1e70d1f1efb4619d7763210a634b882d3b442fd3eb9e389810b949017c2760e3

General

Target

314985092f13d343678ddbbfac9f33b0_JaffaCakes118
Size

2.2MB
Sample

241010-wxxvraverp
MD5

314985092f13d343678ddbbfac9f33b0
SHA1

db17dd599b08fdce0ef702289b58b2058fd3ca14
SHA256

1e70d1f1efb4619d7763210a634b882d3b442fd3eb9e389810b949017c2760e3
SHA512

19cc5ef1da27ed0c3baab0deee341c00a5cb3093b071cdd952e822f476ba0fcd346a7e92b8609f8cfae1dffc314b9c8e69f46c817bd1174bc2f6ed0bb9961103
SSDEEP

49152:YXqWrBnmSHH7fhRocjepNTY2Rz5uFrI6P7EsnBnmiW:YXZBmSHH7fLocj+TY2buFrBBmiW

Score

8^/10

Malware Config

Targets

- Target
  
  314985092f13d343678ddbbfac9f33b0_JaffaCakes118
- Size
  
  2.2MB
- MD5
  
  314985092f13d343678ddbbfac9f33b0
- SHA1
  
  db17dd599b08fdce0ef702289b58b2058fd3ca14
- SHA256
  
  1e70d1f1efb4619d7763210a634b882d3b442fd3eb9e389810b949017c2760e3
- SHA512
  
  19cc5ef1da27ed0c3baab0deee341c00a5cb3093b071cdd952e822f476ba0fcd346a7e92b8609f8cfae1dffc314b9c8e69f46c817bd1174bc2f6ed0bb9961103
- SSDEEP
  
  49152:YXqWrBnmSHH7fhRocjepNTY2Rz5uFrI6P7EsnBnmiW:YXZBmSHH7fLocj+TY2buFrBBmiW
Score

8^/10

evasion impact stealth trojan banker collection credential_access discovery persistence
- Removes its main activity from the application launcher
  stealth trojan evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries the mobile country code (MCC)
  discovery
- Queries the unique device ID (IMEI, MEID, IMSI)
  discovery
behavioral1 behavioral2 behavioral3
- Target
  
  polyvideo.apk
- Size
  
  417KB
- MD5
  
  99c506d3910bc12518e6018fe87940d5
- SHA1
  
  f423b8797862eb17a7df018fe03c7a607947dfff
- SHA256
  
  f4050b9986beff80b7800ce750ce6d39051e597f024c86f4ea33e3016f61ce65
- SHA512
  
  05aa3cad4ab98b79fd1451a3b165cb2083956ee82c3727ac49b5d7a16759a6aac3473ac238155bc94333ab146d451ef449ba081fccd0572655ce32bfb016c916
- SSDEEP
  
  12288:IPP8mCGIWCWAbQLBca09eT+u9iXLP0hf9dn:IPP8nWCWrBc34T+D8hFdn
Score

7^/10

discovery impact persistence banker collection credential_access evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries information about active data network
  discovery
- Queries the mobile country code (MCC)
  discovery
- Queries the unique device ID (IMEI, MEID, IMSI)
  discovery
behavioral4 behavioral5 behavioral6