General
- Target jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.pf.962ec54181c382f0632e86e6eeaaeddf
- Size 2.1MB
- Sample261012-3dkveaswet
- SHA256 186fc52f9e8bcda30bddaebb14b5138c18e5abfaa3c8806b006fa2c30eeb7274
- MD5 962ec54181c382f0632e86e6eeaaeddf
- SHA1 6bef7a237d8ec89b567a3b49c2e72dee96118970
- SHA512 ab52c4e92282e1c3c7869e3d8cb03500dd3a142c0c8d565d2a1810fdc05ecfafc9fb4efd5d66b17e7b7d42f12303a2e24a12024a8adc15c7efab2b6d0a2a9259
- SSDEEP 49152:V6YsHvGeMbhWcTEZnCOF0M8U1IVh578BC+ehxYCUkGgI1tnIPnAiv:VUvGeWhWxCKJ8KIV7wCYFxj1tnI/Aq
- TLSH T1EBA52317CF598285C0BAEF71C261C2B7B1A64CB0E35AD2E71D02F5A8A8779D9C3358C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.pf.apk
Resource
android-x86-arm-20260325-en
Behavioral task
behavioral2
Sample
BDTX140.apk
Resource
android-x86-arm-20260325-en
Behavioral task
behavioral3
Sample
BDTX140.apk
Resource
android-x64-20260325-en
Behavioral task
behavioral4
Sample
BDTX140.apk
Resource
android-x64-arm64-20260325-en
Malware Config
Targets
-
- Target jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.pf.962ec54181c382f0632e86e6eeaaeddf
- Size 2.1MB
- SHA256 186fc52f9e8bcda30bddaebb14b5138c18e5abfaa3c8806b006fa2c30eeb7274
- MD5 962ec54181c382f0632e86e6eeaaeddf
- SHA1 6bef7a237d8ec89b567a3b49c2e72dee96118970
- SHA512 ab52c4e92282e1c3c7869e3d8cb03500dd3a142c0c8d565d2a1810fdc05ecfafc9fb4efd5d66b17e7b7d42f12303a2e24a12024a8adc15c7efab2b6d0a2a9259
- SSDEEP 49152:V6YsHvGeMbhWcTEZnCOF0M8U1IVh578BC+ehxYCUkGgI1tnIPnAiv:VUvGeWhWxCKJ8KIV7wCYFxj1tnI/Aq
- TLSH T1EBA52317CF598285C0BAEF71C261C2B7B1A64CB0E35AD2E71D02F5A8A8779D9C3358C5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks Android system properties for emulator presence.
-
Checks Qemu related system properties.
Checks for Android system properties related to Qemu for Emulator detection.
-
Queries the phone number (MSISDN for GSM devices)
-
Reads the content of SMS inbox messages.
-
Reads the content of the SMS messages.
-
Requests cell location
Uses Android APIs to to get current cell location.
-
Queries information about active data network
-
Queries information about the current Wi-Fi connection
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC)
-
Queries the unique device ID (IMEI, MEID, IMSI)
-
Reads information about phone network operator.
-
Requests dangerous framework permissions
-
- Target BDTX140
- Size 96KB
- SHA256 77ff63fc4125b3c1bf970feb1722e02cf43c9c4d6abeff4b2cccb6a9e55a51ef
- MD5 38e2a484a18765834e721e42df3b89cb
- SHA1 21bb2bc4f29e40abdb103b9d64af815956cb504b
- SHA512 1ad43dbcfdffe2c21649e043ed3e6a61f81f69ac53bac68a9350624b3613be8c249ff0df5b8b7711cb13e030033d23aa71bc3f730becabede1040417f576a618
- SSDEEP 1536:Kh6mBpBM3vDKmJJj0Z/maH2/88Hsv0SBblAi9HQ1oF1YOVUAOgrULB+hsr:UFKbPIZ/me8Mv0s1q25VU3lBwsr
- TLSH T138A3124FE694F63CE1FBCB34F0E28738B73AC919D961534F682A6088D9336905580F99
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10
MITRE ATT&CK Mobile v16
Defense Evasion
Download New Code at Runtime
1Execution Guardrails
1Geofencing
1Virtualization/Sandbox Evasion
4System Checks
4