Extracted

• • Target
    jaffacakes118_6a9ef798c62815b5d76fd5dd95e47c2a1bb5d2d1058d050e548cc3b3c4c0cd95.bin
  • Size 15.6MB
  • SHA256 6a9ef798c62815b5d76fd5dd95e47c2a1bb5d2d1058d050e548cc3b3c4c0cd95
  • MD5 cee493fa8e568c1d8652eb88cb616d80
  • SHA1 9e4424084d880a6f2cae9b6efbcc981e5ecb6baa
  • SHA512 ce6d87363bb80cf09a897658d1b9644685564fd96ba60012405a6530f7bf7087fb2a03b87ce1b9bd29a3df3b94aeb9789ad15f08e528e4823fcb3b25ade10b56
  • SSDEEP 12288:XGAowlXWUYtABhGFyfdxfJJB3kuZYVBVh9xuPnNlxZC3cfYW:XZlWUYtA3GFyHf7muCV7xuP0W
  • TLSH
    T11FF6CF93FB535EAAE4F2C2381624B7789B274D64C20702E34A5C713A9CB75D20BAF5D1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  collectioncredential_accessdefense_evasionevasionexecutionpersistencestealthtrojan

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Acquires the wake lock

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    defense_evasion
  behavioral1behavioral2behavioral3