General
- Target jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.pf.99b5379cea3fba6232c264e49b8b5f37
- Size 2.1MB
- Sample261012-3esxeacs2k
- SHA256 eb27ad6baf7f185ea286aa362732a2147737cdfce23699895486d8c72f6755e8
- MD5 99b5379cea3fba6232c264e49b8b5f37
- SHA1 d786acf2d550b225974ce3f042080d79d0835d9f
- SHA512 66b91d1ecd0ea598abd95edd575e7d1b97714ff2001e716898f909b09587162fe02dc0e3fa30c35feef2a29419efcca5353f83df752b3ea9d0562afd9d89d07e
- SSDEEP 49152:wsHvGeMbhWcTEZnCOF0M8U1IVh578BC+ehxYCUkGgI1tnIPnAi1:1vGeWhWxCKJ8KIV7wCYFxj1tnI/Aw
- TLSH T14BA52317CF59C285C0BAEF71C2A1C2B6B1A64CB0E35AD2E71D02F4A8A8779D5D3358C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.pf.apk
Resource
android-x86-arm-20260325-en
Behavioral task
behavioral2
Sample
BDTX140.apk
Resource
android-x86-arm-20260325-en
Behavioral task
behavioral3
Sample
BDTX140.apk
Resource
android-x64-20260325-en
Behavioral task
behavioral4
Sample
BDTX140.apk
Resource
android-x64-arm64-20260325-en
Malware Config
Targets
-
- Target jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.pf.99b5379cea3fba6232c264e49b8b5f37
- Size 2.1MB
- SHA256 eb27ad6baf7f185ea286aa362732a2147737cdfce23699895486d8c72f6755e8
- MD5 99b5379cea3fba6232c264e49b8b5f37
- SHA1 d786acf2d550b225974ce3f042080d79d0835d9f
- SHA512 66b91d1ecd0ea598abd95edd575e7d1b97714ff2001e716898f909b09587162fe02dc0e3fa30c35feef2a29419efcca5353f83df752b3ea9d0562afd9d89d07e
- SSDEEP 49152:wsHvGeMbhWcTEZnCOF0M8U1IVh578BC+ehxYCUkGgI1tnIPnAi1:1vGeWhWxCKJ8KIV7wCYFxj1tnI/Aw
- TLSH T14BA52317CF59C285C0BAEF71C2A1C2B6B1A64CB0E35AD2E71D02F4A8A8779D5D3358C5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks Android system properties for emulator presence.
-
Checks Qemu related system properties.
Checks for Android system properties related to Qemu for Emulator detection.
-
Queries the phone number (MSISDN for GSM devices)
-
Reads the content of SMS inbox messages.
-
Reads the content of the SMS messages.
-
Requests cell location
Uses Android APIs to to get current cell location.
-
Queries information about active data network
-
Queries information about the current Wi-Fi connection
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC)
-
Queries the unique device ID (IMEI, MEID, IMSI)
-
Reads information about phone network operator.
-
Requests dangerous framework permissions
-
- Target BDTX140
- Size 96KB
- SHA256 77ff63fc4125b3c1bf970feb1722e02cf43c9c4d6abeff4b2cccb6a9e55a51ef
- MD5 38e2a484a18765834e721e42df3b89cb
- SHA1 21bb2bc4f29e40abdb103b9d64af815956cb504b
- SHA512 1ad43dbcfdffe2c21649e043ed3e6a61f81f69ac53bac68a9350624b3613be8c249ff0df5b8b7711cb13e030033d23aa71bc3f730becabede1040417f576a618
- SSDEEP 1536:Kh6mBpBM3vDKmJJj0Z/maH2/88Hsv0SBblAi9HQ1oF1YOVUAOgrULB+hsr:UFKbPIZ/me8Mv0s1q25VU3lBwsr
- TLSH T138A3124FE694F63CE1FBCB34F0E28738B73AC919D961534F682A6088D9336905580F99
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10
MITRE ATT&CK Mobile v16
Defense Evasion
Download New Code at Runtime
1Execution Guardrails
1Geofencing
1Virtualization/Sandbox Evasion
4System Checks
4