General

  • Target

    ac56279bc1171ac7205701120f741871_JaffaCakes118

  • Size

    28.0MB

  • Sample

    240615-bejj7axcqq

  • MD5

    ac56279bc1171ac7205701120f741871

  • SHA1

    143db1e24fc672576a72b07b18a1395fa263721f

  • SHA256

    68c9e4e2f09588c8d5cd7c680188d7a972646439ddf21c094ef3b64c8641e599

  • SHA512

    6eabc981f36990df9fbcf607c2bfb38af5e3d20ab926ef6f70ea04a622e690536969fe714e00b2efa57bdf3673c14a13fea1bf1059f161cdead228d566e0fedb

  • SSDEEP

    786432:/1tF+w0BIg9Ibnd6dfwWCphTrP21LqGS+nKzRH2Z+ILyxJX:dt3sybd6lJCnxILyxx

Malware Config

Targets

    • Target

      ac56279bc1171ac7205701120f741871_JaffaCakes118

    • Size

      28.0MB

    • MD5

      ac56279bc1171ac7205701120f741871

    • SHA1

      143db1e24fc672576a72b07b18a1395fa263721f

    • SHA256

      68c9e4e2f09588c8d5cd7c680188d7a972646439ddf21c094ef3b64c8641e599

    • SHA512

      6eabc981f36990df9fbcf607c2bfb38af5e3d20ab926ef6f70ea04a622e690536969fe714e00b2efa57bdf3673c14a13fea1bf1059f161cdead228d566e0fedb

    • SSDEEP

      786432:/1tF+w0BIg9Ibnd6dfwWCphTrP21LqGS+nKzRH2Z+ILyxJX:dt3sybd6lJCnxILyxx

    • Checks if the Android device is rooted.

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Queries information about running processes on the device

      Application may abuse the framework's APIs to collect information about running processes on the device.

    • Queries the phone number (MSISDN for GSM devices)

    • Requests cell location

      Uses Android APIs to to get current cell location.

    • Domain associated with commercial stalkerware software, includes indicators from echap.eu.org

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Queries information about active data network

    • Queries information about the current Wi-Fi connection

      Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    • Queries the unique device ID (IMEI, MEID, IMSI)

    • Requests dangerous framework permissions

    • Listens for changes in the sensor environment (might be used to detect emulation)

    • Target

      mimo_asset.apk

    • Size

      390KB

    • MD5

      39692de7ff0848e54bf6ea1ce9ece672

    • SHA1

      bf6299d772f195bac724f738c49cdac0c538abe4

    • SHA256

      011c400d36773b3b475290c2d1af5a829c0597c24dfbb10e12222611a4e1300e

    • SHA512

      3ea7d8e4a85e1b8b7759984f817df7c65656d057e31b11ec1a970e79a99b775fca5e5f8ef942f99869a14b58a91c1a5838b5711ac33f915cf8f7f77280bcadc6

    • SSDEEP

      12288:hNx7RUQtEAQ5YXCA3xfDX2O9THkIMFsTTX5KOk5O:57RUQt35XCA3xz2O9TEJy3XIOkw

    Score
    1/10

MITRE ATT&CK Enterprise v15

MITRE ATT&CK Mobile v15

Tasks