43c9703326164f014bb317e79cd79585245259e18e6d4af32b7735b6da5dd2d6

General

Target

6478d00b69e5c2561bd38d29f2813fa2_JaffaCakes118
Size

1.3MB
Sample

240521-x3vs1sfh4z
MD5

6478d00b69e5c2561bd38d29f2813fa2
SHA1

c9ae761853f981f359a466217cbee390f23fd97b
SHA256

43c9703326164f014bb317e79cd79585245259e18e6d4af32b7735b6da5dd2d6
SHA512

b0dca0d2c2008b1211197e6debf026c21f296e3834c28b6c1d9e35ab0d774f5b57e5ad54170071a845fd2b02d4abf520cbb90c66753f0fdf192c1353f8f4d105
SSDEEP

24576:loL0otaYtXMLeE2sepAvb6vsm0ZGpUvb+jno+G8jy9Wq/13tdHbZKm51Ob83B:2Q7YtcFeGv0sKUvb+jbPjy9Wq/1XHNKw

Score

8^/10

Malware Config

Targets

- Target
  
  6478d00b69e5c2561bd38d29f2813fa2_JaffaCakes118
- Size
  
  1.3MB
- MD5
  
  6478d00b69e5c2561bd38d29f2813fa2
- SHA1
  
  c9ae761853f981f359a466217cbee390f23fd97b
- SHA256
  
  43c9703326164f014bb317e79cd79585245259e18e6d4af32b7735b6da5dd2d6
- SHA512
  
  b0dca0d2c2008b1211197e6debf026c21f296e3834c28b6c1d9e35ab0d774f5b57e5ad54170071a845fd2b02d4abf520cbb90c66753f0fdf192c1353f8f4d105
- SSDEEP
  
  24576:loL0otaYtXMLeE2sepAvb6vsm0ZGpUvb+jno+G8jy9Wq/13tdHbZKm51Ob83B:2Q7YtcFeGv0sKUvb+jbPjy9Wq/1XHNKw
Score

8^/10

banker collection discovery evasion persistence stealth trojan
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Removes its main activity from the application launcher
  stealth trojan evasion
- Checks CPU information
  Checks CPU information which indicate if the system is an emulator.
  evasion discovery
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries account information for other applications stored on the device
  Application may abuse the framework's APIs to collect account information stored on the device.
  collection
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Registers a broadcast receiver at runtime (usually for listening for system events)
  persistence
- Checks if the internet connection is available
  discovery
- Queries the unique device ID (IMEI, MEID, IMSI)
  discovery
- Reads information about phone network operator.
  discovery
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Targets

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Removes its main activity from the application launcher

Checks CPU information

Loads dropped Dex/Jar

Queries account information for other applications stored on the device

Queries information about running processes on the device

Queries information about the current Wi-Fi connection

Registers a broadcast receiver at runtime (usually for listening for system events)

Checks if the internet connection is available

Queries the unique device ID (IMEI, MEID, IMSI)

Reads information about phone network operator.

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

behavioral3