adb9b79f6162f18e2da1342b815a37b69e6d04eef64b87dfb76bb0394e223911

Sharing

Copy URL

Twitter E-mail

General

Target

68600cb4aaa04d3f3f5db6e299de8474_JaffaCakes118
Size

29.6MB
Sample

240522-yajqqadh76
MD5

68600cb4aaa04d3f3f5db6e299de8474
SHA1

fe1e2f210deca2c0b3211d96da0865dd567b4bec
SHA256

adb9b79f6162f18e2da1342b815a37b69e6d04eef64b87dfb76bb0394e223911
SHA512

21c370f21ad634d9466c23186d317f2d560a3f6a6c8a72c386f0583cb0d8b46ef2c69d046c3add9c4be2f5c29da5f5022c29c6baf71c2b87bf4411ff50484be4
SSDEEP

786432:ZO/DrW137zgzYTFI717Atc8jUY5Td2kZkTGn09VsdbdNI2KDNwGUAZIFZ:ZO/DM7cYpS8jUQ/Z+G09VUbdNh+NwVr

Score

8^/10

Malware Config

Targets

- Target
  
  68600cb4aaa04d3f3f5db6e299de8474_JaffaCakes118
- Size
  
  29.6MB
- MD5
  
  68600cb4aaa04d3f3f5db6e299de8474
- SHA1
  
  fe1e2f210deca2c0b3211d96da0865dd567b4bec
- SHA256
  
  adb9b79f6162f18e2da1342b815a37b69e6d04eef64b87dfb76bb0394e223911
- SHA512
  
  21c370f21ad634d9466c23186d317f2d560a3f6a6c8a72c386f0583cb0d8b46ef2c69d046c3add9c4be2f5c29da5f5022c29c6baf71c2b87bf4411ff50484be4
- SSDEEP
  
  786432:ZO/DrW137zgzYTFI717Atc8jUY5Td2kZkTGn09VsdbdNI2KDNwGUAZIFZ:ZO/DM7cYpS8jUQ/Z+G09VUbdNh+NwVr
Score

8^/10

banker discovery evasion impact persistence
- Checks if the Android device is rooted.
  evasion
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Checks CPU information
  Checks CPU information which indicate if the system is an emulator.
  evasion discovery
- Checks memory information
  Checks memory information which indicate if the system is an emulator.
  evasion discovery
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Registers a broadcast receiver at runtime (usually for listening for system events)
  persistence
- Checks if the internet connection is available
  discovery
- Reads information about phone network operator.
  discovery
- Requests dangerous framework permissions
behavioral1
- Target
  
  cn.uc.gamesdk.loader.apk
- Size
  
  4.4MB
- MD5
  
  1297f8bf1f76c6f0e15a536d3deb14a2
- SHA1
  
  3bbda128acc28599f3d9f7d62440ba99318538e1
- SHA256
  
  6af1115a45bbddfd7352f25204c313b018a58919bcf668fae18d273d6d1bc3ff
- SHA512
  
  81b7645a8774d44f1ba61e39bdbe5457d1288a16bcee5c2ac6e00729bfc92d71abb853dd0c5ce341a941cd7cefc9c4353ffa2ad947b8a98c269e58cf39013930
- SSDEEP
  
  98304:KOVKntJietxfyuSvMx3988ZoGTDNq421R2wsX4+N4EMsm:TKnXi+ZyuSEpKTGTD4421R3a4+NjM1
Score

1^/10
behavioral2 behavioral3 behavioral4
- Target
  
  libcn.uc.gamesdk.account.so
- Size
  
  611KB
- MD5
  
  aca403484e4e1b5c361b011f64965b14
- SHA1
  
  4a5888c52b6f8dfb3b23b24527bbe3d4dc8f11ba
- SHA256
  
  c571d3043e68bd8fc6d29f636e3a38244874caff2aaa25e46f95098eef5b2d89
- SHA512
  
  966a2ee044e02cd7cee3e7553c4d7b01b678a605aee1fc3566344a182126ac7acbfd7ea8264b73a22d1539abc9a9ede69d1be8f2cc8512096453f3c9901a56fe
- SSDEEP
  
  12288:gWJVKpSqW76ScPZgjhcGDmoJ91PuVoG0O+IzB6/uma:gWJQAuqjDDmoDhTw
Score

1^/10
behavioral5 behavioral6 behavioral7
- Target
  
  libcn.uc.gamesdk.core.so
- Size
  
  2.3MB
- MD5
  
  f8268bf42861d2d4db4e7099b892ddb2
- SHA1
  
  1e7804b6321906cf0e53ae28dd63fcdd7d3f1e9c
- SHA256
  
  cdf396195d573f5ca4236640becd6a88bd04bc3a9ce5de59f09c2c79c85ccadf
- SHA512
  
  5356b8fe14cf117073b7ae8315ec7d6ab850a28bc2bcdc46ea0cbc7685ccb47bdf8d07902e5f47e0c4f48708bcb94e13e8afbefa192554e1d94bf2a0338bc2be
- SSDEEP
  
  49152:bR+XgxQ1A8qPTPfAVV0i3akHFOG+cvTKhPPch5p9uTtPjgCHV:bR+XgxQ1A8qPTHabHM7cvToPPc3pYtP7
Score

1^/10
behavioral10 behavioral8 behavioral9
- Target
  
  libcn.uc.gamesdk.floater.so
- Size
  
  811KB
- MD5
  
  ded1e529f9ed1b9fe997246eaedf9e68
- SHA1
  
  eab0fd7eb7d438017489fee62e8fb69be197f0fa
- SHA256
  
  c8ef6026fb7e91d59347e136f6a306bf68978dbd39aa4d3626b49c4ce6dc55ea
- SHA512
  
  76102d85db3c9ab0b3ecee9824f1400a6ae19e880ddb0379e53466c2a103053b8306bb8bb2bbf1835b75668f364a2784a35045d2b61de539595789a267b06fba
- SSDEEP
  
  24576:DtB7xIJ1t1vY8V76DfPmpL6BLbqU/WHA9uzB:tIPt1vlgDfPmWLbqCMF
Score

1^/10
behavioral11 behavioral12 behavioral13
- Target
  
  libcn.uc.gamesdk.init.so
- Size
  
  145KB
- MD5
  
  e818a169590245919236b2f8300314f3
- SHA1
  
  971fc03819d8d8910204a04666d36478266b31c3
- SHA256
  
  038faf33f57e07c6b4abc546d62ecf112bcdefe615d777d14d2b81bd81215759
- SHA512
  
  5248755350afec5bb376719982ebd6437058c5dcd690a911e00fd8f4306b18120a52233d9c90f6909f37dfcd87b7b301dfe5ebb7999eea14749e0eb187de68c7
- SSDEEP
  
  3072:CoUd73/U3nqG7r51NtNQVTcwSJdyDrDiS/DB:CoUFs3qGh1NtNiTGdypt
Score

1^/10
behavioral14 behavioral15 behavioral16
- Target
  
  libcn.uc.gamesdk.update.so
- Size
  
  19KB
- MD5
  
  8663672bd53fa18f47666fbc3d4d2b72
- SHA1
  
  41a424f4a8b8e99e42c4d84deae74b763ee6e89e
- SHA256
  
  33d3241ac5c57efc1e4c736f2ad36eaf2d51076a30ca28b61342c3d56898f735
- SHA512
  
  eff79d914deeefb378b045856bc08d22a865514fb5b9af5d8941fb7db2e0d464b9326631b31844f04091248c0ce3fcd69a2ac8821a5504ec44b0e5f5dce9ef66
- SSDEEP
  
  384:Ef5btNtjsHOuGD2fPf3BAMmy55Kx+IuzKf1E+sP9NbpZKrrYFrT:mtjFD2fPfRNeLuzq1U9NV/x
Score

1^/10
behavioral17 behavioral18 behavioral19
- Target
  
  ucsdk.apk
- Size
  
  29KB
- MD5
  
  8b08ce5b06d6bddffea3aa3f0bfcff29
- SHA1
  
  7fa193e8d811e93b181c1da8122dfe4e7d42993c
- SHA256
  
  b4071a983a0a546aa5685cf0a49dcf941cc2274a5bb673b8688c1fe7c54ce490
- SHA512
  
  a9896e57b60180ab2641dfc7c835f9fb57fddcefc2590425433bd1458d8b19bea4f41dee76f68d24f5ed73025218cd82905d3ea72dbac595ba34eb0ce5d87c59
- SSDEEP
  
  768:6PBDY6eIEp/sPS7NtutZV3s3dSpmAmMbW1ZmvIZ5KAV:65neIE2gNMFeSpmAJW/lnKAV
Score

1^/10
behavioral20 behavioral21 behavioral22

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Targets

Checks if the Android device is rooted.

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Checks CPU information

Checks memory information

Loads dropped Dex/Jar

Queries information about running processes on the device

Queries information about the current Wi-Fi connection

Queries the phone number (MSISDN for GSM devices)

Registers a broadcast receiver at runtime (usually for listening for system events)

Checks if the internet connection is available

Reads information about phone network operator.

Requests dangerous framework permissions

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22