fb0159537eebb1881c1c0345f981c5e06635bb0ae7b29b72ae54af9d80859227 | Triage

Sharing

General

Target

6fa5c105275750a6d9b68276f9ee4b1d_JaffaCakes118
Size

432KB
Sample

241023-swbpcazajj
MD5

6fa5c105275750a6d9b68276f9ee4b1d
SHA1

6c931d479bf4c2a81984d518523d20b2940c748f
SHA256

fb0159537eebb1881c1c0345f981c5e06635bb0ae7b29b72ae54af9d80859227
SHA512

7da968cad60e17fa3499d9a18c2c545f8d484e800069eddd2fff176634b3c3fa4431de93e8c48cde3ea12e3b6c6e2d106575dda6c2a0e32ae1457b95e5b01d26
SSDEEP

6144:r4YzyyEoB0k1bV8cCq6Pe/H1i99ZMukJFHGNxN0h4Pz+8tReS4RhXNSWeLFevLcQ:s+/tXbV8cCRMH1iPZXk/FhwGvRhXBDBP

Score

8^/10

android discovery evasion impact persistence privilege_escalation stealth trojan

Malware Config

Targets

- Target
  
  6fa5c105275750a6d9b68276f9ee4b1d_JaffaCakes118
- Size
  
  432KB
- MD5
  
  6fa5c105275750a6d9b68276f9ee4b1d
- SHA1
  
  6c931d479bf4c2a81984d518523d20b2940c748f
- SHA256
  
  fb0159537eebb1881c1c0345f981c5e06635bb0ae7b29b72ae54af9d80859227
- SHA512
  
  7da968cad60e17fa3499d9a18c2c545f8d484e800069eddd2fff176634b3c3fa4431de93e8c48cde3ea12e3b6c6e2d106575dda6c2a0e32ae1457b95e5b01d26
- SSDEEP
  
  6144:r4YzyyEoB0k1bV8cCq6Pe/H1i99ZMukJFHGNxN0h4Pz+8tReS4RhXNSWeLFevLcQ:s+/tXbV8cCRMH1iPZXk/FhwGvRhXBDBP
Score

8^/10

discovery evasion impact persistence privilege_escalation stealth trojan
- Removes its main activity from the application launcher
  stealth trojan evasion
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Acquires the wake lock
- Queries the unique device ID (IMEI, MEID, IMSI)
  discovery
- Reads information about phone network operator.
  discovery
- Tries to add a device administrator.
  privilege_escalation impact
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

Broadcast Receivers

Privilege Escalation

Abuse Elevation Control Mechanism

Device Administrator Permissions

Defense Evasion

Hide Artifacts

Suppress Application Icon

Credential Access

Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Account Access Removal

Tasks

static1

behavioral1

discoveryevasionimpactpersistenceprivilege_escalationstealthtrojan

behavioral2

discoveryevasionpersistencestealthtrojan

behavioral3

discoveryevasionimpactprivilege_escalationstealthtrojan