General

  • Target

    7937bfd80439ba6e5b8b2f6785579cad_JaffaCakes118

  • Size

    6.1MB

  • Sample

    240527-p2wd6aea95

  • MD5

    7937bfd80439ba6e5b8b2f6785579cad

  • SHA1

    e8fa0c978ca80e7ecb2b7f4d7e04d1ca7d3f5e5e

  • SHA256

    33d5edf1fca2f270ac61d0f090ac54e52b371fdc839b63b0786dcb48a45cf486

  • SHA512

    4ae0a2fda76e7d985a81472e89d105f3a551c7aa3208ac9e09ede6b02bef38868592898ded6cfb4e06004c4fed12cfa667aa66fafef408da26e8bd51cb4e5601

  • SSDEEP

    98304:AudWDH3DdrTLhNpUcxh7EMEjzenIMERfDIX0jcOCuPLkxC44wCUOQx9zf0NYAG:NkDH3dhozenpuf/jWULkxCYbf0K5

Malware Config

Targets

    • Target

      7937bfd80439ba6e5b8b2f6785579cad_JaffaCakes118

    • Size

      6.1MB

    • MD5

      7937bfd80439ba6e5b8b2f6785579cad

    • SHA1

      e8fa0c978ca80e7ecb2b7f4d7e04d1ca7d3f5e5e

    • SHA256

      33d5edf1fca2f270ac61d0f090ac54e52b371fdc839b63b0786dcb48a45cf486

    • SHA512

      4ae0a2fda76e7d985a81472e89d105f3a551c7aa3208ac9e09ede6b02bef38868592898ded6cfb4e06004c4fed12cfa667aa66fafef408da26e8bd51cb4e5601

    • SSDEEP

      98304:AudWDH3DdrTLhNpUcxh7EMEjzenIMERfDIX0jcOCuPLkxC44wCUOQx9zf0NYAG:NkDH3dhozenpuf/jWULkxCYbf0K5

    • Checks if the Android device is rooted.

    • Removes its main activity from the application launcher

    • Checks CPU information

      Checks CPU information which indicate if the system is an emulator.

    • Checks memory information

      Checks memory information which indicate if the system is an emulator.

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    • Queries information about running processes on the device

      Application may abuse the framework's APIs to collect information about running processes on the device.

    • Queries the mobile country code (MCC)

    • Registers a broadcast receiver at runtime (usually for listening for system events)

    • Acquires the wake lock

    • Checks if the internet connection is available

    • Reads information about phone network operator.

    • Schedules tasks to execute at a specified time

      Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

MITRE ATT&CK Mobile v15

Tasks