708af9235416896a527c345aad81c94dbd9708883263710268ff24896b5060fb

General

Target
7aeb6358c8be72d1735a90653cfc0103_JaffaCakes118
Size 14.1MB
Sample240527-3f585afb63
SHA256 708af9235416896a527c345aad81c94dbd9708883263710268ff24896b5060fb
MD5 7aeb6358c8be72d1735a90653cfc0103
SHA1 c8171d7735bd278c04eae57c5c5029b69c26cc28
SHA512 5fe72e4826da1c3745223549d1caf64d072c31864fd3e6598c34f02d6e228e37b90898225b54279fbaaa32ebad85fd2c9a03dc3f7831582a0479fa400a2393ec
SSDEEP 196608:fpbK3E+DVscc7kPjNWOl/ew4J8/S8xWIZRdoGpP2ikE/2zc8eAUS68iRJHLh+l:x23EWVsP7ajNWOl4JUr8pES0HS0TLh+l
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Targets

- Target
  7aeb6358c8be72d1735a90653cfc0103_JaffaCakes118
- Size 14.1MB
- SHA256 708af9235416896a527c345aad81c94dbd9708883263710268ff24896b5060fb
- MD5 7aeb6358c8be72d1735a90653cfc0103
- SHA1 c8171d7735bd278c04eae57c5c5029b69c26cc28
- SHA512 5fe72e4826da1c3745223549d1caf64d072c31864fd3e6598c34f02d6e228e37b90898225b54279fbaaa32ebad85fd2c9a03dc3f7831582a0479fa400a2393ec
- SSDEEP 196608:fpbK3E+DVscc7kPjNWOl/ew4J8/S8xWIZRdoGpP2ikE/2zc8eAUS68iRJHLh+l:x23EWVsP7ajNWOl4JUr8pES0HS0TLh+l
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

collection discovery evasion impact persistence
- Requests cell location
  Uses Android APIs to to get current cell location.
  collection discovery evasion
- Checks CPU information
  Checks CPU information which indicate if the system is an emulator.
  evasion discovery
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Queries information about the current nearby Wi-Fi networks
  Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
  discovery
- Registers a broadcast receiver at runtime (usually for listening for system events)
  persistence
- Checks if the internet connection is available
  discovery
- Domain associated with commercial stalkerware software, includes indicators from echap.eu.org
- Reads information about phone network operator.
  discovery
- Listens for changes in the sensor environment (might be used to detect emulation)
  evasion
behavioral1
- Target
  ixintui_plugin.jar
- Size 79KB
- SHA256 f10a28194af30f690caaf014d2728af4d4a266de46bf1f94ccd21cf621c72930
- MD5 9a8ff3e1c6f1f87f5a1d437d990dafff
- SHA1 d7f6672803ae11245ec7f2cbcfae989bbc710ef5
- SHA512 5f55d391819e28e6c5fa625d8298f5c237bd6cfe11c1a31b7940c61a024a38f6644857f0e898a2e8ec04d9924149cfb87ca08bc378d517fe95b68ca4f05cd835
- SSDEEP 1536:1rt+8EWS6QIH8Tuqqu+q+xbinlYJ2Lx8ZxpoLobyN/bczo1O8CPa5D4:11g7HuvxzbIyJgxwMZ31jCPoD4
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral2 behavioral3 behavioral4
- Target
  stat_plugin.jar
- Size 16KB
- SHA256 5bfcc016212ee3fb33976d09b101046b2e1c296dc0463e23c5f36ecadbd01f57
- MD5 dbf4755de60ebd9907eb161bcb77382b
- SHA1 b9d1c227b108eeb02efb23ee895e146239d97159
- SHA512 ae4f1320f1bed7bfc08009e92f083c5ef72aad445ee7e77e48cd94020e039b5d4854de24f7e99a6224b7f2d652c9d6c56c4070b49f4059f1ebfeb159d91b98c5
- SSDEEP 384:fka+QPAF/u9U1BTv7uD+lIECg52TH5yNNXamlHeJ4tObrAh7iABYeQA:fkatPAM9uBL7uD+l9SH5yNRa6ejrAbBJ
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6 behavioral7