deb9844db7bad12419f8e17251676d9995c3d30c5f1d021c343742b4b150090e

General

Target
945fe4c7efecb5bea5ef274af640cfd4_JaffaCakes118
Size 309KB
Sample240604-lrlv7acd5t
SHA256 deb9844db7bad12419f8e17251676d9995c3d30c5f1d021c343742b4b150090e
MD5 945fe4c7efecb5bea5ef274af640cfd4
SHA1 b882e5f03052e5d5e39aa8843b300d7c1bbd5e13
SHA512 ef1db08d5d9791502deb8ba6c7a4a7de446ad987cd930254663aa49aa22744380016a86c41bb9265acc646a5dd0d98ad3d99da461ab235a37168698fae24b8f4
SSDEEP 6144:gIpkpwKSqAMpL+37w8kUeV2zaCSqTMKGF5EnjeDBAnAmeU5gg7Qh9:gIpkChqNL+3Etb1WTBGFjqnhjz7QD
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Targets

- Target
  945fe4c7efecb5bea5ef274af640cfd4_JaffaCakes118
- Size 309KB
- SHA256 deb9844db7bad12419f8e17251676d9995c3d30c5f1d021c343742b4b150090e
- MD5 945fe4c7efecb5bea5ef274af640cfd4
- SHA1 b882e5f03052e5d5e39aa8843b300d7c1bbd5e13
- SHA512 ef1db08d5d9791502deb8ba6c7a4a7de446ad987cd930254663aa49aa22744380016a86c41bb9265acc646a5dd0d98ad3d99da461ab235a37168698fae24b8f4
- SSDEEP 6144:gIpkpwKSqAMpL+37w8kUeV2zaCSqTMKGF5EnjeDBAnAmeU5gg7Qh9:gIpkChqNL+3Etb1WTBGFjqnhjz7QD
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

collection credential_access discovery evasion execution persistence stealth trojan
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion credential_access
- Prevents application removal
  Application may abuse the framework's APIs to prevent removal.
  evasion
- Removes its main activity from the application launcher
  stealth trojan evasion
- Requests accessing notifications (often used to intercept notifications before users become aware).
  collection credential_access
- Makes use of the framework's foreground persistence service
  Application may abuse the framework's foreground service to continue running in the foreground.
  evasion persistence
- Queries the mobile country code (MCC)
  discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Registers a broadcast receiver at runtime (usually for listening for system events)
  persistence
- Requests enabling of the accessibility settings.
- Acquires the wake lock
- Checks if the internet connection is available
  discovery
- Reads information about phone network operator.
  discovery
- Requests disabling of battery optimizations (often used to enable hiding in the background).
  evasion
- Schedules tasks to execute at a specified time
  Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
  execution persistence
- Listens for changes in the sensor environment (might be used to detect emulation)
  evasion
behavioral1 behavioral2 behavioral3