d5882e5b97182f1ccf0feaa1b1a6f5247ed47aa3d703c7cce766604e75878216

General

Target

6cb4fb3a3b4dff348b8d7c0fd2a0c844_JaffaCakes118
Size

30.1MB
Sample

240523-3zce6aea98
MD5

6cb4fb3a3b4dff348b8d7c0fd2a0c844
SHA1

42dd9d38eaf3d959ee56741b2cc54d06977b5ee1
SHA256

d5882e5b97182f1ccf0feaa1b1a6f5247ed47aa3d703c7cce766604e75878216
SHA512

a597100ac3ab8950dffa54390e8bca74af1322b3cfacc4bf9161a149d24fbcc2011703a4caf42bbaa26d5c2ff5e9c8ba2a74a2ee58efa10d56d2ff31c360e4d2
SSDEEP

786432:INWgq1gRBjZn4SBrn4SvhAAgI2+KHyaUQuV:EWgq8RZn4+rn46oNydQuV

Score

8^/10

Malware Config

Targets

- Target
  
  6cb4fb3a3b4dff348b8d7c0fd2a0c844_JaffaCakes118
- Size
  
  30.1MB
- MD5
  
  6cb4fb3a3b4dff348b8d7c0fd2a0c844
- SHA1
  
  42dd9d38eaf3d959ee56741b2cc54d06977b5ee1
- SHA256
  
  d5882e5b97182f1ccf0feaa1b1a6f5247ed47aa3d703c7cce766604e75878216
- SHA512
  
  a597100ac3ab8950dffa54390e8bca74af1322b3cfacc4bf9161a149d24fbcc2011703a4caf42bbaa26d5c2ff5e9c8ba2a74a2ee58efa10d56d2ff31c360e4d2
- SSDEEP
  
  786432:INWgq1gRBjZn4SBrn4SvhAAgI2+KHyaUQuV:EWgq8RZn4+rn46oNydQuV
Score

8^/10

discovery evasion impact persistence banker
- Checks if the Android device is rooted.
  evasion
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Checks CPU information
  Checks CPU information which indicate if the system is an emulator.
  evasion discovery
- Checks memory information
  Checks memory information which indicate if the system is an emulator.
  evasion discovery
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Registers a broadcast receiver at runtime (usually for listening for system events)
  persistence
- Checks if the internet connection is available
  discovery
- Domain associated with commercial stalkerware software, includes indicators from echap.eu.org
- Queries the unique device ID (IMEI, MEID, IMSI)
  discovery
- Reads information about phone network operator.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Targets

Checks if the Android device is rooted.

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Checks CPU information

Checks memory information

Queries information about running processes on the device

Queries information about the current Wi-Fi connection

Registers a broadcast receiver at runtime (usually for listening for system events)

Checks if the internet connection is available

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

Queries the unique device ID (IMEI, MEID, IMSI)

Reads information about phone network operator.

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2