General

  • Target

    67b172e6012f096d10b3da344dfade56_JaffaCakes118

  • Size

    16.8MB

  • Sample

    240522-smsaqsfe97

  • MD5

    67b172e6012f096d10b3da344dfade56

  • SHA1

    4e687059cd30da75d655bafbf170051905fa6c77

  • SHA256

    80a1a9da3fdee9a38fc55b58b19bbf769bd808499742744cb94992ad95139b56

  • SHA512

    13902afd5153daf6306db2f1c96dba1c26fbf99658d236528e748755648926b9d83a882a4b7ad74c3af4fa2191aa3795434b22e706f9ccedcb8f4a4bf3bbe077

  • SSDEEP

    393216:BfeClFPcMiYTfb1KSof0R+9nAlm4ZEahkNCNw:BmClFP/iYTD1KZ0RmAfZEN9

Malware Config

Targets

    • Target

      67b172e6012f096d10b3da344dfade56_JaffaCakes118

    • Size

      16.8MB

    • MD5

      67b172e6012f096d10b3da344dfade56

    • SHA1

      4e687059cd30da75d655bafbf170051905fa6c77

    • SHA256

      80a1a9da3fdee9a38fc55b58b19bbf769bd808499742744cb94992ad95139b56

    • SHA512

      13902afd5153daf6306db2f1c96dba1c26fbf99658d236528e748755648926b9d83a882a4b7ad74c3af4fa2191aa3795434b22e706f9ccedcb8f4a4bf3bbe077

    • SSDEEP

      393216:BfeClFPcMiYTfb1KSof0R+9nAlm4ZEahkNCNw:BmClFP/iYTD1KZ0RmAfZEN9

    • Checks if the Android device is rooted.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Requests cell location

      Uses Android APIs to to get current cell location.

    • Checks Android system properties for emulator presence.

    • Checks CPU information

      Checks CPU information which indicate if the system is an emulator.

    • Checks memory information

      Checks memory information which indicate if the system is an emulator.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Queries information about running processes on the device

      Application may abuse the framework's APIs to collect information about running processes on the device.

    • Queries information about the current Wi-Fi connection

      Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    • Queries information about the current nearby Wi-Fi networks

      Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

    • Registers a broadcast receiver at runtime (usually for listening for system events)

    • Checks if the internet connection is available

    • Queries the unique device ID (IMEI, MEID, IMSI)

    • Reads information about phone network operator.

    • Listens for changes in the sensor environment (might be used to detect emulation)

    • Target

      QMJFQ.jar

    • Size

      263KB

    • MD5

      b04477425062e57e3f38286aef7c8a1d

    • SHA1

      4d0e6f5a6039fbdfcc2a0c8029674bb88c3d42ef

    • SHA256

      5871995147ba983e77aff1e6ca21b1134babb715d129d24b11838fa41de693e7

    • SHA512

      d7a69e75e5f1cd4ff3125bd18e504da9ef665da0b4db378acba670da5d4dfcf16d755d949abf865a33c47cbea49f0c4e1f1750f5ad9f1de8f696def4f4605cca

    • SSDEEP

      6144:LGoPOWAwTr734e4KG7SNlysZ1JBba3yq1TgD:3POWnTrTL7XZvBbQyqk

    Score
    1/10
    • Target

      gdtadv2.jar

    • Size

      241KB

    • MD5

      b95166c2f63e536b6fc4b5b811444dec

    • SHA1

      45fc74323bb2e66f4c2a493b65b70e0de2aeb77c

    • SHA256

      2f92b98f55c7d4417dff3fc2af9245c66aad3ab8be65177954ed7a4f13bae20d

    • SHA512

      65eb813d39270d83e6d43956ec139f04779dbea58e517da1727a0f4fad9de32bb4cd49bed1dc1fec31b95a95b1c653c22b327aa38cba1645330c9d256d94c087

    • SSDEEP

      6144:KRKhU/uUwjTCpnUjgWkiCBliWLvghUhSj4qj80Gq7JqBGK:KoUmUgenUjwBl1jgVjJ57IBl

    Score
    1/10

MITRE ATT&CK Matrix

Tasks