Overview

overview

10

Static

static

10

d3cf74fcfe...18.apk

android-9-x86

8

RootRobot.apk

android-9-x86

1

RootRobot.apk

android-10-x64

1

RootRobot.apk

android-11-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d3cf74fcfef339f4e29ba3361e34422f_JaffaCakes118

  • Size

    10.3MB

  • Sample

    241207-1we1rs1nfj

  • MD5

    d3cf74fcfef339f4e29ba3361e34422f

  • SHA1

    02a818bc9be6bf6280337f926845848f7058f1a9

  • SHA256

    dc71dd28c88d47cd47d8fb85dced15340d0021c0704bc39f5b4582ba0faf1f51

  • SHA512

    cb2074392af936e2689a554d5229faa36a378e19bbcc6dae6e305e69d3541fe0763ddadea3710f173b829fdde6ebc558f16ef421f0bee10762ec92aa2f79495f

  • SSDEEP

    196608:PLxnqfTin248xoBGLogstTHQB9QvtR9dGvLBhS/NIj4nsBzTR:ThqMmqWolt20R9OrS1Ij4nsh1

Score
10/10
pegasusandroidcollectiondiscoveryevasionimpactpersistence

Malware Config

Targets

    • Target

      d3cf74fcfef339f4e29ba3361e34422f_JaffaCakes118

    • Size

      10.3MB

    • MD5

      d3cf74fcfef339f4e29ba3361e34422f

    • SHA1

      02a818bc9be6bf6280337f926845848f7058f1a9

    • SHA256

      dc71dd28c88d47cd47d8fb85dced15340d0021c0704bc39f5b4582ba0faf1f51

    • SHA512

      cb2074392af936e2689a554d5229faa36a378e19bbcc6dae6e305e69d3541fe0763ddadea3710f173b829fdde6ebc558f16ef421f0bee10762ec92aa2f79495f

    • SSDEEP

      196608:PLxnqfTin248xoBGLogstTHQB9QvtR9dGvLBhS/NIj4nsBzTR:ThqMmqWolt20R9OrS1Ij4nsh1

    Score
    8/10
    collectiondiscoveryevasionimpactpersistence

    • Checks if the Android device is rooted.

      evasion

    • Queries the phone number (MSISDN for GSM devices)

      discovery

    • Reads the contacts stored on the device.

      collection

    • Reads the content of the call log.

      collection

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

      evasionpersistence

    • Queries information about active data network

      discovery

    • Queries information about the current Wi-Fi connection

      Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

      discovery

    • Reads information about phone network operator.

      discovery
    behavioral1

    • Target

      RootRobot

    • Size

      10KB

    • MD5

      a8932eaff21ef0f5b12212cd898f98a4

    • SHA1

      f433758b0d57312d85860f67b454bfcf8cdcfcaa

    • SHA256

      f85955930a6b8f39abeb9d9b2941a91aeba3dd51ec87c09ef0a2b207601fd416

    • SHA512

      cb5698f459e9ce90d58a4002d4158a751f721698c8891b95e91cad57c58f7a152d51faed7358cf459c8bbbe9514ce2e199f18021da829ddcc46a8d407ed76764

    • SSDEEP

      192:Xiga6QV8zsm40cpgLEeslYSmG0Cu18LBssYM9fZhufDf9KweF/:X/apSzz4CFslYSmGEcX3fZIf9K3

    Score
    1/10
    behavioral2behavioral3behavioral4

MITRE ATT&CK Mobile v15

Tasks