10e76f9b66d07947eefe1e515379b278fe824c9b51a66b84bd5004f78e52702b

Sharing

Copy URL Twitter E-mail

General

Target
55c45f4ff7357411f890d2db66805331_JaffaCakes118
Size 14.1MB
Sample240518-va9qcsdc96
SHA256 10e76f9b66d07947eefe1e515379b278fe824c9b51a66b84bd5004f78e52702b
MD5 55c45f4ff7357411f890d2db66805331
SHA1 0a7c4e20d98d975f53bde23864c4e46524806952
SHA512 b2ec6ed21ac594f9857101c85db87c5ff67275b1db6589e0189db40278f4e6b1cda0c685a53d4aaf5341c4b26ee2ee871d38fcff16680896dd3b82b4fdc01efb
SSDEEP 393216:Ch4XfGE2IDJ7NF96ZBb2HsuUsbuZE0PMjZHa:ZfL2IDB396Z1Il0UY
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Targets

- Target
  55c45f4ff7357411f890d2db66805331_JaffaCakes118
- Size 14.1MB
- SHA256 10e76f9b66d07947eefe1e515379b278fe824c9b51a66b84bd5004f78e52702b
- MD5 55c45f4ff7357411f890d2db66805331
- SHA1 0a7c4e20d98d975f53bde23864c4e46524806952
- SHA512 b2ec6ed21ac594f9857101c85db87c5ff67275b1db6589e0189db40278f4e6b1cda0c685a53d4aaf5341c4b26ee2ee871d38fcff16680896dd3b82b4fdc01efb
- SSDEEP 393216:Ch4XfGE2IDJ7NF96ZBb2HsuUsbuZE0PMjZHa:ZfL2IDB396Z1Il0UY
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

banker collection credential_access discovery evasion execution impact persistence
- Checks if the Android device is rooted.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion credential_access
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Checks Android system properties for emulator presence.
  evasion
- Checks CPU information
  Checks CPU information which indicate if the system is an emulator.
  evasion discovery
- Checks known Qemu files.
  Checks for known Qemu files that exist on Android virtual device images.
  evasion
- Checks known Qemu pipes.
  Checks for known pipes used by the Android emulator to communicate with the host.
  evasion
- Checks memory information
  Checks memory information which indicate if the system is an emulator.
  evasion discovery
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Queries information about the current nearby Wi-Fi networks
  Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
  discovery
- Queries the mobile country code (MCC)
  discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Registers a broadcast receiver at runtime (usually for listening for system events)
  persistence
- Acquires the wake lock
- Checks if the internet connection is available
  discovery
- Queries the unique device ID (IMEI, MEID, IMSI)
  discovery
- Reads information about phone network operator.
  discovery
- Requests cell location
  Uses Android APIs to to get current cell information.
  collection discovery
- Schedules tasks to execute at a specified time
  Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
  execution persistence
- Checks the presence of a debugger
  evasion
behavioral1
- Target
  gdtadv2.jar
- Size 636KB
- SHA256 e6df28c535e661d33a134407674c32555fb985a6a8f3bf8ec743150db61fa7ec
- MD5 cf57d4f9f2ccd86816c4f02989252423
- SHA1 6978f24478ba9baa004bf4d21db251fe67957ec2
- SHA512 f759aea4c4fb91ce69f8238bd0e7c0f99b826cad04fc9c5f47c5afde2eceaf71d515d00f0e08b73c169e1a8bd21a17ddd3971bae27ddeb6960daaf5c5d719d4b
- SSDEEP 12288:lsocNwAPog24tsNbfevYHzN953QZlo5M0f+DMpP7x07S232vjUG:MNvPA9oYHzN953QEM0npDx0nm
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral2
- Target
  lib360.so
- Size 416KB
- SHA256 3dd3f5fb3f3caf48f3dd99410102f804aedfdf42582f7a9f12c9d26a60649a04
- MD5 2f78d0967ca568ce8ca499048621c4c2
- SHA1 a8c72bad930b1aa6aa4eaa9de2ba5fcdda28f06d
- SHA512 75c45a2781f73932cdbd9e2119cd927e38612d7ca48bf7293ab679ac386e8b75718a929d81b8c5a2e1db6cede036c207b4da13c3403b0ee4bad5858313a50b58
- SSDEEP 12288:Rr/mv1+q62vD3+chmTzd4jRAt5ZITrS3Dy:RqXrL3+3TzyjRM5+j
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery evasion impact
- Checks Android system properties for emulator presence.
  evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
behavioral3 behavioral4 behavioral5
- Target
  lib361.so
- Size 149KB
- SHA256 c5ecf28246cdb83bfb9d3df24dfcacd9feafb74f2737c4204bdb0b4fc9c183d4
- MD5 0523de895b3cc4821aa4a6a54fb8d46f
- SHA1 e1bd8b68265f24285cd38eb0548a3be8aa8cdf5d
- SHA512 f86f2c9bf612f217ed64d2fdafd890ce4b7240a3b7227130c939fb570d23b6534040334936e313d6ed1c10ca5f9720a5a1c46d39b4c26935939375470ad00fb0
- SSDEEP 3072:fcFCQoaVHdk310Y4/VvbIw48cXTiOrE9kTDMlcGVCVpap4J2WBRB3vn4AQYflR:iCyHdk31atM7NXmQTDHGVCja22WBjA3m
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral6 behavioral7 behavioral8
- Target
  gdtadv2.jar
- Size 102KB
- SHA256 278aaef0d3db0b27f06eaaaf77e53faff06aa64dccf6e865e4faf41c2de563ae
- MD5 1f9697fedb8c1a68599f9849fa23debc
- SHA1 1977b1f7f83db9292556c65885e86d3e062c376d
- SHA512 83ed4170d231dc93d0af2e1f2ea23c2a42853b75a57d91420337c53641dbfe07631a18151d8843f9dbabe8266c601aa49c3db7f263875ef751e03079d180a591
- SSDEEP 3072:r310Y4/VvbIw48cXTiOrE9kTDMlcGVCVpap4J2WB7:r31atM7NXmQTDHGVCja22WB7
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10 behavioral11 behavioral9
- Target
  libni_510.so
- Size 346KB
- SHA256 3937057b81437cf04b55775d9eecb9a849f8892be2300cc016b6b4534aec4984
- MD5 537bdcb0cecafa461561d309951eb62c
- SHA1 04e1578a5c4d58b39f4cbf5d0a08694046c55e45
- SHA512 d66a5aa90b7999722634e1115d6b56fd2de3d80719a2a1d281a9d92b8c72b4fd39bf9bd942e55240b6cc559c53a812e3b3d30a24034bb2d3d31258de02818794
- SSDEEP 6144:8c88RVMFJf/sEmsGKlsFBTFjWImy7woFK8vt923bZpxU8td1EX35E:z88RVkVXmvKli3+yBBvt923Vpm8d1EXe
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
behavioral12 behavioral13 behavioral14
- Target
  bigicon.png
- Size 357KB
- SHA256 f777eed11d352fa2903e9f5ccbdd14ff9de69373261357c2a1e66b81921ac989
- MD5 4aeb04e1ed6a22d8f24638b21aed5d24
- SHA1 790b73b0400d5009f4b4c35e71d1f4295181d51a
- SHA512 02010e13a553cbaa611875cb9b06c1388e8aeef69d9dc3a6de40db36d5a8d0b3e1e69c1212588f14c680debf1afa9beff6d29bb2547702a1095fc7afbbe8ccdc
- SSDEEP 6144:J9x7MA93J5/OEmqgWZsFBTGy7ImE7soFe8vt9E3bZpXUqtdTEb3NaU2:t7M+XdmpWZiUAENRvt9E3VpEKdTEb3Ah
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15 behavioral16 behavioral17
- Target
  libni_511.so
- Size 346KB
- SHA256 c976d4e659fba141c3f62066dfc86f2efc5867c5bea3fe4f5a66837464a2e2c9
- MD5 24a92786646bdbb29d4427d75a575b37
- SHA1 c3c2d6cb3a3d7be841874a8c1bb4c11d4b157ee0
- SHA512 57a7be47a4fd6a1725883735dd9f0c23dc450dc5a01df6d8039c21559c2d6dd23f11c11858ea2c671a7a15b4bb3d132e685536fd2298062bbb14a0932d82b7c0
- SSDEEP 6144:6upxV+Cy0KmzwcUCWgzmqLq/cBg7/nIWzzuVBdfjLkFtebCOWz/HWMSRjFCXm:C0KgYNqu/ci/IMuzdmgCLHtSRjQm
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
behavioral18
- Target
  bigicon.png
- Size 357KB
- SHA256 141f31ac9f06ea991fb82fd7d89943e3d5bb80a21db970d2abe9a20069cb3467
- MD5 5bda2e93aea9bb626c473df627d9a854
- SHA1 678cc2005089efcaf3f80755c4cf3897e8bef07e
- SHA512 edd765d4fbac3ab16b9d137163d449d6b10e6a37c9a89f04e082a23ff2ccc8310cce90312fc9abd9f08c2303efc8991ca96da1b26e64b396a34c90f642e6a393
- SSDEEP 6144:zi0VTV+uy0KmzOcUuOgzyqLqjcFg7DnIWKTdNjLuP3efoOWT/HWoSfZeXb:ze0KgOZqujcO7ILTH0qorHjSfEXb
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral19 behavioral20 behavioral21