General

  • Target

    994516361c74fa2fe8fbd288389f8515_JaffaCakes118

  • Size

    21.2MB

  • Sample

    240605-z4haesae48

  • MD5

    994516361c74fa2fe8fbd288389f8515

  • SHA1

    2200f40c6194c2d98752ac3b34eb311cf22b1230

  • SHA256

    08f03aab941318373206e93abc4e15b877a5c92a098aebc2109d4d7dd5580eff

  • SHA512

    96294d14a02388669ae37ecc50c163018e3c8a8b51c604b78d6a39c76911a92490c05068f3596f7eb793e8f7aec5c4e628252abfd2b22a540b2879dfb37af79c

  • SSDEEP

    393216:cQJi41l05evALAjxG2Pj7QnUYcEdF+TZiUUkPZ80FqByX:9Ji49vAEr7IUYcEdFy46PZ80F2yX

Malware Config

Targets

    • Target

      994516361c74fa2fe8fbd288389f8515_JaffaCakes118

    • Size

      21.2MB

    • MD5

      994516361c74fa2fe8fbd288389f8515

    • SHA1

      2200f40c6194c2d98752ac3b34eb311cf22b1230

    • SHA256

      08f03aab941318373206e93abc4e15b877a5c92a098aebc2109d4d7dd5580eff

    • SHA512

      96294d14a02388669ae37ecc50c163018e3c8a8b51c604b78d6a39c76911a92490c05068f3596f7eb793e8f7aec5c4e628252abfd2b22a540b2879dfb37af79c

    • SSDEEP

      393216:cQJi41l05evALAjxG2Pj7QnUYcEdF+TZiUUkPZ80FqByX:9Ji49vAEr7IUYcEdFy46PZ80F2yX

    • Checks if the Android device is rooted.

    • Checks Android system properties for emulator presence.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

    • Queries information about active data network

    • Queries information about the current Wi-Fi connection

      Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    • Queries the mobile country code (MCC)

    • Reads information about phone network operator.

    • Listens for changes in the sensor environment (might be used to detect emulation)

MITRE ATT&CK Mobile v15

Tasks