f09db31ef6d4a6c18681d1785ae7b32a82afe818c44d7d5a338d454603f57ef8

General

Target
558eaf7244e256612fd7234403ee9717_JaffaCakes118.apk
Size 254KB
Sample241018-ffwy5ayape
SHA256 f09db31ef6d4a6c18681d1785ae7b32a82afe818c44d7d5a338d454603f57ef8
MD5 558eaf7244e256612fd7234403ee9717
SHA1 e5e08aa1d0d3218f1b71aa01d323408340fcb99e
SHA512 b5e1ab26c1f12e237d71b9aafe44d25881b697591b35a78ba2dfccc28fc010133ba14b5858bca53fe6b353c6c1893a6702fb671bce63534af8de33609d42035f
SSDEEP 6144:RyMz4eyONlSg9go5uLMlixWkRaG8CxUyI/svj2zB7VM3l6:IXeyONll9HuwkEksG81pzB766
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4918	net.droidjack.server

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	net.droidjack.server

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	net.droidjack.server

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	net.droidjack.server

net.droidjack.server
1⤵
- Removes its main activity from the application launcher
- Acquires the wake lock
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4918

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1628

Suppress Application Icon

1

T1628.001

Credential Access

Discovery

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SandroRat_Configuration_Database

Path /data/data/net.droidjack.server/databases/SandroRat_Configuration_Database
Size 16KB
SHA256 4da0f7c511a540be366bd92014b6279194cf5da3c47ddb8acb48526f1ad967ab
MD5 ab9b76032f3671e636504f620ed4d205
SHA1 21e1e3ef5f95af48acdd224ef1f40ff12467521d
SHA512 9e133dfb122855076eec7967f0e73fef6f8cdd655b32f9ee5d8cc7de1114212d10764839359b38b63e73772517910662109d87336a8507a99ca1085758841725
SSDEEP 6:l9bNFlqals1XMAIXIEFtLuJIs/FcERX4PBX4ogLugMBX4suuK0DqiOw:TLpEXMAIXINJIWfRmBEyPbBvOw
MD5 SHA1 SHA512 SSDEEP

Submit Download

SandroRat_Configuration_Database

Path /data/data/net.droidjack.server/databases/SandroRat_Configuration_Database
Size 16KB
SHA256 e06808d0f26d3f7c078373caf37b1fcb15fd7262d7cc9ad3057a130858e69fb2
MD5 6fcf8bde665d6516b741aba0555e6dd8
SHA1 ceb84cfe5ef8eda669b80d9849adfcd1dadcdf68
SHA512 94286235442797ac9531fb81e8d62a966def625a1792dbac8528a9409fe2bbb67099614b1f487253eca3c4bc1733e77df44cb81d605f0586cf32d715f7527718
SSDEEP 6:l9bNFluls1ENMAIXIEFtLuJIs/FcERX4PBX4ogLugMBX4suuK+/jqwllk8Ep:TL8EENMAIXINJIWfRmBEyPbP/fLEp
MD5 SHA1 SHA512 SSDEEP

Submit Download

SandroRat_Configuration_Database

Path /data/data/net.droidjack.server/databases/SandroRat_Configuration_Database
Size 16KB
SHA256 94caa6d0d72974422eb22d54997bd748cc73b824d45d7413e00b0c6310395b04
MD5 205286149bf6310628db2062dd6eea38
SHA1 42e0d3cc8a9eee4a7301d9ccd35466488a8b7b92
SHA512 ea1525557b1699c82c4db2e958ef79c90ba0e58b2fafb0ce79fdfb20e5b17afacbf423207750895210345a99d9952c29bea0e99f6fb850f6505cb76088b8e917
SSDEEP 6:l9bNFl4/Sls1OqMAIXIEFtLuJIs/FcERX4PBX4ogLugMBX4suuK+/Q5+uhp8Ep:TLWuEOqMAIXINJIWfRmBEyPbP/Q5uEp
MD5 SHA1 SHA512 SSDEEP

Submit Download