General
- Target 48ac5d054764c76c815b5982c866bf65_JaffaCakes118
- Size 3.0MB
- Sample241015-s96rmssgrc
- SHA256 70e5fc454d81d0bff99001a75ad416cb8d430155716636bf3cdaf0561dbf00b3
Score
8/10
Malware Config
Targets
-
- Target 48ac5d054764c76c815b5982c866bf65_JaffaCakes118
- Size 3.0MB
- SHA256 70e5fc454d81d0bff99001a75ad416cb8d430155716636bf3cdaf0561dbf00b3
Score8/10Checks if the Android device is rooted.
Checks known Qemu files.
Checks for known Qemu files that exist on Android virtual device images.
Checks known Qemu pipes.
Checks for known pipes used by the Android emulator to communicate with the host.
Loads dropped Dex/Jar
Runs executable file dropped to the device during analysis.
Makes use of the framework's Accessibility service
Retrieves information displayed on the phone screen using AccessibilityService.
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
Acquires the wake lock
Queries information about active data network
Queries information about the current Wi-Fi connection
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
Queries the mobile country code (MCC)
Reads information about phone network operator.
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Input Injection
1Virtualization/Sandbox Evasion
4System Checks
4Discovery
Software Discovery
1Security Software Discovery
1System Information Discovery
3System Network Configuration Discovery
2System Network Connections Discovery
2