Extracted

• • Target

    5b6a11cf41c0c80a7caa536a859a5267_JaffaCakes118

  • Size

    237KB

  • MD5

    5b6a11cf41c0c80a7caa536a859a5267

  • SHA1

    deafe3f891dd95237792f3e331cec864dcac59e1

  • SHA256

    3d8b543ef76189bcb0e7cef2116360fe76c1ff57d1e3596097a9404130729513

  • SHA512

    61448019456d9c9ac0439518a822d0009370f18c699d15687dbab17aa86df684fd676b63903bdc2b68997e5d76eb5a688391dbf735a208be1650320ce06717a5

  • SSDEEP

    6144:f00SCOy5J8gm5fnB+fcejsufx2E4dsj0qZXr5zXYPDy:flVePBKceBFIqZaPu

  Score

  8^/10

  collectioncredential_accessdiscoveryevasionpersistencestealthtrojan

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence

  • Queries the mobile country code (MCC)

    discovery

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Requests enabling of the accessibility settings.

  • Acquires the wake lock

  • Checks if the internet connection is available

    discovery

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    evasion

  • Listens for changes in the sensor environment (might be used to detect emulation)

    evasion
  behavioral1behavioral2behavioral3