1294e4fc4c4d9478c59a75197c43e6f43c58fe9bd1feb47ce261bf750d1f4ee9

General

Target
75be0f6154c4907203598b9eede99fe9_JaffaCakes118
Size 3.5MB
Sample240526-rhb8aaha8t
SHA256 1294e4fc4c4d9478c59a75197c43e6f43c58fe9bd1feb47ce261bf750d1f4ee9
MD5 75be0f6154c4907203598b9eede99fe9
SHA1 79c9d60ac7ade689fffefe43df1007b7acab5745
SHA512 a8d32bf8c89c55076e9d4725906ffd40c8efe77b9e4bd2a9119bc348e9e0b58eb6aa327389758ca3c8daaa246dbfb3ca9fa63534e867b7a7b322974c26c58115
SSDEEP 98304:ReaLV/n3qbcX4C1G8g0QlvB/tFi5XnfuTwKaWucEfS8ET+JGYvvx:MA1zf3cEjE0Hx
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Targets

- Target
  75be0f6154c4907203598b9eede99fe9_JaffaCakes118
- Size 3.5MB
- SHA256 1294e4fc4c4d9478c59a75197c43e6f43c58fe9bd1feb47ce261bf750d1f4ee9
- MD5 75be0f6154c4907203598b9eede99fe9
- SHA1 79c9d60ac7ade689fffefe43df1007b7acab5745
- SHA512 a8d32bf8c89c55076e9d4725906ffd40c8efe77b9e4bd2a9119bc348e9e0b58eb6aa327389758ca3c8daaa246dbfb3ca9fa63534e867b7a7b322974c26c58115
- SSDEEP 98304:ReaLV/n3qbcX4C1G8g0QlvB/tFi5XnfuTwKaWucEfS8ET+JGYvvx:MA1zf3cEjE0Hx
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

banker collection credential_access discovery evasion impact persistence
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion credential_access
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Requests cell location
  Uses Android APIs to to get current cell information.
  collection discovery
- Requests cell location
  Uses Android APIs to to get current cell location.
  collection discovery evasion
- Checks memory information
  Checks memory information which indicate if the system is an emulator.
  evasion discovery
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Queries information about the current nearby Wi-Fi networks
  Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
  discovery
- Registers a broadcast receiver at runtime (usually for listening for system events)
  persistence
- Checks if the internet connection is available
  discovery
- Queries the unique device ID (IMEI, MEID, IMSI)
  discovery
- Reads information about phone network operator.
  discovery
behavioral1 behavioral2 behavioral3
- Target
  __xadsdk__remote__final__.jar
- Size 40KB
- SHA256 d9acce94df9b850372a321c685b6a6fc3939467009874be6dd87d208e314e7b4
- MD5 0e9e1dc278d1bb2d2b7d36ebd70f2c9e
- SHA1 e14d0ad51db670c14208cb98dacc61f4bec72451
- SHA512 07ca7276c76b3a2d495cfd8e536485069351c405113864b5c340aa3546237e104fe67dfa29781aa199c877cfa18dc23fd1820bcb0a4c41344cd327fc7c36a0f1
- SSDEEP 768:j0cAv9dXXGw+VCwUnAg/OaISIkhuPcmrIrCDlIB6NKuA7UmSseGmc:MGNVsntOa6kQc0Irmo6+YMeU
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral4 behavioral5 behavioral6