31c3a75cf8d477ef6589e25ad2a03719d2c4aca59fff6246bf9763c61aae3abb

Sharing

Copy URL Twitter E-mail

General

Target
759f936ac235986dc86b81b0a0201eaf_JaffaCakes118
Size 5.9MB
Sample240526-qrav5sha47
SHA256 31c3a75cf8d477ef6589e25ad2a03719d2c4aca59fff6246bf9763c61aae3abb
MD5 759f936ac235986dc86b81b0a0201eaf
SHA1 f04d2a528e69047aab6b845a439273289e7d1409
SHA512 6a7256c65f0a34c7162ef98dd40ac3e897bcfef7a83f49b6641f2a29f1a2bb9c4176bb3aa03fd9b45d16a96bf5ced0a5b6a30b0da60e7d20501178309136c007
SSDEEP 98304:19SeB0rHIT2HVTbh28bhQzVVHlSALJfgRrf4gQ/aosM2m0xNC6p+tu3ZEUrc:Oearo4VB5baBVHlSUZmDXQ/aK02Urc
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Targets

- Target
  759f936ac235986dc86b81b0a0201eaf_JaffaCakes118
- Size 5.9MB
- SHA256 31c3a75cf8d477ef6589e25ad2a03719d2c4aca59fff6246bf9763c61aae3abb
- MD5 759f936ac235986dc86b81b0a0201eaf
- SHA1 f04d2a528e69047aab6b845a439273289e7d1409
- SHA512 6a7256c65f0a34c7162ef98dd40ac3e897bcfef7a83f49b6641f2a29f1a2bb9c4176bb3aa03fd9b45d16a96bf5ced0a5b6a30b0da60e7d20501178309136c007
- SSDEEP 98304:19SeB0rHIT2HVTbh28bhQzVVHlSALJfgRrf4gQ/aosM2m0xNC6p+tu3ZEUrc:Oearo4VB5baBVHlSUZmDXQ/aK02Urc
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery evasion impact persistence collection credential_access
- Checks CPU information
  Checks CPU information which indicate if the system is an emulator.
  evasion discovery
- Checks memory information
  Checks memory information which indicate if the system is an emulator.
  evasion discovery
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Queries the mobile country code (MCC)
  discovery
- Registers a broadcast receiver at runtime (usually for listening for system events)
  persistence
- Checks if the internet connection is available
  discovery
- Queries the unique device ID (IMEI, MEID, IMSI)
  discovery
behavioral1 behavioral2 behavioral3
- Target
  cn.uc.gamesdk.loader.apk
- Size 5.2MB
- SHA256 49c6c43d6bef28bf117c62d2cd8b0e25e151270cff09216ce51e434b2a1a1e81
- MD5 4165a132458a1038f3b856bbca479979
- SHA1 1403893af273403db063ecb254fae222a7eaa793
- SHA512 7363d9b25f2bf380828d042436a6348e55921534cf8b08a20d510e2e477b07983e1b28cb9df9bdfd52eb731ca498d392cdb54a3e8216dffc27b93db68e998078
- SSDEEP 98304:vNJQ6v7oTALzb5GGGGGGGGDM995iTh1Cki/beMC2C3NUcnoyPehUly:lDv0ELzb5GGGGGGGQ8v2vTi//CAhUly
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral4 behavioral5 behavioral6
- Target
  libcn.uc.gamesdk.account.so
- Size 964KB
- SHA256 b57c8682a8c699153a5be1db9e7fec919d317cfba024722f01d04e5aabb91229
- MD5 2717b0609931a75629512702fe3fb758
- SHA1 7b035726ed054f439391f63fe8f76bd318b7262d
- SHA512 a911ae730471376ec9b08ac294d576f1965d05b9f714caa8ce38ba5876be0c2f50d7fbfe5e0e78b7dd8dd5e3d5647a19ac446b702bd395bb4b6244e49e77507c
- SSDEEP 24576:8OK6nFpIQdYMe3VOfF7Mgrrq1YacpOSFTFOD6+:8OK6FpIrNlOtggqGw
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7 behavioral8
- Target
  libcn.uc.gamesdk.core.so
- Size 2.0MB
- SHA256 50c3926815d4e9f37645a4da344c37dbace4be887c67bc06d46482d85552acfe
- MD5 3fdc4bbcb1b68fc9f4c2177c20af8ad3
- SHA1 eb144c40d4bf523280ed38ded723779b9834e472
- SHA512 e126715ac8148b6e135d39bc74cd42b339a3982ef3339f65baf961a502754018ffa9b38dd0bea4a50e0d3a6e3c76e2dca7fb724afc12f727908bfdfdce265f21
- SSDEEP 49152:t+Pk+f9hb+vKN3PPAVV1CBgxrOvi9lLckq+Xyong/OlYyg:oPk+f9hb+vKN3naPCBgsvi9lLcztoncZ
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10 behavioral11 behavioral9
- Target
  libcn.uc.gamesdk.floater.so
- Size 1.0MB
- SHA256 cc0f65c52589ef369ae55b9f72a9cad6ea157e393c499a2c30cb537a376f8703
- MD5 3d703907a230b7e76ae5834be81aad7f
- SHA1 5cf3f6bc3f0c5c0d50f7b8b23db6e868cb75b7cd
- SHA512 81a8467361710bb700d21fa1ba86c429c0d95066c44a9cd5b46e298fba0f24f4f153e5b59803336fb7484a66b61a41b27b765a3a0079d21ef040a9b5b81996e9
- SSDEEP 24576:ACn7xIJ1t1vNh7WkWSaHzBMFlOuVMdNwtB1Gn0ZRTeHc:AUIPt1vN9WkRa7uVMDQ1Gn0DSHc
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral12 behavioral13 behavioral14
- Target
  libcn.uc.gamesdk.init.so
- Size 559KB
- SHA256 99ef7c93b7600a0971cc710c8c40411875825a9d2bc40793dba7379bbee67c10
- MD5 84269eef0c6a811fbaca4f357c694d6b
- SHA1 f8c33f6fb6ebb356f69406c13798fe2f8eb1c5df
- SHA512 0b4d949ed4384babbbeb5e242e52b413a0ad26e1a20a2234ddbab7736fa9e59a46994970af2427a8ce05218f81c75e14bd7b0fee36ec2a2efc67d164f549cd3a
- SSDEEP 12288:Mnd3Xhg+rnaDIGMGmbJtIb74TTvyanOVpCRncVtceuvvyMp+g:iT9GObJtIXqQkcVtcekn
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15 behavioral16
- Target
  libcn.uc.gamesdk.update.so
- Size 20KB
- SHA256 a3810344fa511bf61d23412bfae0be35367961a80bb2b011b08b41f5ba91f16d
- MD5 213a66a251dabc45fef6063a24ef4d8f
- SHA1 b8ed093c4e3b85185953d235d8715bfc38786ec8
- SHA512 2cc77bae4fcb1c836289679a196a1d37bdae3ff3f46453b970926df8d6c24a79232b2a7fdab22d2c4050c1acae263dd6aed2f12858653384724e0a7ab67a6e99
- SSDEEP 384:mB5btNRSG/i4t/Vt19GYdSpxWZqF2KF+K2vqNlaVjaAZKUrY0h:iRjt/X19ktNFP20lIL6S
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral17 behavioral18 behavioral19
- Target
  ucsdk.apk
- Size 37KB
- SHA256 ebb141841c50402ce7ee24d420e93f3d6c9bf681039e3fc35d288029858cbaa3
- MD5 16f21e512abd3d949ee7fb9aa59ca231
- SHA1 03cf2243334a10f93b7db22ae2be334cf8d47319
- SHA512 76965b6dd487fc9a312e5fe35173cbd79fac0c97e49ac19b74746ceb5145677b22042c57b3eb1e57b7f47b7d5bccba76db7793b59821075c5ba400e8ad4e7245
- SSDEEP 768:B2UTbHoqPqHvRBF0H0N5tyYR9qbLnWxvXsrf5PxDEeBFfOc3eF+9G:B2UT7MZBFc019K+vXsHEeyc3Q+9G
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral20 behavioral21 behavioral22

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Tasks

Sharing

General

Malware Config

Targets

Checks CPU information

Checks memory information

Loads dropped Dex/Jar

Obtains sensitive information copied to the device clipboard

Queries information about running processes on the device

Queries information about the current Wi-Fi connection

Queries the mobile country code (MCC)

Registers a broadcast receiver at runtime (usually for listening for system events)

Checks if the internet connection is available

Queries the unique device ID (IMEI, MEID, IMSI)

MITRE ATT&CK Mobile v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22