850d1fb8e6a4bdfac25ad7201cd87387a6997cc92ddbfc5ebf926eb14a5dc2e9

Sharing

Copy URL

Twitter E-mail

General

Target

65aef2f5f4dc2f9ef5715998349b97c6_JaffaCakes118
Size

6.1MB
Sample

240522-cww3aahe7v
MD5

65aef2f5f4dc2f9ef5715998349b97c6
SHA1

1c1126263ebfba8aef885049aab2cf4343c1f567
SHA256

850d1fb8e6a4bdfac25ad7201cd87387a6997cc92ddbfc5ebf926eb14a5dc2e9
SHA512

b1c1a7cc1b1df73f105e85c28aaae22f4c935061f1429f096f1256d7da26a5a7b37d3433b4b3dbca3e00e97671b16d471f9350a93f9e0f17c348f1d2bf091bbe
SSDEEP

196608:kp7fPwVZnfHbH843vHd9pr5rGjN/yVVGCb7Q7uwteyoteyinP6j:QcdbH/Lpr5rGJ/yVvc+iPg

Score

8^/10

Malware Config

Targets

- Target
  
  65aef2f5f4dc2f9ef5715998349b97c6_JaffaCakes118
- Size
  
  6.1MB
- MD5
  
  65aef2f5f4dc2f9ef5715998349b97c6
- SHA1
  
  1c1126263ebfba8aef885049aab2cf4343c1f567
- SHA256
  
  850d1fb8e6a4bdfac25ad7201cd87387a6997cc92ddbfc5ebf926eb14a5dc2e9
- SHA512
  
  b1c1a7cc1b1df73f105e85c28aaae22f4c935061f1429f096f1256d7da26a5a7b37d3433b4b3dbca3e00e97671b16d471f9350a93f9e0f17c348f1d2bf091bbe
- SSDEEP
  
  196608:kp7fPwVZnfHbH843vHd9pr5rGjN/yVVGCb7Q7uwteyoteyinP6j:QcdbH/Lpr5rGJ/yVvc+iPg
Score

8^/10

banker discovery evasion impact persistence collection credential_access
- Checks if the Android device is rooted.
  evasion
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Checks CPU information
  Checks CPU information which indicate if the system is an emulator.
  evasion discovery
- Checks known Qemu files.
  Checks for known Qemu files that exist on Android virtual device images.
  evasion
- Checks known Qemu pipes.
  Checks for known pipes used by the Android emulator to communicate with the host.
  evasion
- Checks memory information
  Checks memory information which indicate if the system is an emulator.
  evasion discovery
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Queries the mobile country code (MCC)
  discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Registers a broadcast receiver at runtime (usually for listening for system events)
  persistence
- Checks if the internet connection is available
  discovery
- Reads information about phone network operator.
  discovery
behavioral1 behavioral2
- Target
  
  core.jar
- Size
  
  442KB
- MD5
  
  f84ba6f0daba937e6d435442c99e8387
- SHA1
  
  038c9ca9c9ed1c3321bf7fa641975be25fd2241c
- SHA256
  
  428827b1d99667c2608ac1c8708b9e3c87018134c1e640b1990cd73adbb77088
- SHA512
  
  9a8091c2cd339187341868c4f7ac473852c9cff788d53e6148f99e3093ff6129155cdf985be556dfee4d58b1eb9ca39093fe82bc04d3fab147534dd47781a50f
- SSDEEP
  
  12288:uL5KMOiBt1m0FobBKUnJaVS5aNOVWtKVFJj6yHFDqH/H:uVKMdFobBKUnJaVS5jWtqJekc/H
Score

1^/10
behavioral3 behavioral4 behavioral5
- Target
  
  res.bin
- Size
  
  205KB
- MD5
  
  dafb7d4b90ea8d376128c625183dd9ad
- SHA1
  
  883c9b0586e740e9fb976d27a437e84fc26e92fd
- SHA256
  
  07be7e035e50b372d700b7cc148515a26b0775b2b485e50895988753fe24b12b
- SHA512
  
  56deefb30f358f2d404c93725f331374f0878b8121d95412ab1b1299364b2eea2b7fe179e21bbe96f4076300556a09f55825118ff67b401504c2f3b82af6b13b
- SSDEEP
  
  3072:jFsFh83XDWxVFkPRLccq5sOwglfnhdQkWVsXQp6D9PhTbnEaxEiQWu6vSP:jFrzWlkKcqiglfnrXDRFnEaxxaP
Score

1^/10
behavioral6 behavioral7 behavioral8
- Target
  
  update.jar
- Size
  
  6KB
- MD5
  
  3eea0fcda4a513b99cedf31c7452aaf8
- SHA1
  
  071da147eacf17f1c10fc6362ac43839ee96d5a2
- SHA256
  
  2a9b79160a4eae5fea2e7fbd3e0498eae8af9d0e8d784b18ac81c3468da6e0a6
- SHA512
  
  12a20677a8f36778ceeead1e35a9a20dce8ecc9999803db2e3e40312b74847ccc9efbc649b4949dae38520287b7a01bd50c81dbf9fe1db8fb7e9ecd070801880
- SSDEEP
  
  96:G2sO+8hQev6LJugBsw4+KqRdK44JO6kwR7VXChi6nnf6ilCVhRsjgojXFrXyF972:lsONVQJ6p+ZRg7Td1offlqujv671U
Score

1^/10
behavioral10 behavioral11 behavioral9

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Targets

Checks if the Android device is rooted.

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Checks CPU information

Checks known Qemu files.

Checks known Qemu pipes.

Checks memory information

Loads dropped Dex/Jar

Obtains sensitive information copied to the device clipboard

Queries information about the current Wi-Fi connection

Queries the mobile country code (MCC)

Queries the phone number (MSISDN for GSM devices)

Registers a broadcast receiver at runtime (usually for listening for system events)

Checks if the internet connection is available

Reads information about phone network operator.

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11