General

  • Target

    6dd2c43d9b034f69c9da4acb95613553_JaffaCakes118

  • Size

    8.9MB

  • Sample

    240524-jwwvvaae8y

  • MD5

    6dd2c43d9b034f69c9da4acb95613553

  • SHA1

    afb9e07293fcb834da1358e3c8f29087b1072748

  • SHA256

    484fcc59b6b6902e35df9f3d95ac4512e3f00ac223cc0029a767420fb45dada7

  • SHA512

    27a55dbb7607d39f7b0f8546670d58b1e7c63e4dcc0ed1dd3529d5574c6583515f78fb552f401fbbb88df9bce0b1c91b4b2db444bfc3db951741e90f57393582

  • SSDEEP

    196608:DZwhjLwuXALMWk0mL6XUj/txCxXtO8FKzXxkeI1q72zeLxlX1xcxaqF4AuOCM4:DZwhfw/Mv0vE7tY8pXxkHqKzeLxlX1xP

Malware Config

Targets

    • Target

      6dd2c43d9b034f69c9da4acb95613553_JaffaCakes118

    • Size

      8.9MB

    • MD5

      6dd2c43d9b034f69c9da4acb95613553

    • SHA1

      afb9e07293fcb834da1358e3c8f29087b1072748

    • SHA256

      484fcc59b6b6902e35df9f3d95ac4512e3f00ac223cc0029a767420fb45dada7

    • SHA512

      27a55dbb7607d39f7b0f8546670d58b1e7c63e4dcc0ed1dd3529d5574c6583515f78fb552f401fbbb88df9bce0b1c91b4b2db444bfc3db951741e90f57393582

    • SSDEEP

      196608:DZwhjLwuXALMWk0mL6XUj/txCxXtO8FKzXxkeI1q72zeLxlX1xcxaqF4AuOCM4:DZwhfw/Mv0vE7tY8pXxkHqKzeLxlX1xP

    • Checks if the Android device is rooted.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Requests cell location

      Uses Android APIs to to get current cell location.

    • Checks CPU information

      Checks CPU information which indicate if the system is an emulator.

    • Checks memory information

      Checks memory information which indicate if the system is an emulator.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Queries information about running processes on the device

      Application may abuse the framework's APIs to collect information about running processes on the device.

    • Queries information about the current Wi-Fi connection

      Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    • Queries information about the current nearby Wi-Fi networks

      Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

    • Queries the phone number (MSISDN for GSM devices)

    • Registers a broadcast receiver at runtime (usually for listening for system events)

    • Checks if the internet connection is available

    • Queries the unique device ID (IMEI, MEID, IMSI)

    • Reads information about phone network operator.

    • Listens for changes in the sensor environment (might be used to detect emulation)

    • Target

      dynamic.jar

    • Size

      108KB

    • MD5

      036c1d91555f71d141fded831b7060b9

    • SHA1

      8848f30afba238581420a22c267ee48de425f26c

    • SHA256

      b3391347fceb2a7ee182f9f13fd168b2f990044d866a7e765bdc21e79c2cc330

    • SHA512

      8eda9af8144e10ee9bf339385e814204a6a0e43f9a9597948f63e931d917d997d7985569f1850ec14c0df75ddd3d92a55abe8fd0c42fd2bf3897c525502d6afd

    • SSDEEP

      3072:O7o0mE6vhSEwJF6BC7TJ+R/o12tA80lB7Y:6HohdOEBC7TAloAt4lVY

    Score
    1/10
    • Target

      gdtadv2.jar

    • Size

      240KB

    • MD5

      f73389c27d23a9090a7a6c81e231b774

    • SHA1

      25924157d4122f40ef78e86aea40b589457900f9

    • SHA256

      8e2be609b620003e353d8b554a486fca1256c8021b44ae8c1580545da828725a

    • SHA512

      9699a5ec4a7b076146b263f28637a349ce03d18287bc9d03ce6c4c73c055f8f4d16d65de30ea4ab625bb0805a14e4ddc2ed302e47cc908c447f353cd15024c32

    • SSDEEP

      6144:mnTJSUfOFvZ4bzbvq2S5A7KLPRfU+peOOh0OK:mVOB6nquKVBkJh0OK

    Score
    1/10

MITRE ATT&CK Mobile v15

Tasks