General

  • Target

    4a124f29f5b9c878a4b5567ffaa2b97b_JaffaCakes118

  • Size

    5.7MB

  • Sample

    241015-z8s8gssbkq

  • MD5

    4a124f29f5b9c878a4b5567ffaa2b97b

  • SHA1

    253d705d2d157e0a7730670968f68fcc118a066d

  • SHA256

    9b5ac1f58b6e5e6b3afdeae483260790ce667b78a64f322941ef45f9bb9607d7

  • SHA512

    495f602d4a6f61cf01540952b0d6897e433047ccf8e34d0854b1d8b0b4f5521fc9c7dd17c78e5cb3727983715d113861757ae838d953f844494a436be8253ca5

  • SSDEEP

    98304:70ZXX4zEvQ+E7M76ixTFaVhMxdCPs19QkOecUCztyXKwp+6zPhwQeVKrUMphXz:7+w9+4CvT8ExdCkFOecpyH5wQKKrU6hD

Malware Config

Targets

    • Target

      4a124f29f5b9c878a4b5567ffaa2b97b_JaffaCakes118

    • Size

      5.7MB

    • MD5

      4a124f29f5b9c878a4b5567ffaa2b97b

    • SHA1

      253d705d2d157e0a7730670968f68fcc118a066d

    • SHA256

      9b5ac1f58b6e5e6b3afdeae483260790ce667b78a64f322941ef45f9bb9607d7

    • SHA512

      495f602d4a6f61cf01540952b0d6897e433047ccf8e34d0854b1d8b0b4f5521fc9c7dd17c78e5cb3727983715d113861757ae838d953f844494a436be8253ca5

    • SSDEEP

      98304:70ZXX4zEvQ+E7M76ixTFaVhMxdCPs19QkOecUCztyXKwp+6zPhwQeVKrUMphXz:7+w9+4CvT8ExdCkFOecpyH5wQKKrU6hD

    • Checks if the Android device is rooted.

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Queries information about running processes on the device

      Application may abuse the framework's APIs to collect information about running processes on the device.

    • Queries information about the current nearby Wi-Fi networks

      Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

    • Reads the content of photos stored on the user's device.

    • Requests cell location

      Uses Android APIs to to get current cell location.

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Queries information about active data network

    • Queries information about the current Wi-Fi connection

      Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    • Reads information about phone network operator.

MITRE ATT&CK Mobile v15

Tasks