9e8e9ca25c8aa6e85ee5050900a9ada1b4319b6c83671cab424a2351a217ceb5

Sharing

Copy URL Twitter E-mail

General

Target
8e11332a948194fb3c1b912df52c4fcb_JaffaCakes118
Size 13.1MB
Sample240602-plgaascd61
SHA256 9e8e9ca25c8aa6e85ee5050900a9ada1b4319b6c83671cab424a2351a217ceb5
MD5 8e11332a948194fb3c1b912df52c4fcb
SHA1 d5f48122b4c6213c60e206d0fd1097c7ad8d228a
SHA512 5887216a021e2a51495ff96331a7a46bab49f8e83cdafbb3f7139452ada912df55c95e59a2d1d9d016edb9f67554286bc9af664b4d321404cef0d92a80c6b146
SSDEEP 196608:wKskm44TvCWhaPAn8c1YWOCnSfpH70/ZFBNNO1GeA6QVxiKUXlFc9l7biG2SFC5u:wKsR4CaPSQ56bBNNK3QiKUei7/G
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Targets

- Target
  8e11332a948194fb3c1b912df52c4fcb_JaffaCakes118
- Size 13.1MB
- SHA256 9e8e9ca25c8aa6e85ee5050900a9ada1b4319b6c83671cab424a2351a217ceb5
- MD5 8e11332a948194fb3c1b912df52c4fcb
- SHA1 d5f48122b4c6213c60e206d0fd1097c7ad8d228a
- SHA512 5887216a021e2a51495ff96331a7a46bab49f8e83cdafbb3f7139452ada912df55c95e59a2d1d9d016edb9f67554286bc9af664b4d321404cef0d92a80c6b146
- SSDEEP 196608:wKskm44TvCWhaPAn8c1YWOCnSfpH70/ZFBNNO1GeA6QVxiKUXlFc9l7biG2SFC5u:wKsR4CaPSQ56bBNNK3QiKUei7/G
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

banker collection discovery evasion impact persistence ransomware
- Checks if the Android device is rooted.
  evasion
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Checks CPU information
  Checks CPU information which indicate if the system is an emulator.
  evasion discovery
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Reads the contacts stored on the device.
  collection
- Reads the content of the call log.
  collection
- Registers a broadcast receiver at runtime (usually for listening for system events)
  persistence
- Checks if the internet connection is available
  discovery
- Requests cell location
  Uses Android APIs to to get current cell information.
  collection discovery
- Changes the wallpaper (common with ransomware activity)
  ransomware
behavioral1
- Target
  726.apk
- Size 447KB
- SHA256 a08e5e30930046518f72da24e4077b93b70e72011d9211729833f4b8fee691ef
- MD5 e11c9875ba71e9071aa10fc7dc8fb283
- SHA1 9e260f24076b708fc60a982037f444128efb41d0
- SHA512 d59a043b65e9a218928fcbdf4cbf139c860dd287e32594d7e73a9d7137be7d0fe8728b9667063b25b22e526b456d388d1e950bd99c5deb52a12935c370887d6a
- SSDEEP 6144:/hUow0zYsbsM4QJ0txCSCWVFS+RhXChP5d1ZmAdbD/xUanz6BG3n/nwoy6MODlC:/2l0zxbVNkzRHChP5/RxUy3n/FyAlC
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral2 behavioral3 behavioral4
- Target
  QRomCommand.jar
- Size 10KB
- SHA256 a2657b3767205a3971f807b2f2562d310435a28d24f35405d5c494af6ed5c6b0
- MD5 f48e13dc081feb8cd33b78a5004b7a54
- SHA1 422074c1584150bdfb42e3ffd6539ffce73a8001
- SHA512 c378d1b8688a42736bb94acbcc9047cb82bbb10aee9008baa583d82fc15f9ba76f6e5b8dfdf64930d7de3cfe58bb61bc934efd6191e78018fa4bcddece823463
- SSDEEP 192:jMQv0TgBlAsX2ABxwUzDc5ldMT/05j62xcUZXq6HF8ZxvkW6zEiGyq7:jqyuABrzDiMgJ6ChZXqHhkW6zEiGZ
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6 behavioral7
- Target
  lock_screen
- Size 20KB
- SHA256 ae2ea18bff78f50e480a96a90d704b7fd126c683480287d26a8123dfa0e6f585
- MD5 20d475f3acf21a2bf96d3e6b535a5104
- SHA1 3d4c57582a1d41ea803a2cbd862839af1043e730
- SHA512 4f6f2fd1ff6707387446b5e9dce664b3243af4bfd740c6bf927624eb2fb65dbc3abb2a75a323baaa64b5ba993c8c4071e08083d1d1b82734d6a4b63f154c3fb7
- SSDEEP 384:0xAuIGEoaSsiHkabGbPHAkI6EqVTv5SeYbga9JmpoNmnr:iIGWabGHA36JB5B8LO/r
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

impact privilege_escalation
- Tries to add a device administrator.
  privilege_escalation impact
behavioral10 behavioral8 behavioral9