Extracted

• • Target
    jaffacakes118_8ec6adda0001ad9a73db0464aa4ee3143fffea0a3ccf61fdadd2afcf722f4902.bin
  • Size 4.7MB
  • SHA256 8ec6adda0001ad9a73db0464aa4ee3143fffea0a3ccf61fdadd2afcf722f4902
  • MD5 efcf8c9682a75fc7a1b9de05b7fd984d
  • SHA1 81471e93f4a3ec0f9b22a16e7609d1f046fcc4d7
  • SHA512 5c66d178333d6811f3bf7059f874ccd543f696cc85359afcb6535c1519828dcdb099150170c93a0d574b6e382ef439fcc7780d673850c7835800756e9d174f33
  • SSDEEP 98304:wZOpd/A6dSNgaZ2qbNJrCeT4viKNMsexX8veiAjaPu2ZUK5vSsQyBj:wZOAkm2qbNJENMfBPhaP7UkKij
  • TLSH
    T1F1363396D7D2A486F1B9B6B15A3E45F1F9322E3642960BC33215323C55FF33D0B622A4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral1behavioral2behavioral3
• • Target
    childapp.apk
  • Size 18.3MB
  • SHA256 876c45c150fe16b14545823abba8299cf766f042ce51c0ebcb73acca67932339
  • MD5 07de48e2002525035378999a8564274e
  • SHA1 edcaeba73b31ff992e3c21c0fa0268be8e2a3a32
  • SHA512 590562099f3fadcfc58cfb2ceb36fed86ac1be329df6f198a7ab5cca45e28d8f5cf371062e4e112c06134b57629b4734e38c06db31ac57157bc83f901485c7b3
  • SSDEEP 49152:Q5ddrkdEaeqZVnvyQQqAC0y8io2luImzJzdGG8QTOmxU3YqE0cglFVY:mdrk4qnWC0jomzJzBbTl0tl4
  • TLSH
    T18417F017BA45CAC3C46D93F57F230FA82A270F5891522AEB02553A6E3E762D30DD58CD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  bankercollectioncredential_accessdefense_evasiondiscoveryexecutionpersistenceevasionimpact

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Obtains sensitive information copied to the device clipboard

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Queries information about active data network

    discovery

  • Queries the mobile country code (MCC)

    discovery

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    defense_evasion
  behavioral4behavioral5behavioral6