Extracted

• • Target
    jaffacakes118_ced32a42008bf19e099771484ab31b0f86523816169ab6a70f1f754c276e7a3b.bin
  • Size 15.7MB
  • SHA256 ced32a42008bf19e099771484ab31b0f86523816169ab6a70f1f754c276e7a3b
  • MD5 70f5cec3734424df755c67d048e64df3
  • SHA1 1583ee6c58bfe4b49291655368d6eef0413457d1
  • SHA512 3b9cfc674e1eeef2d43999d06e87159e6dc7ad89882e9b324b3a77191d5049dfe15db9a700290a304e05b212bbd7d4a8ff59e464b600d262f73e8eb94583d8f4
  • SSDEEP 12288:QIIdyUomO4LylhI+ixJeyWCKoRcO2BjqQu8dE5St1VYbt:IAF4LylkxJe4KoR3PQ4bt
  • TLSH
    T14AF6BEB3FF156846CFF2493A4228A71A5B6B0E75C78387DA48A47A3C1C771C8CBA54D1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  collectioncredential_accessdefense_evasionevasionexecutionpersistencestealthtrojan

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Acquires the wake lock

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    defense_evasion
  behavioral1behavioral2behavioral3