General

  • Target

    723ee5b451a7bac1036f6937aba08fb8_JaffaCakes118

  • Size

    6.2MB

  • Sample

    240525-rnycpsfe7w

  • MD5

    723ee5b451a7bac1036f6937aba08fb8

  • SHA1

    62d8a55af2577df2290d3004fed8a59dc195591a

  • SHA256

    dda6f880eeebecac2ff635568d148071bf29a877c74167e08423795ed68bcdd5

  • SHA512

    48908faf351938993495efaeef1c085ab829c756d14a9f727f45ce3d00bb08200f531d2d5761bb65fc9f89ebd461951e6943df25b06081de03137b901fc8e0ec

  • SSDEEP

    98304:cddrTLhLpUcxh7EMEjze5N/L6q7kJS4racOOZBtTYcaCBaYCl/rkUx9zf0NYAV:cRhoze5N/SJSOachBNdCl/f0K2

Malware Config

Targets

    • Target

      723ee5b451a7bac1036f6937aba08fb8_JaffaCakes118

    • Size

      6.2MB

    • MD5

      723ee5b451a7bac1036f6937aba08fb8

    • SHA1

      62d8a55af2577df2290d3004fed8a59dc195591a

    • SHA256

      dda6f880eeebecac2ff635568d148071bf29a877c74167e08423795ed68bcdd5

    • SHA512

      48908faf351938993495efaeef1c085ab829c756d14a9f727f45ce3d00bb08200f531d2d5761bb65fc9f89ebd461951e6943df25b06081de03137b901fc8e0ec

    • SSDEEP

      98304:cddrTLhLpUcxh7EMEjze5N/L6q7kJS4racOOZBtTYcaCBaYCl/rkUx9zf0NYAV:cRhoze5N/SJSOachBNdCl/f0K2

    • Checks if the Android device is rooted.

    • Removes its main activity from the application launcher

    • Checks CPU information

      Checks CPU information which indicate if the system is an emulator.

    • Checks memory information

      Checks memory information which indicate if the system is an emulator.

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    • Queries information about running processes on the device

      Application may abuse the framework's APIs to collect information about running processes on the device.

    • Queries the mobile country code (MCC)

    • Registers a broadcast receiver at runtime (usually for listening for system events)

    • Acquires the wake lock

    • Checks if the internet connection is available

    • Reads information about phone network operator.

    • Schedules tasks to execute at a specified time

      Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

MITRE ATT&CK Matrix

Tasks