f73ee685d159cb5432ad675ff58565506d09ec90d0042e38676351e75249d612

Sharing

Copy URL Twitter E-mail

General

Target
55cd50682d35e8df0f5ff44662077c34_JaffaCakes118
Size 25.1MB
Sample240518-vfpblsdd7v
SHA256 f73ee685d159cb5432ad675ff58565506d09ec90d0042e38676351e75249d612
MD5 55cd50682d35e8df0f5ff44662077c34
SHA1 8c7de8eabcd1e04acdacaffdca6623478dacdeb5
SHA512 0e732f0bebbe930c41a3f4cb4e6423c9cd62892b59bd6bbe67517f91ae7f2904a357f63ca8079cb4c5021271e8c66f9699a629580b1a98dc243f8bd0b5c989f8
SSDEEP 786432:Y378vS1fQlMSV/B63vkgDmFLwvyHYJ+41fOS:Y3Amq0vDihL41fT
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Targets

- Target
  55cd50682d35e8df0f5ff44662077c34_JaffaCakes118
- Size 25.1MB
- SHA256 f73ee685d159cb5432ad675ff58565506d09ec90d0042e38676351e75249d612
- MD5 55cd50682d35e8df0f5ff44662077c34
- SHA1 8c7de8eabcd1e04acdacaffdca6623478dacdeb5
- SHA512 0e732f0bebbe930c41a3f4cb4e6423c9cd62892b59bd6bbe67517f91ae7f2904a357f63ca8079cb4c5021271e8c66f9699a629580b1a98dc243f8bd0b5c989f8
- SSDEEP 786432:Y378vS1fQlMSV/B63vkgDmFLwvyHYJ+41fOS:Y3Amq0vDihL41fT
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

banker collection discovery evasion impact persistence
- Checks if the Android device is rooted.
  evasion
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Checks Android system properties for emulator presence.
  evasion
- Checks CPU information
  Checks CPU information which indicate if the system is an emulator.
  evasion discovery
- Checks memory information
  Checks memory information which indicate if the system is an emulator.
  evasion discovery
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries account information for other applications stored on the device
  Application may abuse the framework's APIs to collect account information stored on the device.
  collection
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Reads the content of photos stored on the user's device.
  collection
- Reads the content of the browser bookmarks.
  collection
- Registers a broadcast receiver at runtime (usually for listening for system events)
  persistence
- Checks if the internet connection is available
  discovery
- Reads information about phone network operator.
  discovery
- Listens for changes in the sensor environment (might be used to detect emulation)
  evasion
behavioral1
- Target
  plugin_boostplus.so
- Size 225KB
- SHA256 275e4f6ce9a5b7205050f882790080312f9c00aea8650faa743022ca5d7e2641
- MD5 b32c139f4a3691d1935c4866169578ee
- SHA1 cc4d91d81fe7abb8c59bef9a4d8a1e8c12b47949
- SHA512 2a55e16835e3ede43d4b8b7ec9dac72133b5d3ddd9f580fbc13069403a2e2b2de00c731d92e5c53d5a87c111265659e6b742f421f0652c5c6408a29873df7848
- SSDEEP 6144:8D/XlJp4nqFvhxota5rVmrLy6ZphT8MPZcF:CXlJX1Sa5rVmrm0hwEY
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral2 behavioral3 behavioral4
- Target
  plugin_core.so
- Size 3.6MB
- SHA256 f4753e75b85f1dacdc161a7bd8ea6c2a2ba9d8a3b325d17f90ac174571b825e7
- MD5 c6a2b896567998dcb18dbaaa71e67890
- SHA1 dd406912c1265d240eecbcf509d56e5baf94f10c
- SHA512 6945803edb10d37dcb9700a36369ee9e3abae10f2b3485d17a7f8f815eff617c440bb12204e88d4b5ce14543ccc5c81755df3f91322aab81f1737f63aa76efe3
- SSDEEP 98304:JTygX7UNUdm7iecYmMrGd1tiJLbL/BIkwKtDoNk:J2YYNmw5gMiKDikwXNk
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6 behavioral7
- Target
  plugin_internal.so
- Size 4.1MB
- SHA256 661ea3921b581587f647acb7069fbcf6af5e43cabbcb64e9ead9b99e7d347dcf
- MD5 9a668db2f6b2de717ee3ac42e2207a78
- SHA1 53cf58bd6bad6a3fdd0e6bc4593b29958c02c19c
- SHA512 5545d692612e194c30fb5e39bab801732ff2360dcaa360719fbc9d984696d403b45fe47e251727288b9b227146f9127188c0728f1a45cf35406007aac6566619
- SSDEEP 98304:3sJBKAyYEaRm8FxX285n6l/8FNWvvV+iZ8vVERsqfTVlS:S8AyYECFg8s/8FNWv4N/qfJlS
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral8
- Target
  appupgrade.dex
- Size 52KB
- SHA256 f40dc535425da9412d940580b116801c29c8a30fdbb4df47b41cbd65341171e5
- MD5 da99e2c9c800fa3925acbe7cb422656d
- SHA1 b1c91986ba34ccf9bbf12378d07b597c3e0ba62e
- SHA512 9f95ca6ac05a44c04933bd273b6bdb361e3d9c78c5ea50b8c8ec3ea5d782614173dc90d2f7ff9eaae9d62d1047989f72a51c8451af95faab79c4833e48c293f0
- SSDEEP 1536:lxDbBynskDIL1O9Pv1hQlY8QzugCigezREQ:lxDtW1DOAj8QKuzqQ
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10 behavioral11 behavioral9
- Target
  dbcompt.dex
- Size 47KB
- SHA256 c81cdb3959570b54f45766fd4201b52cb6b0b705a46fc38b4cff8e86098fbe13
- MD5 31378d78d07fff186d72b2072f4aa602
- SHA1 97b8e116276248a7748a335c3393fa1c6f384a61
- SHA512 dbf060d5adf1c18fe141dba53ac3f9977ef96833e37e93df630e428f1522f138a311e829bde559e94e592ee0fce03a6f9934d5cb20fda7e4c78568dec6ae002b
- SSDEEP 768:H6Fk7lryyYrGUsM65ddlh+uZB5XZIqc959chqpzTfe2S/lySRAZg3hh67tN:H665zYZsfddlh7B5pTAeDM2T6ZN
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral12 behavioral13 behavioral14
- Target
  plugin.apk
- Size 573KB
- SHA256 5a005454b7115739ff9135d175fc89b279b741984608c2cb06bea3787d35ef52
- MD5 49e6187aeebc02970e622f22bb49557b
- SHA1 3454e00dd1313e057903cf50f3c770d9f00d287c
- SHA512 f4d42afc64b97bf0acf896ab3348fe2505cab35336810941cf8ca0f7c3e1f682475347b871092e0a59aa7cd8050f543987176ed8ba072ec867bae7ed7de9b4dc
- SSDEEP 12288:/UE5IDFMBKAOovKFagZTgsctiOcUXvfQqMlMjEiWQxPjcyuUP8HNyfZMTsGuBHl:/xgFMBKAWxdgsEvcWjEiWQxbpusp
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15 behavioral16 behavioral17
- Target
  plugin_junkplus.so
- Size 1.9MB
- SHA256 ae53c154e845234b5cc7e152a3aaa56cfa4596cf62dbe245421078db727d6f0e
- MD5 b3acf0e65ecdfbc51d0b0ffd6edb6774
- SHA1 6e1ee2dcdf15d1181f46663ae4de25a32ae930e9
- SHA512 1943fba3c0ae5d71a22ee16354a6206f651c4fa65bcb20cb607a474da489cab4fbcabd335a0bceb01f92f48f409d8947e53d312dd9d86563fa066a96e39c62f0
- SSDEEP 24576:myp5V3Jf5/Xj9BNmhYgTgh1X0BMxBvqt0qPds4ZaYB0/+TKCbgQA9xe5po+71quA:DrXgYZfX0OxBytJdJaYBE+DgX9xuolWI
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral18 behavioral19 behavioral20
- Target
  wechatfile.apk
- Size 9KB
- SHA256 567548b0339f1099b17a60284dff4be0fbf51d642ad978f3f004927b951415a3
- MD5 ef8b23837783b39547356a14328a9f3e
- SHA1 f1ce8483e87c4dc692ae9ef07ccf9f8d7729ef5f
- SHA512 403747fb081a52b508c2fe161803d32c0d537ad83faf47eacb9a64ce78f09f38251299113f622d92e847e4b1955cc0c95f37b235a150ec3de831007b053a38a9
- SSDEEP 192:5cz4I6Kbk0gdaRmMfpMpIcBaK3PuuoMv2fVQQfGbXQ:+0I6KbUUCIpojHGQQ+A
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

discovery
- Checks if the internet connection is available
  discovery
- Queries the unique device ID (IMEI, MEID, IMSI)
  discovery
behavioral21 behavioral22 behavioral23
- Target
  plugin_news.so
- Size 1.3MB
- SHA256 d4508235a23f897ffebd05c660fe3e21cbcc5610b64e31792178893d9690c0af
- MD5 43fc21cddb3897433c34620b9d02a7db
- SHA1 9111e52ed73008d2e5f99e54e8c93e3cb3ab62fa
- SHA512 9478246321bf5c0a3c890883d68a1146ae37626d9a31effbba7e850ccbd394093d43913ea75b850596de2990447467db853f59fc2abb31ff6169b2f604b419ab
- SSDEEP 24576:P2plyVSCbjwTZ3kSDJe9cP8HJAVFcaSad3Pf:6lWSkjW3kSDJe97HJAXjSad3Pf
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral24
- Target
  plugin_sgame.so
- Size 1.2MB
- SHA256 9572ed53721c095272dd0547606aae4c2d76fdbb1edc68f98a26ba08fe5cfffb
- MD5 3483a9b7127c4ccf3df617afeab1030b
- SHA1 ff82fa59b7fe5a48efe22bf76c254f0ba615343e
- SHA512 97154d27c82249a0c3ae5d53c06b6d105bd5d131b507b5be94f26e83f6972e6bc6fa84d1699218af3ca8f8cce2b570e571404f7eca475d1ea6bff2fd1d868424
- SSDEEP 24576:4/aQnV2qPFAuAKjv6zsF3Z9wKZzj/X9xwKJ2kHKOqw/6a1p:4/aQV2Gv64F3ZOKZzjf9xwZk5qw/6a1p
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral25 behavioral26 behavioral27
- Target
  plugin_uniform.so
- Size 5.5MB
- SHA256 9633a35f9b91ff8bc47d9d6ea1ccdc1c52c3571ee40e95dc47e880faefe05ce8
- MD5 8a1a8a6a1b048ec082056971ab6f0fc5
- SHA1 f174bbdf423dce8676706706c38c3c155f5242e4
- SHA512 157535c9b06046c928c85b82a35ef7bc5c509135a7b1015da51ff001376524d1829347906bfc247953310652cdc1ab8d9f5e0017dd3de26f3e6bd1e0e91b3d02
- SSDEEP 98304:ztwu8ZLLbxHiE+EZ9g6ZLdxjuAkFYRvyIlnk4NjkNf/lREIJXnIfCtuBLFSENNBg:ZwtZLLdHiELo6ZLpkEqYk4NjkNf/bjYM
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral28 behavioral29 behavioral30
- Target
  gdtadv2.jar
- Size 128KB
- SHA256 ad4f7fc479ed8bc4f61f1c3681588a9a43e2aaa622dcf7b4b678b30f43701717
- MD5 c3028f8cac5006341d55111eefd11430
- SHA1 bae6757f8bdce156f26f2fdd7549346e906088ca
- SHA512 a8423fa452c19f15b40f12f5861687c2aa1505215ed3ebd82d5aa420059536e41ee019f5e68858a925fa2a98d2e0162c23fffa103d5ffa1f7bc4945b17f8a2f7
- SSDEEP 3072:ioIDL6sFqGfX2Nj1btE365tHbVGyL7f8r5YhLHwBfT5fUonAzrDGDdF:kCI2NjS6rHIyL7MVJUoaDY
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Data from Local System

T1533

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Tasks

Sharing

General

Malware Config

Targets

Checks if the Android device is rooted.

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Checks Android system properties for emulator presence.

Checks CPU information

Checks memory information

Loads dropped Dex/Jar

Queries account information for other applications stored on the device

Queries information about running processes on the device

Queries information about the current Wi-Fi connection

Reads the content of photos stored on the user's device.

Reads the content of the browser bookmarks.

Registers a broadcast receiver at runtime (usually for listening for system events)

Checks if the internet connection is available

Reads information about phone network operator.

Listens for changes in the sensor environment (might be used to detect emulation)

Checks if the internet connection is available

Queries the unique device ID (IMEI, MEID, IMSI)

MITRE ATT&CK Mobile v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32