General
- Target jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.pf.99b5379cea3fba6232c264e49b8b5f37
- Size 2.1MB
- Sample261012-3esxeacs2k
- SHA256 eb27ad6baf7f185ea286aa362732a2147737cdfce23699895486d8c72f6755e8
- MD5 99b5379cea3fba6232c264e49b8b5f37
- SHA1 d786acf2d550b225974ce3f042080d79d0835d9f
- SHA512 66b91d1ecd0ea598abd95edd575e7d1b97714ff2001e716898f909b09587162fe02dc0e3fa30c35feef2a29419efcca5353f83df752b3ea9d0562afd9d89d07e
- SSDEEP 49152:wsHvGeMbhWcTEZnCOF0M8U1IVh578BC+ehxYCUkGgI1tnIPnAi1:1vGeWhWxCKJ8KIV7wCYFxj1tnI/Aw
- TLSH T14BA52317CF59C285C0BAEF71C2A1C2B6B1A64CB0E35AD2E71D02F4A8A8779D5D3358C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.pf.apk
Resource
android-x86-arm-20260325-en
Behavioral task
behavioral2
Sample
BDTX140.apk
Resource
android-x86-arm-20260325-en
Behavioral task
behavioral3
Sample
BDTX140.apk
Resource
android-x64-20260325-en
Behavioral task
behavioral4
Sample
BDTX140.apk
Resource
android-x64-arm64-20260325-en
Malware Config
Targets
-
- Target jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.pf.99b5379cea3fba6232c264e49b8b5f37
- Size 2.1MB
- SHA256 eb27ad6baf7f185ea286aa362732a2147737cdfce23699895486d8c72f6755e8
- MD5 99b5379cea3fba6232c264e49b8b5f37
- SHA1 d786acf2d550b225974ce3f042080d79d0835d9f
- SHA512 66b91d1ecd0ea598abd95edd575e7d1b97714ff2001e716898f909b09587162fe02dc0e3fa30c35feef2a29419efcca5353f83df752b3ea9d0562afd9d89d07e
- SSDEEP 49152:wsHvGeMbhWcTEZnCOF0M8U1IVh578BC+ehxYCUkGgI1tnIPnAi1:1vGeWhWxCKJ8KIV7wCYFxj1tnI/Aw
- TLSH T14BA52317CF59C285C0BAEF71C2A1C2B6B1A64CB0E35AD2E71D02F4A8A8779D5D3358C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Checks Android system properties for emulator presence.
Checks Qemu related system properties.
Checks for Android system properties related to Qemu for Emulator detection.
Queries the phone number (MSISDN for GSM devices)
Reads the content of SMS inbox messages.
Reads the content of the SMS messages.
Requests cell location
Uses Android APIs to to get current cell location.
Queries information about active data network
Queries information about the current Wi-Fi connection
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
Queries the mobile country code (MCC)
Queries the unique device ID (IMEI, MEID, IMSI)
Reads information about phone network operator.
Requests dangerous framework permissions
-
- Target BDTX140
- Size 96KB
- SHA256 77ff63fc4125b3c1bf970feb1722e02cf43c9c4d6abeff4b2cccb6a9e55a51ef
- MD5 38e2a484a18765834e721e42df3b89cb
- SHA1 21bb2bc4f29e40abdb103b9d64af815956cb504b
- SHA512 1ad43dbcfdffe2c21649e043ed3e6a61f81f69ac53bac68a9350624b3613be8c249ff0df5b8b7711cb13e030033d23aa71bc3f730becabede1040417f576a618
- SSDEEP 1536:Kh6mBpBM3vDKmJJj0Z/maH2/88Hsv0SBblAi9HQ1oF1YOVUAOgrULB+hsr:UFKbPIZ/me8Mv0s1q25VU3lBwsr
- TLSH T138A3124FE694F63CE1FBCB34F0E28738B73AC919D961534F682A6088D9336905580F99
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10
MITRE ATT&CK Mobile v16
Defense Evasion
Download New Code at Runtime
1Execution Guardrails
1Geofencing
1Virtualization/Sandbox Evasion
4System Checks
4