b2de24b42811ba0a05d5e51cf45bce10ec8aff9a1e0a5834476d6a70ff4cd04d

General

Target

81028b67bd463375a732a0c77450f965_JaffaCakes118
Size

637KB
Sample

240529-rg4k5sgh41
MD5

81028b67bd463375a732a0c77450f965
SHA1

0ef62bdf7f8f31af8af6e7d9f69c946b2014ce67
SHA256

b2de24b42811ba0a05d5e51cf45bce10ec8aff9a1e0a5834476d6a70ff4cd04d
SHA512

5ce4f1c394e17735847b193e9034d89707735dd121350a6a36ec69cb0dc18d8322d86b90999678bfe9dd1dc28c5d239cfbc7fd3063102e78b253a642741ed706
SSDEEP

12288:B4L4oQI8Y0FotaKIUtrbMs1y/gfOdFskKkgeFxBMC794vvQe6ERylTgJ:doL0otaYtXM25OgkRfM4iydc

Score

8^/10

Malware Config

Targets

- Target
  
  81028b67bd463375a732a0c77450f965_JaffaCakes118
- Size
  
  637KB
- MD5
  
  81028b67bd463375a732a0c77450f965
- SHA1
  
  0ef62bdf7f8f31af8af6e7d9f69c946b2014ce67
- SHA256
  
  b2de24b42811ba0a05d5e51cf45bce10ec8aff9a1e0a5834476d6a70ff4cd04d
- SHA512
  
  5ce4f1c394e17735847b193e9034d89707735dd121350a6a36ec69cb0dc18d8322d86b90999678bfe9dd1dc28c5d239cfbc7fd3063102e78b253a642741ed706
- SSDEEP
  
  12288:B4L4oQI8Y0FotaKIUtrbMs1y/gfOdFskKkgeFxBMC794vvQe6ERylTgJ:doL0otaYtXM25OgkRfM4iydc
Score

8^/10

banker collection discovery evasion persistence stealth trojan
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Removes its main activity from the application launcher
  stealth trojan evasion
- Checks CPU information
  Checks CPU information which indicate if the system is an emulator.
  evasion discovery
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries account information for other applications stored on the device
  Application may abuse the framework's APIs to collect account information stored on the device.
  collection
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Registers a broadcast receiver at runtime (usually for listening for system events)
  persistence
- Checks if the internet connection is available
  discovery
- Domain associated with commercial stalkerware software, includes indicators from echap.eu.org
- Queries the unique device ID (IMEI, MEID, IMSI)
  discovery
- Reads information about phone network operator.
  discovery
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Targets

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Removes its main activity from the application launcher

Checks CPU information

Loads dropped Dex/Jar

Queries account information for other applications stored on the device

Queries information about running processes on the device

Queries information about the current Wi-Fi connection

Registers a broadcast receiver at runtime (usually for listening for system events)

Checks if the internet connection is available

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

Queries the unique device ID (IMEI, MEID, IMSI)

Reads information about phone network operator.

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

behavioral3