9544d149ed965ae3351f7be1032f295e40527c57921e23b3a0f12035169a015c

Sharing

Copy URL Twitter E-mail

General

Target
6600ada3fd0cf5c0f7b65d04889125cf_JaffaCakes118
Size 22.0MB
Sample240522-e43k5sca89
SHA256 9544d149ed965ae3351f7be1032f295e40527c57921e23b3a0f12035169a015c
MD5 6600ada3fd0cf5c0f7b65d04889125cf
SHA1 bce79781826ab2adf36585b223bc71b9f00f860a
SHA512 e958331aedd00bffa856c29d666cf129ad48b0530466829e30f6535cc8b92fa40b09c9fd21d2325f749f97dee77ba4bfd3ff70e7f7bda3f415d735978c7a1920
SSDEEP 393216:28GD5y2fZQPWp5HVK/exoOcBJoLzYATTV10sBINN28OdGGfZFf3KUx:2Xdy6mPk51KWG24OVdBILejKUx
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Targets

- Target
  6600ada3fd0cf5c0f7b65d04889125cf_JaffaCakes118
- Size 22.0MB
- SHA256 9544d149ed965ae3351f7be1032f295e40527c57921e23b3a0f12035169a015c
- MD5 6600ada3fd0cf5c0f7b65d04889125cf
- SHA1 bce79781826ab2adf36585b223bc71b9f00f860a
- SHA512 e958331aedd00bffa856c29d666cf129ad48b0530466829e30f6535cc8b92fa40b09c9fd21d2325f749f97dee77ba4bfd3ff70e7f7bda3f415d735978c7a1920
- SSDEEP 393216:28GD5y2fZQPWp5HVK/exoOcBJoLzYATTV10sBINN28OdGGfZFf3KUx:2Xdy6mPk51KWG24OVdBILejKUx
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

collection discovery evasion persistence
- Requests cell location
  Uses Android APIs to to get current cell location.
  collection discovery evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries information about the current nearby Wi-Fi networks
  Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
  discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Registers a broadcast receiver at runtime (usually for listening for system events)
  persistence
- Checks if the internet connection is available
  discovery
- Reads information about phone network operator.
  discovery
behavioral1
- Target
  bdxadsdk.jar
- Size 85KB
- SHA256 516023ce55fff40074d3c3d9016c023b1fc7dfba2b59c172f89141f1484d418e
- MD5 3c850ffec5bdd850f123077ca210a411
- SHA1 1c1ae4678b8a3b65640f047cb1bd72bc70d66f97
- SHA512 aa3611687b6140ee9214392a84bc1ef55a6425a84a4e413dfcb2e936a931b9015e1e4ec53ad73539d26622427f9e6da0eae5c58ffc18285de42fc15639d786dd
- SSDEEP 1536:E4A1vm52J1h/mgxeek9/Ckkf1THL8BNbM/DXO8Q/3yJ463v6hHA0UGcVrSj:e9mkJ1tmg/I/tkdP8sa80O42uXcVrE
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral2 behavioral3 behavioral4
- Target
  gdtadv2.jar
- Size 96KB
- SHA256 5011bc2225fd4c8d35be1d2c38794853ed91a508addc7c237635358264e3b4b9
- MD5 24babfe2a37fa22fcea5436dc286c682
- SHA1 3c19663d190b1cc1743f8210ee7d99a7955fa614
- SHA512 b8710a16e6a06adf379e7895077d41d97826d3b3944ca0485df10cf0f97dd9c1c0fedbf892def5a13f137e9a6a3eec716ee45a0215b0a0a0ff55fd879de8e443
- SSDEEP 3072:E95Rwj2nLL2sKa5h/D1XRsVdzi3kYORyr:w5SqnH5hBWdEORyr
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6 behavioral7
- Target
  muzhiwanapp.apk
- Size 6.7MB
- SHA256 efa8e431c5d5b3bda3cfc0da4392d14ef447643412bbea22536a155c7aae82b4
- MD5 f166fff17a539f053550965c87c42054
- SHA1 8be071793576b6e324db218f02a017439fe826a3
- SHA512 26869689b5a58e52e63d95b07cf04f560c4580e9bd408a432a61acace492201ffe93cb7e4166a360530eff8fa3827ae0df83ee43e30daa7f670010d59a8bab8a
- SSDEEP 98304:thCSkJBDmTuhW+7eF0JUQ4KMB6NQP4WfxRENHpxPOJHMMC1dh4Zadvtvc8Y6dtR3:nru6wUQMBj4WfOHp+HPC1z4mkKdYIx
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

discovery evasion persistence
- Checks if the Android device is rooted.
  evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Registers a broadcast receiver at runtime (usually for listening for system events)
  persistence
- Checks if the internet connection is available
  discovery
- Queries the unique device ID (IMEI, MEID, IMSI)
  discovery
- Reads information about phone network operator.
  discovery
behavioral8 behavioral9
- Target
  mzw_d
- Size 59KB
- SHA256 2514431fe50d909ac1385e07341ed8878b5f2400df151df5a43a59b98a31ea02
- MD5 b2a8fd2dba92c8f75869f79c70d441da
- SHA1 faaf88b3c3653fc205a3a125ccb77fbc87b76215
- SHA512 a66893a5bb935dfefdc12ea32c2407cf9d8d040ff82852b415c599beb94d002ce77ec15bbac3f78ae6758a8c7f5e83c799ad84fb8ce2e6763da88a9bb20aa7b6
- SSDEEP 1536:zsgtqpcH/obgLKxe7wust6XTyLaFcBowg/pL2Nka2MXX3C:zsqqKH/BKxXMXTym/pyKiXnC
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10
- Target
  mzw_g
- Size 42KB
- SHA256 7a28fd857e1283e351d37931cc6e23cd6de5ad2fd4d3d23337a6f162b07f3978
- MD5 c04d422c5a4bf58a127bbf2bf014965c
- SHA1 3b1f3f4ad21fe0febe567e5a56996a7e61658cf9
- SHA512 6cb2768a8344e3da470472ea906b5be2e33a24384efe35cdc3c0b0c24351c3b34444a4d2d6a9e21c48927b85554aaa3904fb0361071c0711841565222253e0a8
- SSDEEP 768:ccPeR+EU5maX9WkB/gUrXFWLKxe7X+Fu9hRv6Xf3QpD+X7aFkuzkjEC:ccPeRiNWkZbgLKxe7wuzt6XCyLaFm3
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral11 behavioral12 behavioral13
- Target
  stasdk_core
- Size 2.1MB
- SHA256 8dc8a08cb4af889317d11fec26e2c1058f2af5056a4dbc25deaec8707073947f
- MD5 e1dd5bacfa75b9cf6abf6eaa1635e3c7
- SHA1 96a86954d989f634798c91523712c34eab06da3d
- SHA512 e62c106f91d7a7202411a6938ed721fa695257f205e93772a87c59804a899a1bafd4887d48f2c9f33e5fe3ab6965227beb3fee007515ceb926e83d0e990fcc37
- SSDEEP 49152:V1anRWSRRAeAOHy5mWr7cZVsjFrcZzVCuSlH7WKYnRgIpLLw:naRW0AqyJ0vsjFGzoNK7nRgIpLw
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

collection discovery evasion persistence
- Requests cell location
  Uses Android APIs to to get current cell location.
  collection discovery evasion
- Requests cell location
  Uses Android APIs to to get current cell information.
  collection discovery
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Queries information about the current nearby Wi-Fi networks
  Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
  discovery
- Registers a broadcast receiver at runtime (usually for listening for system events)
  persistence
- Checks if the internet connection is available
  discovery
- Queries the unique device ID (IMEI, MEID, IMSI)
  discovery
- Reads information about phone network operator.
  discovery
behavioral14 behavioral15
- Target
  bdxadsdk.jar
- Size 85KB
- SHA256 516023ce55fff40074d3c3d9016c023b1fc7dfba2b59c172f89141f1484d418e
- MD5 3c850ffec5bdd850f123077ca210a411
- SHA1 1c1ae4678b8a3b65640f047cb1bd72bc70d66f97
- SHA512 aa3611687b6140ee9214392a84bc1ef55a6425a84a4e413dfcb2e936a931b9015e1e4ec53ad73539d26622427f9e6da0eae5c58ffc18285de42fc15639d786dd
- SSDEEP 1536:E4A1vm52J1h/mgxeek9/Ckkf1THL8BNbM/DXO8Q/3yJ463v6hHA0UGcVrSj:e9mkJ1tmg/I/tkdP8sa80O42uXcVrE
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral16 behavioral17 behavioral18
- Target
  gdtadv2.jar
- Size 142KB
- SHA256 8f109682334d43d811c7d56620c5eb30c9bc1a89f3f36b91232aeb142a6f6ba7
- MD5 f0b930680aa93a62bb77d1916e64a3d7
- SHA1 fc30b5641b8d32e4efeaf409d07a4d520a95a6da
- SHA512 2a503f3aefd5ed8634dbc85cd952d10625e4bc18badc0661c7cfcc3345cfb43ba1e153d9fb264703e4cf0d6c40ac601942e841b9537125072f884c283adb5b99
- SSDEEP 3072:mZmii8gAi97ZHbwRILfiNJkAzzBdtCQnm:m8B99TZA/3m
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral19 behavioral20 behavioral21

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Execution Guardrails

T1627

Geofencing

T1627.001

Credential Access

Discovery

Location Tracking

T1430

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Requests cell location

Loads dropped Dex/Jar

Queries information about the current nearby Wi-Fi networks

Queries the phone number (MSISDN for GSM devices)

Registers a broadcast receiver at runtime (usually for listening for system events)

Checks if the internet connection is available

Reads information about phone network operator.

Checks if the Android device is rooted.

Loads dropped Dex/Jar

Queries information about running processes on the device

Queries information about the current Wi-Fi connection

Registers a broadcast receiver at runtime (usually for listening for system events)

Checks if the internet connection is available

Queries the unique device ID (IMEI, MEID, IMSI)

Reads information about phone network operator.

Requests cell location

Requests cell location

Loads dropped Dex/Jar

Queries information about running processes on the device

Queries information about the current Wi-Fi connection

Queries information about the current nearby Wi-Fi networks

Registers a broadcast receiver at runtime (usually for listening for system events)

Checks if the internet connection is available

Queries the unique device ID (IMEI, MEID, IMSI)

Reads information about phone network operator.

MITRE ATT&CK Mobile v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21