cb4c4366780dd0c8f1723a77c911ca72dc5f921cf215fc9ffc60a6b18b357387 | Triage

Sharing

General

Target

d2a5238060219037c3728de9f4304d82_JaffaCakes118
Size

788KB
Sample

240907-xvbp6szcpm
MD5

d2a5238060219037c3728de9f4304d82
SHA1

4c7b1a0a091873d8999a5e20b469c89005d46259
SHA256

cb4c4366780dd0c8f1723a77c911ca72dc5f921cf215fc9ffc60a6b18b357387
SHA512

ed0946321ebbe56eb8affdc6cb6ec5bb2f705a1aaed3c2f06ca20776c90864ba02c6de2c6dbaaf07d4ef456cae05943c8379ed88db3546ccfc0d75e89e47ec22
SSDEEP

24576:sQEaFmFN9v46flHtIxo+8lqBtYRNX4Ex7s9N:sQEaFmL9Ac/YB68YsH

Score

8^/10

android banker collection credential_access discovery evasion impact persistence stealth trojan

Malware Config

Targets

- Target
  
  d2a5238060219037c3728de9f4304d82_JaffaCakes118
- Size
  
  788KB
- MD5
  
  d2a5238060219037c3728de9f4304d82
- SHA1
  
  4c7b1a0a091873d8999a5e20b469c89005d46259
- SHA256
  
  cb4c4366780dd0c8f1723a77c911ca72dc5f921cf215fc9ffc60a6b18b357387
- SHA512
  
  ed0946321ebbe56eb8affdc6cb6ec5bb2f705a1aaed3c2f06ca20776c90864ba02c6de2c6dbaaf07d4ef456cae05943c8379ed88db3546ccfc0d75e89e47ec22
- SSDEEP
  
  24576:sQEaFmFN9v46flHtIxo+8lqBtYRNX4Ex7s9N:sQEaFmL9Ac/YB68YsH
Score

8^/10

banker discovery evasion impact persistence stealth trojan collection credential_access
- Removes its main activity from the application launcher
  stealth trojan evasion
- Checks Android system properties for emulator presence.
  evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Queries information about active data network
  discovery
- Queries the mobile country code (MCC)
  discovery
- Queries the unique device ID (IMEI, MEID, IMSI)
  discovery
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

Broadcast Receivers

Privilege Escalation

Defense Evasion

Download New Code at Runtime

Hide Artifacts

Suppress Application Icon

Virtualization/Sandbox Evasion

System Checks

Credential Access

Clipboard Data

Discovery

Software Discovery

Security Software Discovery

System Information Discovery

System Network Configuration Discovery

System Network Connections Discovery

Lateral Movement

Collection

Clipboard Data

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

Data Manipulation

Transmitted Data Manipulation

Tasks

static1

behavioral1

bankerdiscoveryevasionimpactpersistencestealthtrojan

behavioral2

bankercollectioncredential_accessdiscoveryevasionimpactpersistencestealthtrojan

behavioral3

bankercollectioncredential_accessdiscoveryevasionimpactstealthtrojan