36050438869a840764b4dde7481bdd75899763ee2e5aef89b29bcabf115e2fe0

General

Target

63d1c4eed6af4f5df798744775aea2ab_JaffaCakes118
Size

636KB
Sample

240521-s3x6xsag4z
MD5

63d1c4eed6af4f5df798744775aea2ab
SHA1

668acc398af2a9e7de36d82ba2574ee70c008897
SHA256

36050438869a840764b4dde7481bdd75899763ee2e5aef89b29bcabf115e2fe0
SHA512

84358f4752c19034d043eb854b20af46a94bf39130dfe7c656b9b824f512e94057b48104440970110978d21a76ac4991896ea4d547b9571e5446e53e5001a76d
SSDEEP

12288:Q4LUaxJLbt0E46VYj1b4Zoi/m627grLMxpzseFxIMtU94vvQe6ERylTUu:O6LZ0E46iKZoie62bCMiiydX

Score

8^/10

Malware Config

Targets

- Target
  
  63d1c4eed6af4f5df798744775aea2ab_JaffaCakes118
- Size
  
  636KB
- MD5
  
  63d1c4eed6af4f5df798744775aea2ab
- SHA1
  
  668acc398af2a9e7de36d82ba2574ee70c008897
- SHA256
  
  36050438869a840764b4dde7481bdd75899763ee2e5aef89b29bcabf115e2fe0
- SHA512
  
  84358f4752c19034d043eb854b20af46a94bf39130dfe7c656b9b824f512e94057b48104440970110978d21a76ac4991896ea4d547b9571e5446e53e5001a76d
- SSDEEP
  
  12288:Q4LUaxJLbt0E46VYj1b4Zoi/m627grLMxpzseFxIMtU94vvQe6ERylTUu:O6LZ0E46iKZoie62bCMiiydX
Score

8^/10

banker collection discovery evasion persistence stealth trojan
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Removes its main activity from the application launcher
  stealth trojan evasion
- Checks CPU information
  Checks CPU information which indicate if the system is an emulator.
  evasion discovery
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries account information for other applications stored on the device
  Application may abuse the framework's APIs to collect account information stored on the device.
  collection
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Registers a broadcast receiver at runtime (usually for listening for system events)
  persistence
- Checks if the internet connection is available
  discovery
- Queries the unique device ID (IMEI, MEID, IMSI)
  discovery
- Reads information about phone network operator.
  discovery
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Targets

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Removes its main activity from the application launcher

Checks CPU information

Loads dropped Dex/Jar

Queries account information for other applications stored on the device

Queries information about running processes on the device

Queries information about the current Wi-Fi connection

Registers a broadcast receiver at runtime (usually for listening for system events)

Checks if the internet connection is available

Queries the unique device ID (IMEI, MEID, IMSI)

Reads information about phone network operator.

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

behavioral3