0db138fdf9b4608d71c9aa2a8870d2c7469ca89e1b431ab329c59592d512da63 | Triage

Sharing

General

Target

6ccd389ae873556ec2d65ef93d52f74d_JaffaCakes118
Size

19.4MB
Sample

240524-ax6a8seh21
MD5

6ccd389ae873556ec2d65ef93d52f74d
SHA1

f0261db72297c49a254b98df202d811bb6ae3362
SHA256

0db138fdf9b4608d71c9aa2a8870d2c7469ca89e1b431ab329c59592d512da63
SHA512

8e2216a48ed335f4c934170a25d113b803917ff66e99f3b0672292a572e4bc6197350fe8b3995b90f49739583db7ea9200dcf80329cc392b0ca708a4ca9d0f60
SSDEEP

393216:3wVhPltzhcSP1Zzq3zwwQuMYTUplp6qOsfGxQkFLDvwlt3NLw9ug:3wXbZFq38e9T6Osfaol7s93

Score

8^/10

android banker discovery evasion persistence

Malware Config

Targets

- Target
  
  6ccd389ae873556ec2d65ef93d52f74d_JaffaCakes118
- Size
  
  19.4MB
- MD5
  
  6ccd389ae873556ec2d65ef93d52f74d
- SHA1
  
  f0261db72297c49a254b98df202d811bb6ae3362
- SHA256
  
  0db138fdf9b4608d71c9aa2a8870d2c7469ca89e1b431ab329c59592d512da63
- SHA512
  
  8e2216a48ed335f4c934170a25d113b803917ff66e99f3b0672292a572e4bc6197350fe8b3995b90f49739583db7ea9200dcf80329cc392b0ca708a4ca9d0f60
- SSDEEP
  
  393216:3wVhPltzhcSP1Zzq3zwwQuMYTUplp6qOsfGxQkFLDvwlt3NLw9ug:3wXbZFq38e9T6Osfaol7s93
Score

8^/10

banker discovery evasion persistence
- Checks if the Android device is rooted.
  evasion
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Checks CPU information
  Checks CPU information which indicate if the system is an emulator.
  evasion discovery
- Checks memory information
  Checks memory information which indicate if the system is an emulator.
  evasion discovery
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries the mobile country code (MCC)
  discovery
- Registers a broadcast receiver at runtime (usually for listening for system events)
  persistence
- Checks if the internet connection is available
  discovery
- Queries the unique device ID (IMEI, MEID, IMSI)
  discovery
behavioral1

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

Broadcast Receivers

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

System Checks

Credential Access

Discovery

Process Discovery

Software Discovery

Security Software Discovery

System Information Discovery

System Network Configuration Discovery

System Network Connections Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

bankerdiscoveryevasionpersistence