General
- Target a2f56380193098a50bf708e37afa485e_JaffaCakes118
- Size 30.4MB
- Sample240612-3lr9fsvglc
- SHA256 2b6bd2bcc06de25e402811a818dceeb5998f9730561d183572e3d92a47ae103d
- MD5 a2f56380193098a50bf708e37afa485e
- SHA1 c51b916bf4b3038dc3ff62f3476015c53fbef859
- SHA512 ec74b1d511892c1733313420445e3f030fabc2d962350db04076a4e073c8b763dc0943fadbae4fa1160a4fff62b87de394212971c81e10f5d2a9b4d9310d3fb8
- SSDEEP 786432:saOaDwLQMuMGJXXz47doy4frGOfCuTF1vxUm/qIC7RlVY:gaDwLQ/MOnZB0uBEm/a3C
- MD5 SHA1 SHA512 SSDEEP
Behavioral task
behavioral1
Sample
a2f56380193098a50bf708e37afa485e_JaffaCakes118.apk
Resource
android-x86-arm-20240611.1-en
Behavioral task
behavioral2
Sample
a2f56380193098a50bf708e37afa485e_JaffaCakes118.apk
Resource
android-x64-arm64-20240611.1-en
Behavioral task
behavioral3
Sample
amap_resource1_0_0.apk
Resource
android-x86-arm-20240611.1-en
Behavioral task
behavioral4
Sample
amap_resource1_0_0.apk
Resource
android-x64-20240611.1-en
Behavioral task
behavioral5
Sample
amap_resource1_0_0.apk
Resource
android-x64-arm64-20240611.1-en
Malware Config
Targets
-
- Target a2f56380193098a50bf708e37afa485e_JaffaCakes118
- Size 30.4MB
- SHA256 2b6bd2bcc06de25e402811a818dceeb5998f9730561d183572e3d92a47ae103d
- MD5 a2f56380193098a50bf708e37afa485e
- SHA1 c51b916bf4b3038dc3ff62f3476015c53fbef859
- SHA512 ec74b1d511892c1733313420445e3f030fabc2d962350db04076a4e073c8b763dc0943fadbae4fa1160a4fff62b87de394212971c81e10f5d2a9b4d9310d3fb8
- SSDEEP 786432:saOaDwLQMuMGJXXz47doy4frGOfCuTF1vxUm/qIC7RlVY:gaDwLQ/MOnZB0uBEm/a3C
- MD5 SHA1 SHA512 SSDEEP
Score8/10Checks if the Android device is rooted.
Checks known Qemu files.
Checks for known Qemu files that exist on Android virtual device images.
Checks known Qemu pipes.
Checks for known pipes used by the Android emulator to communicate with the host.
Queries information about running processes on the device
Application may abuse the framework's APIs to collect information about running processes on the device.
Queries information about active data network
Queries information about the current Wi-Fi connection
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
Reads information about phone network operator.
Listens for changes in the sensor environment (might be used to detect emulation)
-
- Target amap_resource1_0_0.png
- Size 24KB
- SHA256 fc0c21884d4edfa4d93282139a309f204b27271a111a5b158edbc048f730b461
- MD5 94a2a5f84a3fd6f0fd9134708ae1b81e
- SHA1 1e21afaa48ed86cb31aaf7b17c3514315364cc99
- SHA512 24a175d15cb5cf8d23f0d53b004ed5c9a47646129c816fcae1b46aedabd95bb2c6dd2958d39d6f98f36dec3cd55d6af2d9b8f7013ced4b37a30db566e9a44923
- SSDEEP 384:SevEWnTSCwukBdJ4dVCHyP7MPi3oqYXgnJk:3vEWnSue4+Sf3opQa
- MD5 SHA1 SHA512 SSDEEP
Score1/10
MITRE ATT&CK Mobile v15
Defense Evasion
Execution Guardrails
1Geofencing
1Hide Artifacts
1User Evasion
1Virtualization/Sandbox Evasion
4System Checks
4