evasion impact persistence
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Requests cell location
  Uses Android APIs to to get current cell location.
  collection discovery evasion
- Checks CPU information
  Checks CPU information which indicate if the system is an emulator.
  evasion discovery
- Checks memory information
  Checks memory information which indicate if the system is an emulator.
  evasion discovery
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Queries information about the current nearby Wi-Fi networks
  Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
  discovery
- Registers a broadcast receiver at runtime (usually for listening for system events)
  persistence
- Acquires the wake lock
- Checks if the internet connection is available
  discovery
- Reads information about phone network operator.
  discovery
behavioral1
- Target
  AlipayMSP206_PPS3_V3.5.4.0619.apk
- Size 354KB
- SHA256 46f025d57f9aed1fb674c0fe8fc77add93cf00ea6e1633596955f33426be7688
- MD5 12ae4560d8350db4bd6fa3bc1589614c
- SHA1 dbbfce036a1823aaec9d1c7b621adbd7317f7fa9
- SHA512 df7348142a8c294d0d7f7ce77795fd0f81f60831ca1831164e5060c900aa90af430b11f6972103a5c6307d81d8cdf095105a9ab3d01c2183d10d01910976c6fd
- SSDEEP 6144:ipIlfloegHi/BBs3dWcfihtB7+Y3Ju4g29f5C8EcPK+WvyQcy2fn1E:ip2JgC/BBsNWfh3Vcc5CLE8Rcy2fn1E
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

collection discovery evasion
- Requests cell location
  Uses Android APIs to to get current cell location.
  collection discovery evasion
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Checks if the internet connection is available
  discovery
behavioral2