General
- Target f7a01a72056b791898c75c6de13a15c6_JaffaCakes118
- Size 13.6MB
- Sample241216-g87f1aykez
- SHA256 93ca4d53d68b38627ce7c629f189d500ebe5f43240ae9a4cd1b1c02c68990359
Score
10/10
Malware Config
Targets
-
- Target f7a01a72056b791898c75c6de13a15c6_JaffaCakes118
- Size 13.6MB
- SHA256 93ca4d53d68b38627ce7c629f189d500ebe5f43240ae9a4cd1b1c02c68990359
Score8/10-
Checks if the Android device is rooted.
-
Removes its main activity from the application launcher
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
-
Queries the phone number (MSISDN for GSM devices)
-
Acquires the wake lock
-
Domain associated with commercial stalkerware software, includes indicators from echap.eu.org
-
Queries information about active data network
-
Queries information about the current Wi-Fi connection
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the unique device ID (IMEI, MEID, IMSI)
-
Reads information about phone network operator.
-
Requests accessing notifications (often used to intercept notifications before users become aware).
-
Tries to add a device administrator.
-
Checks the presence of a debugger
MITRE ATT&CK Mobile v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Device Administrator Permissions
1Defense Evasion
Hide Artifacts
1Suppress Application Icon
1Virtualization/Sandbox Evasion
1System Checks
1