General

  • Target

    676de1ccdd5f6903223a8fdef576a160_JaffaCakes118

  • Size

    1.6MB

  • Sample

    240522-qtg28sdc7s

  • MD5

    676de1ccdd5f6903223a8fdef576a160

  • SHA1

    a15e58ea0fb6a13e68f107b74b56766deef4e4e0

  • SHA256

    c3bf4bea9d57ac1d1a1ac6132967f3b4ced8930ca84753a50c982f6aa5d819ed

  • SHA512

    da5d4ebe0f6ab42c1e8f9b8008599ea53454608908deae9ba8a7537347c071a8272bc6d9575fbfda2a0d1a0d721ff1627817d621ea52a3762830617c03eff0af

  • SSDEEP

    24576:ERx2F5mWlHY02U7mokJlhv79uSXvBQKHJfiIzkPySm02xA5ZpGWSG9vGtt48M:EH2F75Y02Dlhv79uSfympgqSm02We1G

Malware Config

Targets

    • Target

      676de1ccdd5f6903223a8fdef576a160_JaffaCakes118

    • Size

      1.6MB

    • MD5

      676de1ccdd5f6903223a8fdef576a160

    • SHA1

      a15e58ea0fb6a13e68f107b74b56766deef4e4e0

    • SHA256

      c3bf4bea9d57ac1d1a1ac6132967f3b4ced8930ca84753a50c982f6aa5d819ed

    • SHA512

      da5d4ebe0f6ab42c1e8f9b8008599ea53454608908deae9ba8a7537347c071a8272bc6d9575fbfda2a0d1a0d721ff1627817d621ea52a3762830617c03eff0af

    • SSDEEP

      24576:ERx2F5mWlHY02U7mokJlhv79uSXvBQKHJfiIzkPySm02xA5ZpGWSG9vGtt48M:EH2F75Y02Dlhv79uSfympgqSm02We1G

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Removes its main activity from the application launcher

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Queries the mobile country code (MCC)

    • Queries the phone number (MSISDN for GSM devices)

    • Requests enabling of the accessibility settings.

    • Acquires the wake lock

    • Checks if the internet connection is available

    • Reads information about phone network operator.

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

    • Listens for changes in the sensor environment (might be used to detect emulation)

MITRE ATT&CK Matrix

Tasks