048e9f8d47817336d1dd147f3c2472576600f7e59457455e406ff3f19110818e

Sharing

Copy URL Twitter E-mail

General

Target
908145d4321e78182b7cac31697e8a60_JaffaCakes118
Size 18.5MB
Sample240603-ewe5waba7s
SHA256 048e9f8d47817336d1dd147f3c2472576600f7e59457455e406ff3f19110818e
MD5 908145d4321e78182b7cac31697e8a60
SHA1 d310bc84dd7f385b8ff5af8aa42e26dd28e4e65a
SHA512 45f89a45978c5ea11e75197f530de98b6aafab08702ab9db8b6f954869861bb7d037fb07993bd6715c1164e6dd8faf88f29c99fad6dabd897c233e6fecdbdd1e
SSDEEP 393216:W5wiswqbO2HX7kNM5AUoHWFOZ+LS/9R7enrvpDHATurJa:3wd+X7iuWWFZLSrervpkTuFa
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Targets

- Target
  908145d4321e78182b7cac31697e8a60_JaffaCakes118
- Size 18.5MB
- SHA256 048e9f8d47817336d1dd147f3c2472576600f7e59457455e406ff3f19110818e
- MD5 908145d4321e78182b7cac31697e8a60
- SHA1 d310bc84dd7f385b8ff5af8aa42e26dd28e4e65a
- SHA512 45f89a45978c5ea11e75197f530de98b6aafab08702ab9db8b6f954869861bb7d037fb07993bd6715c1164e6dd8faf88f29c99fad6dabd897c233e6fecdbdd1e
- SSDEEP 393216:W5wiswqbO2HX7kNM5AUoHWFOZ+LS/9R7enrvpDHATurJa:3wd+X7iuWWFZLSrervpkTuFa
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery evasion impact persistence
- Checks CPU information
  Checks CPU information which indicate if the system is an emulator.
  evasion discovery
- Checks memory information
  Checks memory information which indicate if the system is an emulator.
  evasion discovery
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Queries the mobile country code (MCC)
  discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Registers a broadcast receiver at runtime (usually for listening for system events)
  persistence
- Requests dangerous framework permissions
behavioral1
- Target
  BannerPlugin-2.8.apk
- Size 53KB
- SHA256 324291e648daafc5a213e3535ee76e6ec9964f7d6c611d301eb671f53010d517
- MD5 848a0f6dee1f516e7ab7c03174370dbf
- SHA1 efc3ee3430b0636d09a870dd0f5b0046f2d3208e
- SHA512 5d154fa6eedabc9fc500c8b7645e780c5668789ded96599cffd2042fa1584c8913eb063e649c0d86e26496d57ac03180560328978c6661aebbacafd600c0b9c1
- SSDEEP 1536:ALBBgNeASxUC0nUk79YukilDb7aFYPduSq:AVZVk7D/7aFYYj
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral2 behavioral3 behavioral4
- Target
  CommonPlugin-4.4.apk
- Size 527KB
- SHA256 1bac6e3aa07a0fe1d29316d93dad4f3d82bf92f761971b61062a24a48296769a
- MD5 31b1c9c7bf5548dbcd03f35e01565b46
- SHA1 0c50f07520a40a0db28e6439d4386fad47ee1b8c
- SHA512 56ab20a59808a11a4a0c5408380a301d0887807262332671f3cec8fe8d5338f360edbdba7fa1f3c8d3007888706545927126266cb98713ee21017fafa2d999d7
- SSDEEP 12288:+Le2JLGMk3r0+YjD2aNc4zCUlOLNCJ4v7ZVetyke:oVGMIJYj6aCUlOUJg7ZVA1e
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6 behavioral7
- Target
  FrameworkPlugin-3.3.apk
- Size 18KB
- SHA256 47de5b649090505e1c7054bc3152b6b5f360fe90db35d2e32acfa2c5f7664ebd
- MD5 b5d09bda650ec2bfb081844aaef26650
- SHA1 d87a19cbf278b3e14309e9714aadc2b139cc3ddb
- SHA512 2e16d25e8ae1d6d39c11c6a81745c8b2b66efb4f10472ccb97dc02224a5dec6634ff1b682d93d5172f878c1c10ef5787e234b6995194da4c786f037ab77dc5a4
- SSDEEP 384:2UdBCUR0bRqX+X6Jjot8abgRMEafy6uiF9HjVM8lwM2O:5zlCOJJjv6pF9HjwbO
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10 behavioral8 behavioral9
- Target
  WelcomePlugin-3.0.apk
- Size 34KB
- SHA256 55c5682f6b1046c58d71239118e34ae39c478458077855ea138472fe15972db5
- MD5 53b5892acd6483e96ea19addcfe67da1
- SHA1 9225a1b634136a74852dc556f38adae3a9b98530
- SHA512 1bdd98905c1083aeab7f8170afbba375928b6d979425eb5a7823ebc496639380e677a4b4149cd9ff8e65cd1e1234074fc2b2770b1f956dcf30150e2f6b8549a3
- SSDEEP 768:D3rXFWLKxe7X+Fu9kpP7MD2BvdHxNcO6uv/jPk+EFg90oPp:D3bgLKxe7wumFMDQxSruXjM+E21R
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral11 behavioral12 behavioral13
- Target
  gdtadv2.jar
- Size 88KB
- SHA256 e365ac88dc01033ccf02fe965d5e1eee9044c4ca1a3d9d96085be6a427a5274a
- MD5 0586f3074966b353fe050ec4055ca09c
- SHA1 645839dc107ba400711b8f4d8e4495dc29ac8ee0
- SHA512 e76d878ec99c64cff35a11a5837237206bb02b1cc2d35ff2c0f03c72519bc19813138f54a6aca6c775b33de532a011dee7949ecddb7b57e4264380d70b81e4a5
- SSDEEP 1536:ZIyPme+AtVhpPhvh8Ba1e6Z5KgXJMfl24RnuFo398/FhluO4HyafAtQOz672r:9OefrzPhyh0KgXJ2l2nqt8/FhwfWQ1y
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral14 behavioral15 behavioral16

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Tasks

Sharing

General

Malware Config

Targets

Checks CPU information

Checks memory information

Loads dropped Dex/Jar

Queries information about running processes on the device

Queries information about the current Wi-Fi connection

Queries the mobile country code (MCC)

Queries the phone number (MSISDN for GSM devices)

Registers a broadcast receiver at runtime (usually for listening for system events)

Requests dangerous framework permissions

MITRE ATT&CK Mobile v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16