f1c7b692c4d696e4883f9a82ff4926cc59c94c3f6ddda5fc6d1ec13045e86669

General

Target

66f8e21a5d2ef7b1f5c83f0ef34391f4_JaffaCakes118
Size

15.7MB
Sample

240522-mpl9lsca69
MD5

66f8e21a5d2ef7b1f5c83f0ef34391f4
SHA1

4686f1cbeef6d07223c103a2978896bac1408d34
SHA256

f1c7b692c4d696e4883f9a82ff4926cc59c94c3f6ddda5fc6d1ec13045e86669
SHA512

5a7644cf50e9536e391b4c41c6cbe4492b8b0c59bddcd54d0c2c5377f0438b648f93d56b83236109280cc83a7dcc5538b426656dee2ff4c97a573a77d4245001
SSDEEP

393216:x3kGTMbb1ANML98Ijq0+WLBkEBnxgBSVxNOQ7W72XC4C:x37Ub1ANMLKI1kE3gWxgQvE

Score

8^/10

Malware Config

Targets

- Target
  
  66f8e21a5d2ef7b1f5c83f0ef34391f4_JaffaCakes118
- Size
  
  15.7MB
- MD5
  
  66f8e21a5d2ef7b1f5c83f0ef34391f4
- SHA1
  
  4686f1cbeef6d07223c103a2978896bac1408d34
- SHA256
  
  f1c7b692c4d696e4883f9a82ff4926cc59c94c3f6ddda5fc6d1ec13045e86669
- SHA512
  
  5a7644cf50e9536e391b4c41c6cbe4492b8b0c59bddcd54d0c2c5377f0438b648f93d56b83236109280cc83a7dcc5538b426656dee2ff4c97a573a77d4245001
- SSDEEP
  
  393216:x3kGTMbb1ANML98Ijq0+WLBkEBnxgBSVxNOQ7W72XC4C:x37Ub1ANMLKI1kE3gWxgQvE
Score

8^/10

banker discovery evasion impact persistence
- Checks if the Android device is rooted.
  evasion
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Checks CPU information
  Checks CPU information which indicate if the system is an emulator.
  evasion discovery
- Checks memory information
  Checks memory information which indicate if the system is an emulator.
  evasion discovery
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Queries information about the current nearby Wi-Fi networks
  Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
  discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Registers a broadcast receiver at runtime (usually for listening for system events)
  persistence
- Checks if the internet connection is available
  discovery
- Queries the unique device ID (IMEI, MEID, IMSI)
  discovery
- Reads information about phone network operator.
  discovery
- Requests dangerous framework permissions
behavioral1 behavioral2
- Target
  
  alipay_msp.apk
- Size
  
  748KB
- MD5
  
  d06ea38e4210a87d6b96f8b0491df677
- SHA1
  
  3ba573396398757088e559a9d372049a377eb05a
- SHA256
  
  76a24f83ad15586ff9a2081e420a707be9ddb0b5047e5b6de5974c41624ff2c1
- SHA512
  
  3d43e5bfad2b703a804a53048b6a88228a11fb80ac641d6594f774cc07f6c7367e0ee80b29966d02c9206542f467f55b0f1ddbbfef0ec372256314a7d1071f30
- SSDEEP
  
  12288:IjRAsoln+WMB1EgrGERh4xWgtSM7vXrRCn4I5p2Cnfv:IjRApZ+WM7yER61P7jw4IGSfv
Score

1^/10
behavioral3 behavioral4
- Target
  
  epayx.jar
- Size
  
  175KB
- MD5
  
  e70d3c3ff87401690af6a24542304a6c
- SHA1
  
  4ed2a412969626fb6f7cba98338c29160f9b99c2
- SHA256
  
  6a752a41d365e98a27cdad043a69d688b320df708227deb182b276ef14e87351
- SHA512
  
  15b102a0397becccaf1780df053290e4569b4fe3c28cf722922df7dca3cb72b8ebf89ab33cea62354038eaf3d1dbad39f3696ced47ceeb0365b84a5716b57548
- SSDEEP
  
  3072:Zaau3uCBHk77yuepqPs7R35NON2UUuE2oFFN9aDDMVEnYdY+HUbfGer:Za7dHl0MR35NOUUqRFFN0v8EnYdYmU7B
Score

1^/10
behavioral5 behavioral6 behavioral7

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Targets

Checks if the Android device is rooted.

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Checks CPU information

Checks memory information

Loads dropped Dex/Jar

Queries information about running processes on the device

Queries information about the current Wi-Fi connection

Queries information about the current nearby Wi-Fi networks

Queries the phone number (MSISDN for GSM devices)

Registers a broadcast receiver at runtime (usually for listening for system events)

Checks if the internet connection is available

Queries the unique device ID (IMEI, MEID, IMSI)

Reads information about phone network operator.

Requests dangerous framework permissions

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7