Extracted

• • Target
    jaffacakes118_95458d9e14fa37eb43473dc88df12e6138f0ba78e712f9bbd63ce780abefa9af.bin
  • Size 17.1MB
  • SHA256 95458d9e14fa37eb43473dc88df12e6138f0ba78e712f9bbd63ce780abefa9af
  • MD5 add3e91fca04243e8a9083de84598b39
  • SHA1 5289656c2eaaa0fba53d5342fb239fe77a6bc0ae
  • SHA512 99903305f4825f82660bdd5730aa56beae556ea7f05bba38a836b91b5f9e9607ffe38b266bee8e41471256f6bec9af5f78af1344cd9c356aa49f9fc950fe8e04
  • SSDEEP 49152:hjVQ1GBKhw+sYg/h0pmzPzdGGnQTOFveUKYqY0cgAB37dE:hO0Ow+sL/h0pmzPzBQTqf0tAp7i
  • TLSH
    T1AF07DF13FA45CBC3D56C83F1BA575F996A274F09C142AAEB00253A9E3EB62C20DD55CC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  bankercollectioncredential_accessdefense_evasiondiscoveryexecutionpersistenceimpact

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Obtains sensitive information copied to the device clipboard

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Queries information about active data network

    discovery

  • Queries the mobile country code (MCC)

    discovery

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    defense_evasion
  behavioral1behavioral2behavioral3