Analysis
- max time kernel
36s - max time network
184s - platform
android_x64 - resource
android-x64-20240624-en - resource tags
- submitted
09/07/2024, 00:30
General
- Target 2e611c42b6a47f535bf832b054ada8d7_JaffaCakes118.apk
- Size 204KB
- Sample240709-atmdyszalc
- SHA256 61f9b09905c02759518c50a662d7391297c24fecff9420ffd9a070497e9e1985
Score
8/10
Malware Config
Signatures
- Removes its main activity from the application launcher 1 TTPs 1 IoCs
- Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
- Queries the phone number (MSISDN for GSM devices) 1 TTPs
- Acquires the wake lock 1 IoCs
- Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
- Queries information about active data network 1 TTPs 1 IoCs
- Queries the mobile country code (MCC) 1 TTPs 1 IoCs
- Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
Processes
-
wocwvy.czyxoxmbauu.slsa1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Queries the mobile country code (MCC)
- Listens for changes in the sensor environment (might be used to detect emulation)