Extracted

• • Target
    jaffacakes118_95123c12214fa66ab8d86c8d1fa71348c37aa10ab375d03016a249d4b7c1e707.bin
  • Size 15.7MB
  • SHA256 95123c12214fa66ab8d86c8d1fa71348c37aa10ab375d03016a249d4b7c1e707
  • MD5 20a7fe746d3dfe5f99d3113313947cdf
  • SHA1 e3fd67eaa836e6ee97db8bbf9d01f683fefaf062
  • SHA512 ff6da551ce565cbe18d987a32dae248b92ef2e6340b612c8d9aaf333c732d70d4369c74eb3d49747d245a105161b65a30c0ac8fb1744a367a6aae87141404c58
  • SSDEEP 12288:KZasCTBfOKqnhuZxBQa43Ujnz+RayrQTIRcOypyWoiEn2kvdeWiDJqY3SaYW:gEf02xiaVjz+/QTIR3IWckvkDiW
  • TLSH
    T127F6BE53FB23CDB1E4F385368B24A3695F2A0C66D35381D71868B12D9F77AD80A694F0
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  collectioncredential_accessdefense_evasionevasionexecutionpersistencestealthtrojan

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Acquires the wake lock

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    defense_evasion
  behavioral1behavioral2behavioral3