General

  • Target

    711f5937fe6f9b8f2e23f8b5b90e6168_JaffaCakes118

  • Size

    21.8MB

  • Sample

    240525-g9cb9ahd39

  • MD5

    711f5937fe6f9b8f2e23f8b5b90e6168

  • SHA1

    d3d5d7c052a952c3bf475952f9e58dfa54646bc4

  • SHA256

    f30020c7fd67f24050962c8b714b60d6fa03251cb6dc71ea27a165e81f622841

  • SHA512

    872e03fe1defc8ab6b059cdfa843ee0916689b265c5e5917934f9e84e1f80fb6ae2c985708fa341392dbfe049e7c2ffd52a2464063ed30d48d5b70b7ff1eeb23

  • SSDEEP

    393216:7OkhH7Vf7GYZmOmaZyIvGM5Raf3WYGzPGJF5inK/VnRdg2xxfnK/V1HbQXXtzXLr:7OkhH7FGimaZoMKWbzPkF5IK/V/gyVKI

Malware Config

Targets

    • Target

      711f5937fe6f9b8f2e23f8b5b90e6168_JaffaCakes118

    • Size

      21.8MB

    • MD5

      711f5937fe6f9b8f2e23f8b5b90e6168

    • SHA1

      d3d5d7c052a952c3bf475952f9e58dfa54646bc4

    • SHA256

      f30020c7fd67f24050962c8b714b60d6fa03251cb6dc71ea27a165e81f622841

    • SHA512

      872e03fe1defc8ab6b059cdfa843ee0916689b265c5e5917934f9e84e1f80fb6ae2c985708fa341392dbfe049e7c2ffd52a2464063ed30d48d5b70b7ff1eeb23

    • SSDEEP

      393216:7OkhH7Vf7GYZmOmaZyIvGM5Raf3WYGzPGJF5inK/VnRdg2xxfnK/V1HbQXXtzXLr:7OkhH7FGimaZoMKWbzPkF5IK/V/gyVKI

    • Checks if the Android device is rooted.

    • Requests cell location

      Uses Android APIs to to get current cell location.

    • Checks CPU information

      Checks CPU information which indicate if the system is an emulator.

    • Queries information about running processes on the device

      Application may abuse the framework's APIs to collect information about running processes on the device.

    • Queries information about the current Wi-Fi connection

      Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    • Queries information about the current nearby Wi-Fi networks

      Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

    • Registers a broadcast receiver at runtime (usually for listening for system events)

    • Checks if the internet connection is available

    • Queries the unique device ID (IMEI, MEID, IMSI)

    • Reads information about phone network operator.

    • Schedules tasks to execute at a specified time

      Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    • Listens for changes in the sensor environment (might be used to detect emulation)

MITRE ATT&CK Mobile v15

Tasks