f4efa6809e6cac7afa86e0e2d0108ff1868670353cc1fc883b6d48cf7e42d53d

Sharing

Copy URL

Twitter E-mail

General

Target

69af7fa88a78ec34a56c1b989cfad226_JaffaCakes118
Size

10.5MB
Sample

240523-eqdpvsdd5y
MD5

69af7fa88a78ec34a56c1b989cfad226
SHA1

8ad1476d6391166f6b14c9577a7e75d20adee95c
SHA256

f4efa6809e6cac7afa86e0e2d0108ff1868670353cc1fc883b6d48cf7e42d53d
SHA512

11480e59ffb99ca28d6f12b40d892eb91a848b3ae21915c9d206654705ed306fbb7a8e99ac3638641b1d352f053957f30ce67f4b3f0751c19e35cb7a9f1f1cfa
SSDEEP

196608:f8NZtCeKb+RpCt779+RpCt77veU5pkfTJSTUyckZZE9sjZNw7VfOnO6WvNO:0N2x+479+47vVOfTJlycOEGqMOe

Score

8^/10

Malware Config

Targets

- Target
  
  69af7fa88a78ec34a56c1b989cfad226_JaffaCakes118
- Size
  
  10.5MB
- MD5
  
  69af7fa88a78ec34a56c1b989cfad226
- SHA1
  
  8ad1476d6391166f6b14c9577a7e75d20adee95c
- SHA256
  
  f4efa6809e6cac7afa86e0e2d0108ff1868670353cc1fc883b6d48cf7e42d53d
- SHA512
  
  11480e59ffb99ca28d6f12b40d892eb91a848b3ae21915c9d206654705ed306fbb7a8e99ac3638641b1d352f053957f30ce67f4b3f0751c19e35cb7a9f1f1cfa
- SSDEEP
  
  196608:f8NZtCeKb+RpCt779+RpCt77veU5pkfTJSTUyckZZE9sjZNw7VfOnO6WvNO:0N2x+479+47vVOfTJlycOEGqMOe
Score

8^/10

banker collection discovery evasion impact persistence
- Checks if the Android device is rooted.
  evasion
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Checks memory information
  Checks memory information which indicate if the system is an emulator.
  evasion discovery
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Reads the content of photos stored on the user's device.
  collection
- Registers a broadcast receiver at runtime (usually for listening for system events)
  persistence
- Checks if the internet connection is available
  discovery
- Requests dangerous framework permissions
behavioral1
- Target
  
  cn.uc.gamesdk.loader.apk
- Size
  
  4.9MB
- MD5
  
  b68ad432ebb064991407fdf85b3e1010
- SHA1
  
  ca758fb3a56d5a4d5cc9d28b539f37c01f0b60cf
- SHA256
  
  1697fb88881561933c7760fdd6acda28f8f9a9cd4b193ca619cfdbe209ffc9de
- SHA512
  
  59a4e096173d31e95d49dca9f73aa763d9d4de321fac861bd9122435961ac30f278706f5d1586c242c9681d0e3296a7d10f97709abe28cf2ad67cb02bcfac228
- SSDEEP
  
  98304:b5REIY7FZOBdOklZrwdNh792UOUqfC04m4O4fJ7vKV:bnEIY7FZODOkllMNh79JOvCvO4sV
Score

1^/10
behavioral2 behavioral3 behavioral4
- Target
  
  libcn.uc.gamesdk.account.so
- Size
  
  962KB
- MD5
  
  375fd95c8b0d1f1ceb4a49e9c26c17e3
- SHA1
  
  ce5f677a9f49cbc820098bd19fbaaa5ddc053841
- SHA256
  
  ec6ef33d48266cfbd39dcc22f565abfa2fe876baf427562367a28fa3d5131ebe
- SHA512
  
  dbdcaa12c729dabfe5f1d8ec9f38b145f703a59a26af1d4b4071268fa2ce9bea85673852ea6857af46d9e464a2eef68e287f1879aa3765911f774bb0ea2348d2
- SSDEEP
  
  24576:jK6nFpIQd1qa3xG33/XGAff1SkBin5+ODRt:jK6FpIByx2uAf9nBs
Score

1^/10
behavioral5 behavioral6
- Target
  
  libcn.uc.gamesdk.core.so
- Size
  
  1.9MB
- MD5
  
  e52f28755c208e82387e54ed3ada579c
- SHA1
  
  94d50952a095d0ad0a5e9eaf4dd3452ef1c57088
- SHA256
  
  b4346c319b010a9209be8f696de39903914a3c3c0baf57c96d79ba32c2090f46
- SHA512
  
  c1b2f82680c6b2c813a5950b13d1bc9fe081d40ad32a2d530536d44fa1f8b8deae8a0f83ff971a045350165506460a1d741f8fcc6e54319e8307df339441b766
- SSDEEP
  
  49152:/yPk+f9hb+hKNLPPAVV1CBgxrOvi7jTelAD7aaongwOlDk:/yPk+f9hb+hKNLnaPCBgsviHTelyZonp
Score

1^/10
behavioral7 behavioral8 behavioral9
- Target
  
  libcn.uc.gamesdk.floater.so
- Size
  
  860KB
- MD5
  
  bf4e5959f2a83e78d370faf4d12417c2
- SHA1
  
  f756bf347a7f7daee9be5c6046c90c1f6ea1affd
- SHA256
  
  e2080090950185985027764162cf7475ba7485ddbddb6bdcb869a2f419c99e66
- SHA512
  
  fc92240c4d32cae8b3850327f0faa5363df8a6354cd8c4fac1ab7caf82d79a7fb0f9c2e0f3f32dfa21ca0e50a5a3861b1817f7b40e844e5997a858157ee054b8
- SSDEEP
  
  24576:iB7xIJ1t1vKlf1oRlMGa1OybBivLwIunQd9XL:yIPt1vKlf1QlVa1Oybg8ydF
Score

1^/10
behavioral10 behavioral11 behavioral12
- Target
  
  libcn.uc.gamesdk.init.so
- Size
  
  557KB
- MD5
  
  27f968b06845eb1be53a982daf4b55dc
- SHA1
  
  9dfbcb10cf8cb1142da2bedd8d05b3fd8a26728c
- SHA256
  
  32de8ef669a10288c71f5ee0ee8c01ab0512b4da2e1872e0b84c20f2b2181943
- SHA512
  
  a8d9971094616b9c090b4460f196295bd6a947a8a3c8afae707296f8e24c979903e5908c907d359162993cccda7f76c11560191b9ecf2b5571467b70aac9733d
- SSDEEP
  
  12288:j3BsPp7aDIGMGmbJtIb74TTvyanOVpCRncVtceuelyXApN1:jRCGObJtIXqQkcVtcetlUI
Score

1^/10
behavioral13 behavioral14
- Target
  
  libcn.uc.gamesdk.update.so
- Size
  
  20KB
- MD5
  
  f154a9be2b4b04b73938ac7a5082bcb3
- SHA1
  
  e439e95b9947bdac4f6e588f4c980e8eef8d2448
- SHA256
  
  75fa3b03178bb601d58091c9d44103b239ae94adfdab3197c288ed9262e23ada
- SHA512
  
  48f1630e87321c80bcc465e4664974dd36975e1cae708be0adfcea27a6d30c5a821a0474ec68f9c1cfe56624d9301653e6b24921ef921e7a2b405da5e507ab0b
- SSDEEP
  
  384:v5btNaRjyBSULTvdjbS5B5r5jgoQG6jbrcKNuS4JuSQmRnGp0ZK6rY2+D:tpSULTxSjt5jXB6j9p0uWnxU2u
Score

1^/10
behavioral15 behavioral16 behavioral17
- Target
  
  ucsdk.apk
- Size
  
  37KB
- MD5
  
  1e5d2ae8f1e890c4182fd46f6a84f932
- SHA1
  
  7f86c7f330038b2fb2289723b483c4077edacc3d
- SHA256
  
  8ad31017a72b5afd54856038d992514ffe66e56b508f34897992426344f7a46a
- SHA512
  
  d08231273c8c4338917a73ceb8fa963246feaa47eb028e6faf25dffcee42fb0c7efa7e4067b96bd7427abb83bc63a0ecb6c29368167ba129e403c8bb0c4ff15e
- SSDEEP
  
  768:1MV1jZsxScAGt1Iz+2+mfoNtr9MbUPEETVKZKGefwB29qAdOKd4:2VpaxScAYIzNfatGnEIEGHg9qAQKd4
Score

1^/10
behavioral18 behavioral19 behavioral20

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Data from Local System

T1533

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Tasks

Sharing

General

Malware Config

Targets

Checks if the Android device is rooted.

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Checks memory information

Loads dropped Dex/Jar

Queries information about running processes on the device

Queries information about the current Wi-Fi connection

Reads the content of photos stored on the user's device.

Registers a broadcast receiver at runtime (usually for listening for system events)

Checks if the internet connection is available

Requests dangerous framework permissions

MITRE ATT&CK Mobile v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20