3d9ec591f829440da0051dd755ecbf326e6f03f83eb3d88c51a6b633cb31b572

General

Target
906a9b8b116d95971794bdfb1c44670d_JaffaCakes118
Size 16.8MB
Sample240603-d55lfsbc22
SHA256 3d9ec591f829440da0051dd755ecbf326e6f03f83eb3d88c51a6b633cb31b572
MD5 906a9b8b116d95971794bdfb1c44670d
SHA1 55d422dd1fe040e4edb89242789076e37778c797
SHA512 59dbd73d2517922cd7baa4dd9ad3e4a6621a467b5eafc8c68fe643f493f0d4143d9531d52c5f796ebd58f2e74b20a981a2320c6bf202efe707aaeee8e672b835
SSDEEP 393216:cHXa8UQ6gG3pxsCyyGjpoamTRpMXdmj+O0Vm7zSY9Nro5MYoFEET:cKUG3p2yGjpxuROXde+tVm7mY9BOkEET
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Targets

- Target
  906a9b8b116d95971794bdfb1c44670d_JaffaCakes118
- Size 16.8MB
- SHA256 3d9ec591f829440da0051dd755ecbf326e6f03f83eb3d88c51a6b633cb31b572
- MD5 906a9b8b116d95971794bdfb1c44670d
- SHA1 55d422dd1fe040e4edb89242789076e37778c797
- SHA512 59dbd73d2517922cd7baa4dd9ad3e4a6621a467b5eafc8c68fe643f493f0d4143d9531d52c5f796ebd58f2e74b20a981a2320c6bf202efe707aaeee8e672b835
- SSDEEP 393216:cHXa8UQ6gG3pxsCyyGjpoamTRpMXdmj+O0Vm7zSY9Nro5MYoFEET:cKUG3p2yGjpxuROXde+tVm7mY9BOkEET
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

banker collection discovery evasion persistence
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Requests cell location
  Uses Android APIs to to get current cell location.
  collection discovery evasion
- Checks CPU information
  Checks CPU information which indicate if the system is an emulator.
  evasion discovery
- Checks memory information
  Checks memory information which indicate if the system is an emulator.
  evasion discovery
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Queries information about the current nearby Wi-Fi networks
  Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
  discovery
- Registers a broadcast receiver at runtime (usually for listening for system events)
  persistence
- Acquires the wake lock
- Checks if the internet connection is available
  discovery
- Reads information about phone network operator.
  discovery
behavioral1
- Target
  AlipayMSP206_PPS3_V3.5.4.0619.apk
- Size 354KB
- SHA256 46f025d57f9aed1fb674c0fe8fc77add93cf00ea6e1633596955f33426be7688
- MD5 12ae4560d8350db4bd6fa3bc1589614c
- SHA1 dbbfce036a1823aaec9d1c7b621adbd7317f7fa9
- SHA512 df7348142a8c294d0d7f7ce77795fd0f81f60831ca1831164e5060c900aa90af430b11f6972103a5c6307d81d8cdf095105a9ab3d01c2183d10d01910976c6fd
- SSDEEP 6144:ipIlfloegHi/BBs3dWcfihtB7+Y3Ju4g29f5C8EcPK+WvyQcy2fn1E:ip2JgC/BBsNWfh3Vcc5CLE8Rcy2fn1E
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

collection discovery evasion
- Requests cell location
  Uses Android APIs to to get current cell location.
  collection discovery evasion
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Checks if the internet connection is available
  discovery
behavioral2