Extracted

• • Target
    jaffacakes118_6c31b5244ce3c114e7660e01853cd0cc0c671ec92585dcff5dc857adf45bf6aa.bin
  • Size 15.7MB
  • SHA256 6c31b5244ce3c114e7660e01853cd0cc0c671ec92585dcff5dc857adf45bf6aa
  • MD5 deb8cc81fd3826c312d10410487ce16a
  • SHA1 c9d14b1da43931f9b3afa97646219aece8a21240
  • SHA512 2cf8dbd3fe683ea6dffaf06386e4558791f57d0966e1fd3107e9e1f4256d20500988b8879ce9ae174b91c537b5c2c077b8d1b2df39e96749280c27488a5ed3da
  • SSDEEP 12288:BKhqYww9K+3KhxasNjJ4AtbFF87pHOKpxyW7ERcOaREZy7QYC7KeN/sD7Ys:BKhJd3KDX96Mo1OKpxtER3Eh7uGIs
  • TLSH
    T1CDF6CF63F7968CA6D4F386361330B31A572B4DA8C7A741D328D8B2283D7B1C44E656F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  collectioncredential_accessdefense_evasionevasionexecutionpersistencestealthtrojan

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Acquires the wake lock

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    defense_evasion
  behavioral1behavioral2behavioral3