Overview

overview

10

Static

static

6

93d5a3d311...18.apk

android-9-x86

10

93d5a3d311...18.apk

android-10-x64

10

93d5a3d311...18.apk

android-11-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    93d5a3d3115b514fedf7eac4b3e7f798_JaffaCakes118
  • Size 2.4MB
  • Sample240813-ts6wraydlm
  • SHA256 784d7899e33b6cb229556dd19d2aa8090df59c8441e520c6c1d5f648ace2a55f
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
hydraandroidbankercollectioncredential_accessdiscoveryevasioninfostealerpersistencestealthtrojan

Malware Config

Targets

    • Target
      93d5a3d3115b514fedf7eac4b3e7f798_JaffaCakes118
    • Size 2.4MB
    • SHA256 784d7899e33b6cb229556dd19d2aa8090df59c8441e520c6c1d5f648ace2a55f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    hydrabankercollectioncredential_accessdiscoveryevasioninfostealerpersistencestealthtrojan

    • Hydra

      Android banker and info stealer.

      bankertrojaninfostealerhydra

    • Removes its main activity from the application launcher

      stealthtrojanevasion

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

      evasion

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

      collectionevasioncredential_access

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Queries information about active data network

      discovery

    • Queries the mobile country code (MCC)

      discovery

    • Reads information about phone network operator.

      discovery

    • Requests enabling of the accessibility settings.

    behavioral1behavioral2behavioral3

MITRE ATT&CK Mobile v15

Tasks