Extracted

• • Target
    jaffacakes118_3ee886939627d458f358c29ad698e2f18518911b4a9f23019ece28f5982b6e97.bin
  • Size 15.7MB
  • SHA256 3ee886939627d458f358c29ad698e2f18518911b4a9f23019ece28f5982b6e97
  • MD5 f2a97c37691a226ad92ae69e57f4a697
  • SHA1 1ee10231b0c8f1f693afdd54eb74ffe01bde0258
  • SHA512 d4ebd991a5e8413fbd3bcfd390ee9d3ff0559d0c1174a39ed2ecdd1f554596320bcfc92c88e76d1c9b39f93608c2363179560bf4171790b641085be7d39dfc1d
  • SSDEEP 12288:rnCCxg0nQ1TgrhiLRbP3cV2LTueyW2N8RcOGn7na4E7yRkoVZj/m9Y14:rnvETgliFDc4LqeUN8R3eNE7yZ+a14
  • TLSH
    T130F6BF13F7679885D8F3573D12206B95932A4D68C3E389D31C967328ED7B2DE0A6A4F0
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  collectioncredential_accessdefense_evasionevasionexecutionpersistencestealthtrojan

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Acquires the wake lock

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    defense_evasion
  behavioral1behavioral2behavioral3