9cb27a45cd414dd4016f25d49fcf1223027c150e06ea254151afdda9ed80a553

Sharing

Copy URL Twitter E-mail

General

Target
b74d99ebe9af2cf9cc0f84f47fddb815_JaffaCakes118
Size 2.9MB
Sample240617-hxdvzstcmp
SHA256 9cb27a45cd414dd4016f25d49fcf1223027c150e06ea254151afdda9ed80a553
MD5 b74d99ebe9af2cf9cc0f84f47fddb815
SHA1 d081e4523b4f1eaa4fd2b07211b6b563745f5aaf
SHA512 6a6c899bafb2a76ef60085a6128918d28e17bd2469f649df5bcf7b0ac15ae1743e51765f9d976465064dc1e4342db8a55c0994f57cddf14cfad3e1c3fd35c926
SSDEEP 49152:yebEoRR/+UXgZNvxEDKJ84INrIQ7UDa6+We718RRvyyRvy0WrS:JEe+UsoKRINp+a6e18nJ0S
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Targets

- Target
  b74d99ebe9af2cf9cc0f84f47fddb815_JaffaCakes118
- Size 2.9MB
- SHA256 9cb27a45cd414dd4016f25d49fcf1223027c150e06ea254151afdda9ed80a553
- MD5 b74d99ebe9af2cf9cc0f84f47fddb815
- SHA1 d081e4523b4f1eaa4fd2b07211b6b563745f5aaf
- SHA512 6a6c899bafb2a76ef60085a6128918d28e17bd2469f649df5bcf7b0ac15ae1743e51765f9d976465064dc1e4342db8a55c0994f57cddf14cfad3e1c3fd35c926
- SSDEEP 49152:yebEoRR/+UXgZNvxEDKJ84INrIQ7UDa6+We718RRvyyRvy0WrS:JEe+UsoKRINp+a6e18nJ0S
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

banker collection discovery evasion persistence
- Checks if the Android device is rooted.
  evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Requests cell location
  Uses Android APIs to to get current cell location.
  collection discovery evasion
- Queries information about active data network
  discovery
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
behavioral1 behavioral2
- Target
  com.newpay.spsdk.smspay.zfmgsdk.apk
- Size 95KB
- SHA256 0d1300ee97decedb4a6dc4a0304779ba475153fc1185f39d92d2df4865416866
- MD5 25cdc4eb758d0a793c61da97a2c02a9f
- SHA1 dcaf1d357c8dd5e131b65d0eecfc509a93efdc1e
- SHA512 94bd124255b13fab7a20c14994666a4ddddc5c83890a01220db562225dadf7589377d01365840802dd5cc36b89a77a3dc8f9bd15067abed721f1b36b1cf89927
- SSDEEP 1536:uOioreFZ+v4Dx0XUvVBqCqG9UnLEFrzZF00AEOHlveECCNwl4iu+G8aAWDKsF9kQ:uPoreT+wDx0QAyrzZWA3CfRnjKckxuGQ
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral3 behavioral4 behavioral5
- Target
  com.skymobi.pay.plugin.main_v10015.pl
- Size 59KB
- SHA256 09a1eaa8ea5844ad9fa0cc8ac61848ad769d62bf90fa9b15d2aa21a9fc593413
- MD5 af3d9be42c31205f5c5835876219a080
- SHA1 94ee91f71c77d45efcbc3a5b41c1153b9eff2bf4
- SHA512 51903ef751775c31e4a1f5f1190deaee2d50c93d5e36968045c67e446c7545c1cb12f26575e9d741a258a5882fbe357ac1657f18b9eca995bd533700828eeff2
- SSDEEP 1536:+wSyx28ZQi8KwGltzgA4iPBUFOIWGpJj3CqgOwETU+gI9nuTk:+wnx//DwiSGgOW7Cz9yb9nuTk
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral6 behavioral7 behavioral8
- Target
  com.skymobi.pay.plugin.recordupload_v10009.pl
- Size 39KB
- SHA256 790966b840b1ddc049d87f682c83ce73aed0b3890e2d26e36b1ca390e0aad019
- MD5 389752c98285491ec0245b2e5cd41363
- SHA1 eb5130e959314cda0c762ddf8e19fe0a9a6c79d5
- SHA512 2b2de3ee7dc5dfe9574541373032f6355adede8ec5cd1ea5ab2a67849c1107fb4abdc98a08efdf9c8a9f5747dca291b475d64d75595404f4d0256a01e131a09a
- SSDEEP 768:GAuuiz2kmTfvaI3u3QKZTUeHHktBypJHajfMvN+ZPpiT63wCNcU5B:YyXd3uRRdJHB+ZRiTyv5B
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10 behavioral11 behavioral9
- Target
  com.skymobi.pay.plugin.smspay_v10039.pl
- Size 248KB
- SHA256 229dc2c46231d85e6b4298f7e6a067df9840c754d4b1440e2e9594f92d000040
- MD5 f7b9113f2220d0c9bafb01c3c1864e5e
- SHA1 40e8abb05c69f87a9e4e723885e6855d177c44e5
- SHA512 7342091212a23843a2d5d4d9ef18d3aeff8d3c27657f4ece882f0a90844c00ee6b6179de9c750c3050468ed3aaaff46c37f6b966110b65b22c59330d2f614756
- SSDEEP 6144:M5djDaCE+IKyOhmkHkj0cCTfT/YPoUt75p3KV8zaqqD1:AzE+aOfTOZtFxaDD1
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral12 behavioral13 behavioral14
- Target
  skymobi_pay_wxplugin.apk
- Size 33KB
- SHA256 6d6f22a6688689b35a723620794bc03e958a69e1770073bd921d3c6129733f26
- MD5 73d8a99bf9de4eb876f1739627197190
- SHA1 135f99fe90f129274c74f5c9b032294bfae3d05a
- SHA512 d5d9068f5fbf3c85bafb8edf084c40e4411814f02542cde120815951c6a2cfae78a0b08f930ef7143f10145ce0abcbd942c44f54afbb0d963ba47c653a162049
- SSDEEP 768:iwFX6Lei59coj/94ML6plol/S54bLhWQeJ:iwF0t5jj1/LMcaivhWQC
- MD5 SHA1 SHA512 SSDEEP
Score

4^/10

persistence
behavioral15 behavioral16 behavioral17
- Target
  unicom_resource.dat
- Size 64KB
- SHA256 4fcfe4f8c3e7cc3c4320e2a6a3dd3c20f47324f53243e93dd85ad95e387d92cf
- MD5 92196937fb04bc1bee22e106ea4cf28f
- SHA1 0c68a181eb63f1a6690e60dfd837b91eb17151a5
- SHA512 6cda00e6ebe4f6ade964ccab4db83c8363f2def0acd2dd744e1b0048cb5f32185fdfe75aa70d0df38ce1ce52d3d731848eece6f5626f826f891172433fdc8bd4
- SSDEEP 1536:aWDADrANWprK16KtyiRFtm8clagB/dcfziAWmk2CN:a13ANkxsFto4c/HT
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral18 behavioral19 behavioral20

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Execution Guardrails

T1627

Geofencing

T1627.001

Credential Access

Discovery

Location Tracking

T1430

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks if the Android device is rooted.

Loads dropped Dex/Jar

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Queries information about running processes on the device

Queries the phone number (MSISDN for GSM devices)

Requests cell location

Queries information about active data network

Queries information about the current Wi-Fi connection

MITRE ATT&CK Mobile v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20