General
- Target jaffacakes118_not-a-virus.HEUR.AdWare.AndroidOS.Ewind.jg.0b54e77f933c360e99dbf
- Size 1.1MB
- Sample261015-ddc25aew3y
- SHA256 268c74ae7168fda9093287c2c7a7b4d1d69ee2c30d637a034051cf602a12dfdd
- MD5 635232d38100b54e77f933c360e99dbf
- SHA1 61dce3edafc26105bf6f25739cb5a299e0e6f023
- SHA512 6617275f0e4a16c099c454e01778e97abb5c2a5703050949aa8cd99e70986f2c2603b768825ba6aab88169f7ff52067ad29b8cf43361ab5e744e917841841d6b
- SSDEEP 24576:gJ1cde9duB6FFaxC65Bwb1mvp5tpicgxUSXg8g2dkbw7wmfHLv2SmX5fmZRa:gJ1p9duB6FFaxCUvTtpicyUSQ8g2ubiu
- TLSH T19C3523B2ECC8A500E50E62B5B4A95CFB5D261B4490D7F6DF0A4873C3C9E1F815E47AAC
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
jaffacakes118_not-a-virus.HEUR.AdWare.AndroidOS.Ewind.jg.apk
Resource
android-x86-arm-20260325-en
Behavioral task
behavioral2
Sample
jaffacakes118_not-a-virus.HEUR.AdWare.AndroidOS.Ewind.jg.apk
Resource
android-x64-20260325-en
Behavioral task
behavioral3
Sample
jaffacakes118_not-a-virus.HEUR.AdWare.AndroidOS.Ewind.jg.apk
Resource
android-x64-arm64-20260325-en
Malware Config
Targets
-
- Target jaffacakes118_not-a-virus.HEUR.AdWare.AndroidOS.Ewind.jg.0b54e77f933c360e99dbf
- Size 1.1MB
- SHA256 268c74ae7168fda9093287c2c7a7b4d1d69ee2c30d637a034051cf602a12dfdd
- MD5 635232d38100b54e77f933c360e99dbf
- SHA1 61dce3edafc26105bf6f25739cb5a299e0e6f023
- SHA512 6617275f0e4a16c099c454e01778e97abb5c2a5703050949aa8cd99e70986f2c2603b768825ba6aab88169f7ff52067ad29b8cf43361ab5e744e917841841d6b
- SSDEEP 24576:gJ1cde9duB6FFaxC65Bwb1mvp5tpicgxUSXg8g2dkbw7wmfHLv2SmX5fmZRa:gJ1p9duB6FFaxCUvTtpicyUSQ8g2ubiu
- TLSH T19C3523B2ECC8A500E50E62B5B4A95CFB5D261B4490D7F6DF0A4873C3C9E1F815E47AAC
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Obtains sensitive information copied to the device clipboard
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about the current nearby Wi-Fi networks
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
-
Requests cell location
Uses Android APIs to to get current cell location.
-
Queries information about active data network
-
Queries information about the current Wi-Fi connection
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC)
-
Queries the unique device ID (IMEI, MEID, IMSI)
-
Reads information about phone network operator.
MITRE ATT&CK Mobile v16
Defense Evasion
Download New Code at Runtime
1Execution Guardrails
1Geofencing
1Virtualization/Sandbox Evasion
2System Checks
2