Extracted

• • Target
    jaffacakes118_55d6f3e5e561ab51733e8167f96219568236b73362c7dd8e2b3fa905245476f0.bin
  • Size 7.4MB
  • SHA256 55d6f3e5e561ab51733e8167f96219568236b73362c7dd8e2b3fa905245476f0
  • MD5 63381a09f187dcdaed9009fe3327c0cd
  • SHA1 399a88ebe4e1def9b7f6bbbeae08713eefcd7809
  • SHA512 7546a975c2a31a36b193a8324e1f094a33a2e22ce2e51cfb8b4e2ec892b5209b6c78962f32b826a4ce592bdead0f9bf7907d67722dcaec294a40fb7e67f9bede
  • SSDEEP 49152:FQ+RdYQqyyJthLRnmzvzdGG6QTO0oUEYqq0cggM3hmIj:FQBZthLRnmzvzBVTt0tgkhJ
  • TLSH
    T1C376CF43BE15CBC3C86D93F56E134FA92A275F58C5926AEB00153A9E3E362C20DD65CC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  bankercollectioncredential_accessdefense_evasiondiscoveryexecutionpersistenceimpact

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Obtains sensitive information copied to the device clipboard

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Queries information about active data network

    discovery

  • Queries the mobile country code (MCC)

    discovery

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    defense_evasion
  behavioral1behavioral2behavioral3