61aec9c3a1c40ae11c09f76dfa4434edf73401eaf008c81a0f859d51593d0cb7

General

Target

6d09b0cc1aa7dac869bb1873f550765e_JaffaCakes118
Size

11.5MB
Sample

240524-cpkqnshg82
MD5

6d09b0cc1aa7dac869bb1873f550765e
SHA1

e343d031b2c1403a31adef3d6a0f5e618fd514cc
SHA256

61aec9c3a1c40ae11c09f76dfa4434edf73401eaf008c81a0f859d51593d0cb7
SHA512

9b92bd1227238b5f615664b564285454d8a1beda1738e7a0ed265bad137e83a8ce1f634b6068793ac1f8da8bbe6cf2ed0a50a7595be6d0ba49643dfe90f64a3c
SSDEEP

196608:SZWwOqAepW1oKk53fbqphoNReSYrvnxb757BXGjnHHkp3khxuntw5Kh6ZNZsdeEI:SZY1eH5Pbqw/A1P/XqnHHXrutw5K8ZAU

Score

8^/10

Malware Config

Targets

- Target
  
  6d09b0cc1aa7dac869bb1873f550765e_JaffaCakes118
- Size
  
  11.5MB
- MD5
  
  6d09b0cc1aa7dac869bb1873f550765e
- SHA1
  
  e343d031b2c1403a31adef3d6a0f5e618fd514cc
- SHA256
  
  61aec9c3a1c40ae11c09f76dfa4434edf73401eaf008c81a0f859d51593d0cb7
- SHA512
  
  9b92bd1227238b5f615664b564285454d8a1beda1738e7a0ed265bad137e83a8ce1f634b6068793ac1f8da8bbe6cf2ed0a50a7595be6d0ba49643dfe90f64a3c
- SSDEEP
  
  196608:SZWwOqAepW1oKk53fbqphoNReSYrvnxb757BXGjnHHkp3khxuntw5Kh6ZNZsdeEI:SZY1eH5Pbqw/A1P/XqnHHXrutw5K8ZAU
Score

8^/10

banker collection discovery evasion impact persistence
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Requests cell location
  Uses Android APIs to to get current cell location.
  collection discovery evasion
- Checks CPU information
  Checks CPU information which indicate if the system is an emulator.
  evasion discovery
- Checks memory information
  Checks memory information which indicate if the system is an emulator.
  evasion discovery
- Queries account information for other applications stored on the device
  Application may abuse the framework's APIs to collect account information stored on the device.
  collection
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Queries information about the current nearby Wi-Fi networks
  Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
  discovery
- Queries the mobile country code (MCC)
  discovery
- Registers a broadcast receiver at runtime (usually for listening for system events)
  persistence
- Checks if the internet connection is available
  discovery
- Domain associated with commercial stalkerware software, includes indicators from echap.eu.org
- Queries the unique device ID (IMEI, MEID, IMSI)
  discovery
- Reads information about phone network operator.
  discovery
behavioral1