15eb8a70f249e7e16ed859ef15536d19dc4454d14edc7e037d18f60c1eb011cb

Sharing

Copy URL

Twitter E-mail

General

Target

b06936b50bcda474fbcb2cd7da5e3b88_JaffaCakes118
Size

19.6MB
Sample

240615-2a5jzaxana
MD5

b06936b50bcda474fbcb2cd7da5e3b88
SHA1

803b0d810fcb4e96d808628b4e8daeaa0a6b73cb
SHA256

15eb8a70f249e7e16ed859ef15536d19dc4454d14edc7e037d18f60c1eb011cb
SHA512

4a09c05816b2b7e61fc44cf17a9f4d10cd2bad4acd729746f52c51df6eb29b7ce570863e41143ef71a97024f6cf5445ad263b096f86ddd6fe2278d6cb307e00a
SSDEEP

393216:KbgLvxuUzxhjRyg7hwVhSB4WIyD8sk1FP72P7oCaQX/+iN5TBnUpACZEG8gtlrtM:KbgLZB1b7ASB5ds1FP72DoCa6/PTBUAl

Score

8^/10

Malware Config

Targets

- Target
  
  b06936b50bcda474fbcb2cd7da5e3b88_JaffaCakes118
- Size
  
  19.6MB
- MD5
  
  b06936b50bcda474fbcb2cd7da5e3b88
- SHA1
  
  803b0d810fcb4e96d808628b4e8daeaa0a6b73cb
- SHA256
  
  15eb8a70f249e7e16ed859ef15536d19dc4454d14edc7e037d18f60c1eb011cb
- SHA512
  
  4a09c05816b2b7e61fc44cf17a9f4d10cd2bad4acd729746f52c51df6eb29b7ce570863e41143ef71a97024f6cf5445ad263b096f86ddd6fe2278d6cb307e00a
- SSDEEP
  
  393216:KbgLvxuUzxhjRyg7hwVhSB4WIyD8sk1FP72P7oCaQX/+iN5TBnUpACZEG8gtlrtM:KbgLZB1b7ASB5ds1FP72DoCa6/PTBUAl
Score

8^/10

collection discovery evasion impact persistence
- Checks if the Android device is rooted.
  evasion
- Checks Android system properties for emulator presence.
  evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries information about the current nearby Wi-Fi networks
  Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
  discovery
- Queries information about active data network
  discovery
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Queries the mobile country code (MCC)
  discovery
- Reads information about phone network operator.
  discovery
- Requests cell location
  Uses Android APIs to to get current cell information.
  collection discovery
behavioral1
- Target
  
  ZIPReader.jar
- Size
  
  34KB
- MD5
  
  a2fc8f81e6ff69a4e396041f2a494a74
- SHA1
  
  ca8fedfd182e1ac1f088a8d31248133bd692064e
- SHA256
  
  3909ffc26db090e69bdbc947d692f27c8b2c30110fb2e8b35d879c92d8d4c890
- SHA512
  
  6b6460aec5822e80c12702d5e4a07b4f0b61b434487d946d2be15916fefaf09124666f7c9035c9c2f5c72e9c799d87f62621e62e70e15b0a04c61b5a52ea6116
- SSDEEP
  
  768:nwsYfPny019Zj5bGXcnHYzW3DSe0VVY/WVmw7wO1:wn9ZVb0CYzcaxmyv1
Score

1^/10
behavioral2 behavioral3 behavioral4
- Target
  
  beacon_dynamic.jar
- Size
  
  104KB
- MD5
  
  fffee01fa41f95a2963feb95001120b9
- SHA1
  
  f69a6d6a36fb0c538db796a877003a37a36249cd
- SHA256
  
  f15e5ca0b6c58014cde75ea44a90e8038bdd1224126e8fcaf60147f5aae37b00
- SHA512
  
  0b0b6cdf502c1fd2328022c9fc0e835a21e66c468feeed919ed188ba71bcb911665d5d41a28fbab982c38aaf46fdbe17c13de7f34050b8be175e5d6bc1cc9476
- SSDEEP
  
  3072:N5bJnFR/s9fK/WJPV1WWi4nrU45Y7E4ZtI2xxZ:N5hT/8JPumH58dI2N
Score

1^/10
behavioral5 behavioral6 behavioral7
- Target
  
  com.tencent.mtt.filemgr.jar
- Size
  
  123KB
- MD5
  
  859ccaa280d24c243e9a5ce079fdc991
- SHA1
  
  73caf4fb79baf5d7620c69b9f19820969930feeb
- SHA256
  
  6d17f2b0a44241ee816392e777f4c3610f1cb610060e8d7b70c634688c71eef7
- SHA512
  
  fb62676c6baaa92228296fa292c2c79d2ab39765cf22a6f7926e95426811011d70ee320e124d50dbf4d3fcebeffd5134fa77430cd8867fb2f6f398b121f6bc1e
- SSDEEP
  
  3072:4uv6vsQ3cuBg9J4xV9aZq5dECUtWncX/o8//65:44zQ3lxVAF3sqv//Y
Score

1^/10
behavioral10 behavioral8 behavioral9
- Target
  
  com.tencent.mtt.market.jar
- Size
  
  131KB
- MD5
  
  a99aee9d0c14ad1f18b84775b4a24e6e
- SHA1
  
  0e813d27a7059a8d5858cc6f6ea81e63dbc9e88b
- SHA256
  
  fd5b60b2709a1e880b3d633da4a7f06c797b75fe90e1fce7cbced26cd8b69142
- SHA512
  
  7fd4f7fb7aaab59ebdfc01ce8cb7f2fbac3b8452bfbb8ff3f763f35944421a271d2f072e9c5503f4f1da83e0b95f6d9c8f2f43bbfb34aa6a0eddd756dcd4b217
- SSDEEP
  
  3072:M7ISTdJEOtxdsBzWo+poyaXDekWsuWAUO+m20WCPg:Oxruqo+KyayRTWpWg
Score

1^/10
behavioral11 behavioral12 behavioral13
- Target
  
  com.tencent.mtt.myvideo.jar
- Size
  
  77KB
- MD5
  
  a8cf588e44847ca2929fd7b40ca84932
- SHA1
  
  3d84c545aa8a2632aaf66efe1e7587c52c3b9b46
- SHA256
  
  79853adeaf46419c822154e09f36c1ccbb1325375496d9d47289238ac7ea0b8b
- SHA512
  
  dbb9fa59a8b4760d882973a1ad23f5e4de230e8b4daaf88a182de4166d7ecd127a61fe377193a32e1b2a6ae1c5951098760d2554525a491e0aa462ab5a57174f
- SSDEEP
  
  1536:EPShimrYKE9bUmzXwEb08iA0DxVHn4J4kEJ/nVezDU1r+lxjEz0:g9bvBbzz+4J4D8zDU1edF
Score

1^/10
behavioral14 behavioral15 behavioral16
- Target
  
  com.tencent.mtt.novel.jar
- Size
  
  307KB
- MD5
  
  5dced4633d854cff9d912fe87df6827f
- SHA1
  
  df637c117e222b5347226d34ccae8f667b55bfff
- SHA256
  
  2b081647831630f129d47e4d09b46b97d7d46f97c43efe7e2af723b9fa88b4f1
- SHA512
  
  b817127a2acecd1bce5f7a7652ea1d38a925a7b80bdbbcfa9cbdf3daf7022a8580387cf0d7ffd11ead19dfa9d2b1fd6aff83168b71fcbccd17667fa6d54b6513
- SSDEEP
  
  6144:4rFhanmRL1wXo6xjSZn0kv3ZPCW8Sa0De/BNS9Z0t6nMru:z8L18xjgn0kxPljc/fSgt2R
Score

1^/10
behavioral17 behavioral18 behavioral19
- Target
  
  com.tencent.mtt.pagetoolbox.jar
- Size
  
  16KB
- MD5
  
  734e223d060272b07b20af03104a772a
- SHA1
  
  e959122bb666784fa74daf719f9d81e7c1e4f0cb
- SHA256
  
  b0aff98782412dbcc79886862d076ff880311441d042d934c8199324096a986a
- SHA512
  
  c4b72bd759b16bc35b006712b8e51174a587c76f65d74c537d48173bc21e95c326eb5025f8f1d4774d5048637d25d8aaf46e6a54b4cf5eefc95750736db04afb
- SSDEEP
  
  384:KsFxf1xDOg1djgwCKFhd6rXyVw88LlaNgwbUPaYGo7pJli:JxTj1jOrXYwjLlaReJs
Score

1^/10
behavioral20 behavioral21 behavioral22
- Target
  
  com.tencent.mtt.qbgame.jar
- Size
  
  153KB
- MD5
  
  2e288aa06aae616a94bdcbf9a9f8f767
- SHA1
  
  3b6f0045850a36286324980c38dc88a0b6a50e7b
- SHA256
  
  c0ad163884826fbc005b73393ccc5e781ba87120dc1a5d17c048714b7fe25acc
- SHA512
  
  62a8770396ffa2880678b01cfead011d7ae5c6e3d00d280e36740b99f8e74f1e5bf379969c414ac019a500b7bc83c44b63f9df47f3268545f8b0b2b3c1ebbe45
- SSDEEP
  
  3072:7GCAs6ah/zCzABnmNugEqtM1KsffvVbaztg0FDsZRu+TWZ:7P1/zGtNutK6vVyzZJZ
Score

1^/10
behavioral23 behavioral24 behavioral25
- Target
  
  com.tencent.mtt.qrcode.jar
- Size
  
  53KB
- MD5
  
  fac44221b666f21af6041fec5e0ca933
- SHA1
  
  140015fb464259730f30f575c2d15fbe4e35fd45
- SHA256
  
  f1165ea989e5acba6d617806251189b670357e5b782ecf082471a9023f1ac9ef
- SHA512
  
  2566be1be234a16ffe6f152a1e00f8da00b4f39ad2a289b29518aeb96b638b28b42ae77ce63f4b6ff9929037a893c91b5d7755a409a2c5aee4ac6e0a91ec4baa
- SSDEEP
  
  1536:LsipdoTJmBPICMdSWmo20UGllQqFgfnDIbGzFG342AE:oipdWmB0m6UGoqqvsbmGoy
Score

1^/10
behavioral26 behavioral27 behavioral28
- Target
  
  com.tencent.mtt.read.jar
- Size
  
  64KB
- MD5
  
  da8cfbf943c3c6e4807442e33275edbd
- SHA1
  
  c9993eda5c45447510f546b0d2d1164aea30c624
- SHA256
  
  5819f0741c7dd89cf803503299f56c66e2a238b98835b74696e08ae0669ea1ee
- SHA512
  
  8f20dec04cfbd049d015431916e63c4e2fe80ed37ba10b61d83f314e76b2d03a343833960300e0319eca1fd4fe86417d2135d2828c7d870595cf01d45208dee9
- SSDEEP
  
  1536:dqplH/a5xPGTTVLIgSE40rZOWHR2t15+eHXWhg8+:0pJ/KGTV1SE4qt2z5S65
Score

1^/10
behavioral29 behavioral30 behavioral31
- Target
  
  com.tencent.mtt.setting.jar
- Size
  
  89KB
- MD5
  
  1d3cd9b307d5f685910809a2ce66203f
- SHA1
  
  ed1a99e6a6a299180eb278268e35cc4f329bc52e
- SHA256
  
  09050cb453e49fe8ca6f194e508f2faf316ed54a2ff03e085993f26f3d1ceaf7
- SHA512
  
  116e76374ac5284aee11f89ddb58e14f8374028facd746a37607158312168f892f58a480a7678bd69159643948b0df3ee5633ab752f7550a621181758ee05a50
- SSDEEP
  
  1536:ddDo223+GLpHpUXvGCIWYWZ6mbba5HeQZTDTdBlVmFZViY7JfBt4GSdH:dN5s8/GCq3mbba5BZHjlEDVp7JfL4zdH
Score

1^/10
behavioral32

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Tasks

Sharing

General

Malware Config

Targets

Checks if the Android device is rooted.

Checks Android system properties for emulator presence.

Loads dropped Dex/Jar

Queries information about running processes on the device

Queries information about the current nearby Wi-Fi networks

Queries information about active data network

Queries information about the current Wi-Fi connection

Queries the mobile country code (MCC)

Reads information about phone network operator.

Requests cell location

MITRE ATT&CK Mobile v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32