Extracted

• • Target
    jaffacakes118_a93510465b3f7ac07d33774fc0c752c3b42c18574e95336f7eb363d5d2499728.bin
  • Size 3.7MB
  • SHA256 a93510465b3f7ac07d33774fc0c752c3b42c18574e95336f7eb363d5d2499728
  • MD5 3bd4aeeb91a318e63466f4ee51169738
  • SHA1 68eff2cac51e807744743a05990f53601c8f0175
  • SHA512 1af47dc9376ae9153f481955eeb4e37d4fde560fe886baa918dd9e0f263b57f8a42446aaff28f33f064b03118a4d12e45ba99810bbfa8bd8fe9f653c3f9e3761
  • SSDEEP 98304:cnNCHss3ArrbJL8C3SmzzzBOTG0tococ6y:cnNCHz+rl8wdzgNYU
  • TLSH
    T15F06E003EF45CAD7D8BAC3F56B330CA95A270F15C642AAE341157A6E2E771C10EC669C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  bankercollectioncredential_accessdefense_evasiondiscoveryexecutionpersistenceevasionimpact

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Obtains sensitive information copied to the device clipboard

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Acquires the wake lock

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Performs UI accessibility actions on behalf of the user

    Application may abuse the accessibility service to prevent their removal.

    evasion

  • Queries information about active data network

    discovery

  • Queries the mobile country code (MCC)

    discovery

  • Requests disabling of battery optimizations (often used to enable hiding in the background).

    defense_evasion
  behavioral1behavioral2behavioral3