619f998d8571e7300c6b54d4e5e9f96a8ed1f2b7dd3eda50df348bb6b701ba75

Sharing

Copy URL Twitter E-mail

General

Target

a3e1694ca91705db999da192d4e01981_JaffaCakes118
Size

26.7MB
Sample

240613-fhlk6sycqq
MD5

a3e1694ca91705db999da192d4e01981
SHA1

a3edab3db56aaec917dca7bdaf6dd3b6d86a6dc9
SHA256

619f998d8571e7300c6b54d4e5e9f96a8ed1f2b7dd3eda50df348bb6b701ba75
SHA512

3ad58e51c1d557a3975df919c957d878e180017e2cbe0a3ab2ce4bb65515668f6f86cb6d53de000e96b4c502290835bb8cb0706f0f5a1d4b32eb5ce96f17d993
SSDEEP

786432:av2TFG7aBw7IKiD2sKo6DGbNBg7TaRra781YreLIGCrB:BBKa27Nno6CMTAa78oeLIGCd

Score

8^/10

Malware Config

Targets

- Target
  
  a3e1694ca91705db999da192d4e01981_JaffaCakes118
- Size
  
  26.7MB
- MD5
  
  a3e1694ca91705db999da192d4e01981
- SHA1
  
  a3edab3db56aaec917dca7bdaf6dd3b6d86a6dc9
- SHA256
  
  619f998d8571e7300c6b54d4e5e9f96a8ed1f2b7dd3eda50df348bb6b701ba75
- SHA512
  
  3ad58e51c1d557a3975df919c957d878e180017e2cbe0a3ab2ce4bb65515668f6f86cb6d53de000e96b4c502290835bb8cb0706f0f5a1d4b32eb5ce96f17d993
- SSDEEP
  
  786432:av2TFG7aBw7IKiD2sKo6DGbNBg7TaRra781YreLIGCrB:BBKa27Nno6CMTAa78oeLIGCd
Score

8^/10

collection discovery evasion impact persistence
- Checks if the Android device is rooted.
  evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries information about the current nearby Wi-Fi networks
  Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
  discovery
- Requests cell location
  Uses Android APIs to to get current cell location.
  collection discovery evasion
- Queries information about active data network
  discovery
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Queries the unique device ID (IMEI, MEID, IMSI)
  discovery
- Reads information about phone network operator.
  discovery
- Listens for changes in the sensor environment (might be used to detect emulation)
  evasion
behavioral1
- Target
  
  adpsdk.apk
- Size
  
  30KB
- MD5
  
  a70e38de7f4632734e191a8f6dede493
- SHA1
  
  be11a122ac973e2d0cc24237af55605ea76a0330
- SHA256
  
  98c7e6b430330578aaf1370f541e03487428d675059bd2339eb0b8bc6099bfe6
- SHA512
  
  9be2bc0c4a81eb2f2645ee362c7038f0ea8723a295d9d92db13950c2b5acf6ad45dc5ca5391a7bf63a38f318df2755ad86d8981a4fe25c8b89159b66e5a7a602
- SSDEEP
  
  768:dRjM2Ubi5z0pgRkYGVBDu14z5yERTxa538tCAkO7A6mrA:TMf4z2UkY0aC2MtCbO7AprA
Score

1^/10
behavioral2 behavioral3 behavioral4
- Target
  
  cn.sirius.adpsdk.loader.apk
- Size
  
  1.2MB
- MD5
  
  4de6b0dec7c2c2c5fad77effbe394762
- SHA1
  
  c340d93315c63849b4163e27469aa3d604931fa9
- SHA256
  
  a66b41df8e7ff734d58cf2d4118ccbec75327b5dcb0e39b8605e1059bcec3d96
- SHA512
  
  5871aa5fd06e455318386ddeed2a58dc3c423112d230e4147e1c7fadf6cb639cf27672f03e7b256fa64d0543c575ef18503b204ea04672a131e08eaad0386240
- SSDEEP
  
  24576:VCFpxfSqY1IdRgRS3M3TvCNvNuZUMzmk3kXyRTeeJTUaR8qPei:VCFffSqAIdiRS3YTv88Zz6JXQeiCqPei
Score

1^/10
behavioral5 behavioral6 behavioral7
- Target
  
  cn.uc.gamesdk.loader.apk
- Size
  
  2.3MB
- MD5
  
  35406b0ab3a51683e02deaa0412c7fe1
- SHA1
  
  b879e851b3f032a26c03b376b04ed5c1ec29d569
- SHA256
  
  13cc40f0ce40368f22a92afbe5ed8459d19c4cf1bf33a69b7a050053241e4c34
- SHA512
  
  a2ce81bf27642e59ab7c874a268c2695b44df073d3b59552334d3d3b539b232dbe7f5eb46d9861bda7f25ec11ae1b615d716df079048c1cb7493931ee2af8914
- SSDEEP
  
  49152:OuqUqQUY+bcgBGcI0dm0Rr1nbg0yvV1wLk5rIRaf3Q8yrhbtxm+cH9:l1C/BGcIeLnbgFwura+fyrhbgH9
Score

1^/10
behavioral10 behavioral8 behavioral9
- Target
  
  libcn.uc.gamesdk.account.so
- Size
  
  371KB
- MD5
  
  74742670eaba3a15fcb1d156337b7520
- SHA1
  
  ef798181cb3c438578554d519462c600a53df51b
- SHA256
  
  376601eeeefdd0ba35766500552c8c3b6ce58f55092ab6d8e6a89c3b58e2d6f4
- SHA512
  
  ff45d277dfcbfd7c49b6659d5a38437440f99c9bdd3558611f90d70aa74e7cf8563c783266bb7baf56c5560906bf2d3039594de04877fb2d6c10a7cf0df3e0e4
- SSDEEP
  
  6144:i7xdArxSnZacXsIq1sgVQo5Zd+xQmsLhdhabvTeAwd3As3/L406pxH8:i7xwIZjsIq1s/Yd+TsLSvTeAwiA/c0KS
Score

1^/10
behavioral11 behavioral12 behavioral13
- Target
  
  libcn.uc.gamesdk.sa.plugin.core.so
- Size
  
  197KB
- MD5
  
  8c143ea400387c46ccfeae52ac7d8463
- SHA1
  
  96663bcb27878321b7f9bba4045110e5461bcb83
- SHA256
  
  345e72453bd46267bfa76db7c94ee7f24a4666a725305acf666cdf213d38b351
- SHA512
  
  d314ef8d9eee43b5847bc14081dd6c57eb52f00c6d936b69c0994698f785ca27dcce44d08d9b9d2cf5874d145bc3b1f8176fde7a9d216bfbc4cc8875211e6dd8
- SSDEEP
  
  3072:XSccBNJC39LT3H5zlRvlf9RBOg5q1WXBP62EctrAr/d:CccBNJC39331df93rc8ud
Score

1^/10
behavioral14 behavioral15 behavioral16
- Target
  
  libcn.uc.gamesdk.sa.plugin.floater.so
- Size
  
  487KB
- MD5
  
  6738fefdf20b2159760154d90cfad470
- SHA1
  
  27c1e604d7faaf7192a89b064c379bb07be413e5
- SHA256
  
  fadbfe40ca11a4d5e0a91cf406cac9424e00100d924a46384a7bf1db302f2e2e
- SHA512
  
  3eaaf2a218568b0325589af64e255c8316e90dda1d2f1c45c73230cc17c35d84564e56dac8b263d5092fb0676adec655aca28a888987378de4217dc5077ce626
- SSDEEP
  
  6144:IWaRGbHegBx1BpaMJ0H7BcEZlGlSoS4dhbuPzrDi+8GaeEKbMwE11tVdwG:IWaEBJXaMWbBpZclSlb2+gHKbMwEmG
Score

1^/10
behavioral17 behavioral18 behavioral19
- Target
  
  libcn.uc.gamesdk.sa.plugin.init.so
- Size
  
  174KB
- MD5
  
  224cb9a48f5995e9d0bc460d53a2ef9b
- SHA1
  
  a6edf96f2a080ba2e71256b7fa8fd61a1189279f
- SHA256
  
  cb8e2e029402536dcea1eb74178c7700678758649350822b81a39b86f1f68717
- SHA512
  
  717e4b0741e2121feb23ff4eb6ca1f3934970fd0bede5b75ac34ec79ccd214205db44f856d32be331940739ad7cc755f7d4c38489f92b01c0899dea36eea0f39
- SSDEEP
  
  3072:p2Ys9oMFGzYV6U+Cric2nfZ4cb3CBVjRMl9oHHNkKLJOS/puHYByDyFX:pHs9pFEYVNJh2h4CueoHHNFhzyCX
Score

1^/10
behavioral20 behavioral21 behavioral22
- Target
  
  libcn.uc.gamesdk.sa.plugin.msg.so
- Size
  
  144KB
- MD5
  
  49491487866855c1aced3d0fe16587fc
- SHA1
  
  00baed114a1d72976585c13c66783fe750e9cf00
- SHA256
  
  2bc0ad0fa4989f46e18b6f58eda5a78f915e638abe86a65e3d0cf3432f074d09
- SHA512
  
  91b70e4c77603ceae926cf8f7ffe83797c17b06719fdd74fd7d271ecb2cc5e939c6139e145d1fcff680b037044fdd14db07009c0c4b79efac71956787611bfe1
- SSDEEP
  
  3072:saYQVLWJWExJCJU/lrAfSqR6SugGYYbpbTmYzN4JxP:8Q7cJF26SVGlTNqxP
Score

1^/10
behavioral23 behavioral24 behavioral25
- Target
  
  libcn.uc.gamesdk.sa.plugin.pay.so
- Size
  
  11KB
- MD5
  
  dbf215c7dc407221280290f568efed1e
- SHA1
  
  8de107d1c18dab99d0d9e8a91ee505900d790195
- SHA256
  
  ee2145cf0242ad10d5c4edeaaf49a8e2d22e27a0e40f4a7e278544c54948f5b0
- SHA512
  
  45bfb95e76ff357dd172bd7f0d7406194c57bca13ea6d45baf1a24752f88c0810cc6e06ba6b73df03221c245af9f273b684884e25f6dbe137420d654143e31cc
- SSDEEP
  
  192:GaXt6NTj3H7fh97gLSof8eyMRSutxuzjU4vG9coOC5kCUSX2NQz+wa6lrbkAyYoH:fUNHtZgLff+8SiQzQ4OmAyCUsjz+W9Ql
Score

1^/10
behavioral26 behavioral27 behavioral28
- Target
  
  libcn.uc.gamesdk.sa.plugin.update.so
- Size
  
  18KB
- MD5
  
  4bdf431e38a4fc545aee0a7b5c3c4e1f
- SHA1
  
  3276c07d12fb3c46d14d3ff7fa40e1fbd4ff8242
- SHA256
  
  f2ee261dd157c6fce555581a3dd597d790b2907bebe3b09e675c6e464c9e4086
- SHA512
  
  a9777231b8a405009752006921470936b949466d18f0c47a86a4b7bfa6dd6512f353d40ccbbd134ad837cd5054aa24e08ebd134fa6c70c996c12ea569b0670d7
- SSDEEP
  
  384:L0h5UrzUXvnOHQQVjUl8dGBQ5DEPZvahLVInsefGcZKt59bbrYe7Jq:wh5UnOOHQwjS8dGBQ5EdsOLXemp
Score

1^/10
behavioral29 behavioral30 behavioral31
- Target
  
  ucsdk.apk
- Size
  
  30KB
- MD5
  
  3676be0cda042f75f4909fe7ef924516
- SHA1
  
  0c189e4ba001501a986c0bf6661b8c3e173380a6
- SHA256
  
  3a2199218dc8d205146e574d78860c2e9eb1b6a78a4a1da8fb4766df5968144c
- SHA512
  
  40c42af78489da6d7be501091a1241967cabf0b8314ca3ece666c48bc7af92eebe692cf2eb97b8980bd361b80ce99c18124297a7745437c0b63633f2dfb69abb
- SSDEEP
  
  768:PEY3HUY5Opbi3uMpQQtJ3OW9DwWdQik9sIRBKxy:DuOFP+W9wWdyuJxy
Score

1^/10
behavioral32

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Execution Guardrails

T1627

Geofencing

T1627.001

Hide Artifacts

T1628

User Evasion

T1628.002

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Tasks

Sharing

General

Malware Config

Targets

Checks if the Android device is rooted.

Loads dropped Dex/Jar

Queries information about running processes on the device

Queries information about the current nearby Wi-Fi networks

Requests cell location

Queries information about active data network

Queries information about the current Wi-Fi connection

Queries the unique device ID (IMEI, MEID, IMSI)

Reads information about phone network operator.

Listens for changes in the sensor environment (might be used to detect emulation)

MITRE ATT&CK Mobile v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32