General

  • Target

    8be15230c11d67b8d2cc82e6f7741d3f_JaffaCakes118

  • Size

    4.3MB

  • Sample

    240601-1kdzbsge24

  • MD5

    8be15230c11d67b8d2cc82e6f7741d3f

  • SHA1

    824a27cf1f7105c17f57145275be5e3af6db3b88

  • SHA256

    53c4db9f4e28b6b01465ec9ab52061c7c221ce77671daab5206ab90673763278

  • SHA512

    90af29c00a8378bf2d8995d6a6342100457962f57283b637e83c67dcd0b5eeeaec618832517aac8c20d5842d6cf1599de0d1c0f6e36a357f8e7dd81f218abec3

  • SSDEEP

    98304:mQvsTDSI9S3a/tE/oo3yxyaf80zGijojJXwnqMV8L3/Bbc19/nMV8L3/Bbc19/tG:mXDSI9S3a1eR3yka00zGhFL3p29/BL3t

Malware Config

Targets

    • Target

      8be15230c11d67b8d2cc82e6f7741d3f_JaffaCakes118

    • Size

      4.3MB

    • MD5

      8be15230c11d67b8d2cc82e6f7741d3f

    • SHA1

      824a27cf1f7105c17f57145275be5e3af6db3b88

    • SHA256

      53c4db9f4e28b6b01465ec9ab52061c7c221ce77671daab5206ab90673763278

    • SHA512

      90af29c00a8378bf2d8995d6a6342100457962f57283b637e83c67dcd0b5eeeaec618832517aac8c20d5842d6cf1599de0d1c0f6e36a357f8e7dd81f218abec3

    • SSDEEP

      98304:mQvsTDSI9S3a/tE/oo3yxyaf80zGijojJXwnqMV8L3/Bbc19/nMV8L3/Bbc19/tG:mXDSI9S3a1eR3yka00zGhFL3p29/BL3t

    • Checks CPU information

      Checks CPU information which indicate if the system is an emulator.

    • Checks memory information

      Checks memory information which indicate if the system is an emulator.

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    • Queries information about running processes on the device

      Application may abuse the framework's APIs to collect information about running processes on the device.

    • Queries information about the current Wi-Fi connection

      Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    • Queries the mobile country code (MCC)

    • Registers a broadcast receiver at runtime (usually for listening for system events)

    • Checks if the internet connection is available

    • Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

    • Queries the unique device ID (IMEI, MEID, IMSI)

    • Reads information about phone network operator.

MITRE ATT&CK Mobile v15

Tasks