Overview

overview

10

Static

static

6

fd66ce40e7...18.apk

android-9-x86

10

fd66ce40e7...18.apk

android-10-x64

10

fd66ce40e7...18.apk

android-11-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fd66ce40e73dbfe2a1f6a718c5ca30da_JaffaCakes118

  • Size

    4.7MB

  • Sample

    240928-3z9ewsvcjf

  • MD5

    fd66ce40e73dbfe2a1f6a718c5ca30da

  • SHA1

    696431ac145a50da1b1060639d7908c682f134c8

  • SHA256

    b0ac55805196efd6af8d21642c3dd81ea0900847c2544404292b4bfd1ce84fa3

  • SHA512

    371c38332a1ba8e1ea8224c1d2f47f14df4e8c9f78c981aacb7fa36496e7dbe0ea06e369f9236fa61b1588f0ef5b9784be1583872df4ef6b7c9504d338c00fe3

  • SSDEEP

    98304:hN23CGCNT1OO6CuFJaylF8ZCCfxOk13C3cFR+ARW5yYbsae+P7Wv/2TrJ1ebpFA:hI3C/NTt6HVlCZCQxERARW5galPi2TFP

Score
10/10
hydraandroidbankercollectioncredential_accessdiscoveryevasioninfostealerpersistencetrojan

Malware Config

Targets

    • Target

      fd66ce40e73dbfe2a1f6a718c5ca30da_JaffaCakes118

    • Size

      4.7MB

    • MD5

      fd66ce40e73dbfe2a1f6a718c5ca30da

    • SHA1

      696431ac145a50da1b1060639d7908c682f134c8

    • SHA256

      b0ac55805196efd6af8d21642c3dd81ea0900847c2544404292b4bfd1ce84fa3

    • SHA512

      371c38332a1ba8e1ea8224c1d2f47f14df4e8c9f78c981aacb7fa36496e7dbe0ea06e369f9236fa61b1588f0ef5b9784be1583872df4ef6b7c9504d338c00fe3

    • SSDEEP

      98304:hN23CGCNT1OO6CuFJaylF8ZCCfxOk13C3cFR+ARW5yYbsae+P7Wv/2TrJ1ebpFA:hI3C/NTt6HVlCZCQxERARW5galPi2TFP

    Score
    10/10
    hydrabankercollectioncredential_accessdiscoveryevasioninfostealerpersistencetrojan

    • Hydra

      Android banker and info stealer.

      bankertrojaninfostealerhydra

    • Hydra payload

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

      evasion

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

      collectionevasioncredential_access

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Queries information about active data network

      discovery

    • Queries the mobile country code (MCC)

      discovery

    • Reads information about phone network operator.

      discovery
    behavioral1behavioral2behavioral3

MITRE ATT&CK Mobile v15

Tasks