andrmonitor | 71768a11c8503aef5ef025423e0dd41f526bb5ec27ddca2e128bb7c1ad033c82 | Triage

Sharing

General

Target

f6a294d150c5c291e2f998a8cd4e4874_JaffaCakes118
Size

13.6MB
Sample

241216-bqf87sykeq
MD5

f6a294d150c5c291e2f998a8cd4e4874
SHA1

e118d7785f84eab2cbf9e3fce144c08e05f8df3b
SHA256

71768a11c8503aef5ef025423e0dd41f526bb5ec27ddca2e128bb7c1ad033c82
SHA512

41b5408de4470a95d565a80c5a5596a4b87edfa00a105fa7b683a4675b043d5d39c829d42db94b9835b626aed30a9c36fa16a9baf5d72619013d0d6b63186fa4
SSDEEP

393216:P9Ow1aZ85fVGEAA9SVSEArrHnexhdPWACDIurRo951b7:EwnhA0SZ0i1C8c2N

Score

10^/10

andrmonitor android banker discovery evasion impact persistence privilege_escalation stealth trojan

Malware Config

Targets

- Target
  
  f6a294d150c5c291e2f998a8cd4e4874_JaffaCakes118
- Size
  
  13.6MB
- MD5
  
  f6a294d150c5c291e2f998a8cd4e4874
- SHA1
  
  e118d7785f84eab2cbf9e3fce144c08e05f8df3b
- SHA256
  
  71768a11c8503aef5ef025423e0dd41f526bb5ec27ddca2e128bb7c1ad033c82
- SHA512
  
  41b5408de4470a95d565a80c5a5596a4b87edfa00a105fa7b683a4675b043d5d39c829d42db94b9835b626aed30a9c36fa16a9baf5d72619013d0d6b63186fa4
- SSDEEP
  
  393216:P9Ow1aZ85fVGEAA9SVSEArrHnexhdPWACDIurRo951b7:EwnhA0SZ0i1C8c2N
Score

8^/10

banker discovery evasion impact persistence privilege_escalation stealth trojan
- Checks if the Android device is rooted.
  evasion
- Removes its main activity from the application launcher
  stealth trojan evasion
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Queries the phone number (MSISDN for GSM devices)
  discovery
- Acquires the wake lock
- Domain associated with commercial stalkerware software, includes indicators from echap.eu.org
- Queries information about active data network
  discovery
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Reads information about phone network operator.
  discovery
- Tries to add a device administrator.
  privilege_escalation impact
- Checks the presence of a debugger
  evasion
behavioral1 behavioral2

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

Broadcast Receivers

Privilege Escalation

Abuse Elevation Control Mechanism

Device Administrator Permissions

Defense Evasion

Hide Artifacts

Suppress Application Icon

Virtualization/Sandbox Evasion

System Checks

Credential Access

Discovery

Software Discovery

Security Software Discovery

System Information Discovery

System Network Configuration Discovery

System Network Connections Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Account Access Removal

Data Encrypted for Impact

Tasks

static1

behavioral1

bankerdiscoveryevasionimpactpersistenceprivilege_escalationstealthtrojan

behavioral2

bankerdiscoveryevasionimpactprivilege_escalation