General

  • Target

    6fa5a32f8d3cb40388f309dee125076e_JaffaCakes118

  • Size

    4.7MB

  • Sample

    240524-yjy7rsgh9t

  • MD5

    6fa5a32f8d3cb40388f309dee125076e

  • SHA1

    9520ffd0d2dce79c8448e0e953dde4e0f1c0ef7b

  • SHA256

    23243507f497a47a2148a3f6cec098947b918f50bf698c3808265956533500b4

  • SHA512

    9c02abee2a323d81c45b149bc1d841ecedc2927fc179c9a142d2363eda4f134e7260ffa8266142740005d180a6577923ac0016e6fe52f4d2d487c74958bff111

  • SSDEEP

    98304:lc8OP7aU7ZVUWfve7auSPd2MR1OXO9041LYCBMKQIXZ:lETHbJvGS122QXi1JBMq

Malware Config

Targets

    • Target

      6fa5a32f8d3cb40388f309dee125076e_JaffaCakes118

    • Size

      4.7MB

    • MD5

      6fa5a32f8d3cb40388f309dee125076e

    • SHA1

      9520ffd0d2dce79c8448e0e953dde4e0f1c0ef7b

    • SHA256

      23243507f497a47a2148a3f6cec098947b918f50bf698c3808265956533500b4

    • SHA512

      9c02abee2a323d81c45b149bc1d841ecedc2927fc179c9a142d2363eda4f134e7260ffa8266142740005d180a6577923ac0016e6fe52f4d2d487c74958bff111

    • SSDEEP

      98304:lc8OP7aU7ZVUWfve7auSPd2MR1OXO9041LYCBMKQIXZ:lETHbJvGS122QXi1JBMq

    • Checks if the Android device is rooted.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Checks CPU information

      Checks CPU information which indicate if the system is an emulator.

    • Checks memory information

      Checks memory information which indicate if the system is an emulator.

    • Queries information about running processes on the device

      Application may abuse the framework's APIs to collect information about running processes on the device.

    • Queries the mobile country code (MCC)

    • Registers a broadcast receiver at runtime (usually for listening for system events)

    • Checks if the internet connection is available

    • Queries the unique device ID (IMEI, MEID, IMSI)

    • Reads information about phone network operator.

MITRE ATT&CK Matrix

Tasks