General

  • Target

    6fa396c435aa74e935fb3d20d68b8d71_JaffaCakes118

  • Size

    6.3MB

  • Sample

    241023-st48waxcjb

  • MD5

    6fa396c435aa74e935fb3d20d68b8d71

  • SHA1

    9b2ff3dea9c378c12f5cd64d392a7a21a3f505d8

  • SHA256

    9669b41554d066c398b85c11d1cb366c37d7ec466328d5f0f85f592540e2fd47

  • SHA512

    d988205dd33f6781432c21a4f7db6479af0115f4ca32cd59dbd4a85baba87410e79f5229b3344bb54cca86e05ace267e9e4b0adafb2f252f814fae8c909ee563

  • SSDEEP

    196608:PTaM9GFSE63zyPhq2gyEnx3Be5ixtl9lBUJc2eJ9:raM9GFSENM27Enq4lJJ9

Malware Config

Targets

    • Target

      6fa396c435aa74e935fb3d20d68b8d71_JaffaCakes118

    • Size

      6.3MB

    • MD5

      6fa396c435aa74e935fb3d20d68b8d71

    • SHA1

      9b2ff3dea9c378c12f5cd64d392a7a21a3f505d8

    • SHA256

      9669b41554d066c398b85c11d1cb366c37d7ec466328d5f0f85f592540e2fd47

    • SHA512

      d988205dd33f6781432c21a4f7db6479af0115f4ca32cd59dbd4a85baba87410e79f5229b3344bb54cca86e05ace267e9e4b0adafb2f252f814fae8c909ee563

    • SSDEEP

      196608:PTaM9GFSE63zyPhq2gyEnx3Be5ixtl9lBUJc2eJ9:raM9GFSENM27Enq4lJJ9

    • Checks if the Android device is rooted.

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

    • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    • Queries information about running processes on the device

      Application may abuse the framework's APIs to collect information about running processes on the device.

    • Queries information about the current nearby Wi-Fi networks

      Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

    • Reads the content of photos stored on the user's device.

    • Requests cell location

      Uses Android APIs to to get current cell location.

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Queries information about active data network

    • Queries information about the current Wi-Fi connection

      Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    • Reads information about phone network operator.

MITRE ATT&CK Mobile v15

Tasks