General
- Target jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.pf.ca2b6b65fe746f400552bf959ea3e832
- Size 1.6MB
- Sample261012-3j53jafc96
- SHA256 08e2c76692ca5bf36d0dbcf0b121cba1d9b8bf5d8ff413f66b128adc209a14ae
- MD5 ca2b6b65fe746f400552bf959ea3e832
- SHA1 f3a248e6a4020679e330abf67c69a8f32b0fdf53
- SHA512 858b65974615fc299d2f939844480f3aa43e81b16331bec17b3d8c91ed2cd83b1de7394945e2c8db4bb44b16fb45722bb1883314a1359c5b3590c8e40afad35a
- SSDEEP 24576:EY1NU+CDjORXMWp4pCW3OAzqcuvpSFHKyfMUBBCoNCChytz3WAK1Swh:EY1NwDSRXtehzqcukFHKuB4CPhjQwh
- TLSH T15275232BFB99855BC697A234B14661CE73314E44931A07221239F138FBF75AF4B63B48
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.pf.apk
Resource
android-x86-arm-20260325-en
Behavioral task
behavioral2
Sample
FZ200DL.apk
Resource
android-x86-arm-20260325-en
Behavioral task
behavioral3
Sample
FZ200DL.apk
Resource
android-x64-20260325-en
Behavioral task
behavioral4
Sample
FZ200DL.apk
Resource
android-x64-arm64-20260325-en
Malware Config
Targets
-
- Target jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.pf.ca2b6b65fe746f400552bf959ea3e832
- Size 1.6MB
- SHA256 08e2c76692ca5bf36d0dbcf0b121cba1d9b8bf5d8ff413f66b128adc209a14ae
- MD5 ca2b6b65fe746f400552bf959ea3e832
- SHA1 f3a248e6a4020679e330abf67c69a8f32b0fdf53
- SHA512 858b65974615fc299d2f939844480f3aa43e81b16331bec17b3d8c91ed2cd83b1de7394945e2c8db4bb44b16fb45722bb1883314a1359c5b3590c8e40afad35a
- SSDEEP 24576:EY1NU+CDjORXMWp4pCW3OAzqcuvpSFHKyfMUBBCoNCChytz3WAK1Swh:EY1NwDSRXtehzqcukFHKuB4CPhjQwh
- TLSH T15275232BFB99855BC697A234B14661CE73314E44931A07221239F138FBF75AF4B63B48
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks Android system properties for emulator presence.
-
Queries information about running processes on the device
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Reads the content of SMS inbox messages.
-
Reads the content of the SMS messages.
-
Requests cell location
Uses Android APIs to to get current cell location.
-
Queries information about active data network
-
Queries information about the current Wi-Fi connection
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC)
-
Requests dangerous framework permissions
-
- Target FZ200DL
- Size 99KB
- SHA256 2a3cb93d0ca14a1d0b0820c2a26df502a461fb2546ef4587524087c130553f10
- MD5 e8fbf92c750dbd6fb316be82a6b7b7ae
- SHA1 2a6ae9568698807cacc8cf4349556446c996b136
- SHA512 7848191878b5b8ba2d5020c7be953e70ccc4d392d29e400a65a57cd3731604933125de1d81b3732d251b3450fd4766a814ccd01f3975beda2499a9ba585a26e0
- SSDEEP 3072:O/UQ9RDR78j9tqyLm0NhjQOH4A2fra1m+91rc2LrJ2:2UQ9D78JoUpj/orah1rRU
- TLSH T17AA3124FB3F90A4EE853E9FA17A046B6F57185A0C71B8DBA822F18D3D1A7446D3112B1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10
MITRE ATT&CK Mobile v16
Defense Evasion
Download New Code at Runtime
1Execution Guardrails
1Geofencing
1Virtualization/Sandbox Evasion
3System Checks
3