General
- Target jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.pf.d8847d80c63174afbfffac825c397f97
- Size 1.8MB
- Sample261012-3llfxafd35
- SHA256 d4d48047543dca6798284f3cedfc8bdcda087a667a128bacc8f973d2f46e96ef
- MD5 d8847d80c63174afbfffac825c397f97
- SHA1 e44b50a68d8261a0362ed85276aa9fe1358e966f
- SHA512 c0dc3225e20728ac70ded6123d8dd958b64a33cc874dfd5d825f8cab4f2177b8ddf3679e88a6580c3e11b2d35aab23fe8396ecc1e6edd9aa0fdcae0e4499362a
- SSDEEP 49152:N3KshCeDTlBeOsmHy5QOLKKhDyh+2aQSwSPeNeBOJdDFt5:JJnbvgQGKoOINwfDJ
- TLSH T186951223E789A8D6D4B3A2358E37919290525C705647E3A31D02B17C4EB7EC893E9FCD
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.pf.apk
Resource
android-x86-arm-20260325-en
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
dERlZG.apk
Resource
android-x86-arm-20260325-en
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
dERlZG.apk
Resource
android-x64-20260325-en
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
dERlZG.apk
Resource
android-x64-arm64-20260325-en
0 signatures
150 seconds
Malware Config
Targets
-
- Target jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.pf.d8847d80c63174afbfffac825c397f97
- Size 1.8MB
- SHA256 d4d48047543dca6798284f3cedfc8bdcda087a667a128bacc8f973d2f46e96ef
- MD5 d8847d80c63174afbfffac825c397f97
- SHA1 e44b50a68d8261a0362ed85276aa9fe1358e966f
- SHA512 c0dc3225e20728ac70ded6123d8dd958b64a33cc874dfd5d825f8cab4f2177b8ddf3679e88a6580c3e11b2d35aab23fe8396ecc1e6edd9aa0fdcae0e4499362a
- SSDEEP 49152:N3KshCeDTlBeOsmHy5QOLKKhDyh+2aQSwSPeNeBOJdDFt5:JJnbvgQGKoOINwfDJ
- TLSH T186951223E789A8D6D4B3A2358E37919290525C705647E3A31D02B17C4EB7EC893E9FCD
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Queries the phone number (MSISDN for GSM devices)
-
Reads the content of SMS inbox messages.
-
Reads the content of the SMS messages.
-
Requests cell location
Uses Android APIs to to get current cell location.
-
Queries information about active data network
-
Queries information about the current Wi-Fi connection
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC)
-
Reads information about phone network operator.
-
- Target dERlZG
- Size 96KB
- SHA256 77ff63fc4125b3c1bf970feb1722e02cf43c9c4d6abeff4b2cccb6a9e55a51ef
- MD5 38e2a484a18765834e721e42df3b89cb
- SHA1 21bb2bc4f29e40abdb103b9d64af815956cb504b
- SHA512 1ad43dbcfdffe2c21649e043ed3e6a61f81f69ac53bac68a9350624b3613be8c249ff0df5b8b7711cb13e030033d23aa71bc3f730becabede1040417f576a618
- SSDEEP 1536:Kh6mBpBM3vDKmJJj0Z/maH2/88Hsv0SBblAi9HQ1oF1YOVUAOgrULB+hsr:UFKbPIZ/me8Mv0s1q25VU3lBwsr
- TLSH T138A3124FE694F63CE1FBCB34F0E28738B73AC919D961534F682A6088D9336905580F99
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10
MITRE ATT&CK Mobile v16
Defense Evasion
Download New Code at Runtime
1Execution Guardrails
1Geofencing
1Virtualization/Sandbox Evasion
2System Checks
2