aa466eff576c8e6500e3ada97993f6b2d489881f965be0ccb6b2f804543114a2

General

Target
516df1e1a4a556599a30ceebd9660a32_JaffaCakes118.apk
Size 263KB
Sample240331-j19x9sha93
SHA256 aa466eff576c8e6500e3ada97993f6b2d489881f965be0ccb6b2f804543114a2
MD5 516df1e1a4a556599a30ceebd9660a32
SHA1 1c8229f4fe06a4d63eba381e3e4332dcc69c938f
SHA512 e671db2ec516bbb7a1d7308a5123bfd2768c6866316a11c03de2268cc0465999524482097616c5b3ce5ce3bbe899bb6b22956517c718cfedbfb66fd313e201a3
SSDEEP 6144:P1PNvivXSCeVvnD2IJOsBFaw4IzEsS/ZXBc2Y4MT5fNK:P7i6tQIwsBFa/IvcR9UK
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

evasion stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4269	com.bangkok.kngpmgbv.cwknzgcapmerxi

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.bangkok.kngpmgbv.cwknzgcapmerxi/app_tfile/fields.jar	4308	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.bangkok.kngpmgbv.cwknzgcapmerxi/app_tfile/fields.jar --output-vdex-fd=48 --oat-fd=49 --oat-location=/data/user/0/com.bangkok.kngpmgbv.cwknzgcapmerxi/app_tfile/oat/x86/fields.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.bangkok.kngpmgbv.cwknzgcapmerxi/app_tfile/fields.jar	4269	com.bangkok.kngpmgbv.cwknzgcapmerxi

com.bangkok.kngpmgbv.cwknzgcapmerxi
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
PID:4269
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.bangkok.kngpmgbv.cwknzgcapmerxi/app_tfile/fields.jar --output-vdex-fd=48 --oat-fd=49 --oat-location=/data/user/0/com.bangkok.kngpmgbv.cwknzgcapmerxi/app_tfile/oat/x86/fields.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4308

com.bangkok.kngpmgbv.cwknzgcapmerxi:RemoteProcess
1⤵
PID:4324

com.bangkok.kngpmgbv.cwknzgcapmerxi:guard
1⤵
PID:4608

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Hide Artifacts

1

T1628

Suppress Application Icon

1

T1628.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fields.jar

Path /data/data/com.bangkok.kngpmgbv.cwknzgcapmerxi/app_tfile/fields.jar
Size 138KB
SHA256 e900cb4c3fe9d8f45196a7457e9645c65b0f3cde820f4161950252cff67a4d97
MD5 cceb8db3b057d24673d49eda229e9892
SHA1 b18f6353b2156410249079a3b7b86ef3a530e8ee
SHA512 4a42cde3165a706e823caa1362001ed8aa647caf22325a4f2554c64fc4ebcd79afe44fe5eab5474221806f26e7aca9d2901026de6e597ef62fe867f123e4bd57
SSDEEP 3072:KmCi2YMNjc0deii5lYQWVS75lpPQ8NR3h/EiVxqgtp:PCZHZpeiYoVoy8NR3h1VxbX
MD5 SHA1 SHA512 SSDEEP

Submit Download

tbcom.bangkok.kngpmgbv.cwknzgcapmerxi

Path /data/data/com.bangkok.kngpmgbv.cwknzgcapmerxi/databases/tbcom.bangkok.kngpmgbv.cwknzgcapmerxi
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

tbcom.bangkok.kngpmgbv.cwknzgcapmerxi-journal

Path /data/data/com.bangkok.kngpmgbv.cwknzgcapmerxi/databases/tbcom.bangkok.kngpmgbv.cwknzgcapmerxi-journal
Size 512B
SHA256 e3f7216e84e227c275676557587676ed1b5b7500ad8616224e51f4be5362492a
MD5 3a955750a80a7b410e78bc6ee0d680fb
SHA1 1d3c8742188f405dbdf0314785eb10845514f27c
SHA512 010c9b64be0015d37ff2e4fa346453f552379db5f76080c6f5f6142fc58c875cd2a189560236f19a8fc3187a4fa757c35b30b38442ef3a36cf5f627156c6d984
MD5 SHA1 SHA512

Submit Download

tbcom.bangkok.kngpmgbv.cwknzgcapmerxi-shm

Path /data/data/com.bangkok.kngpmgbv.cwknzgcapmerxi/databases/tbcom.bangkok.kngpmgbv.cwknzgcapmerxi-shm
Size 28KB
SHA256 18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
MD5 cf845a781c107ec1346e849c9dd1b7e8
SHA1 b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA512 4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

tbcom.bangkok.kngpmgbv.cwknzgcapmerxi-wal

Path /data/data/com.bangkok.kngpmgbv.cwknzgcapmerxi/databases/tbcom.bangkok.kngpmgbv.cwknzgcapmerxi-wal
Size 48KB
SHA256 ce83c9c5fe88ac2855517c5e82135499a354df312c0fe8fe6bedbc46ebdfd5b8
MD5 71d4032d8f76b4ae1400d554d30db4c3
SHA1 9119dddc126f289571e3403f0a198fcb13493586
SHA512 8ddf748035dc759d138539f7544abccb9b821480c7233343b0b43f4f9cda3f60c415e751bb99735b746c4ca261f813a5fe5183b7903e1561a3cb9440d2eddabd
SSDEEP 48:1zNSP/9LvZGqdIgpT1EHV6e8eSP/IAxyW:x0P9w5gpeHYBPgS9
MD5 SHA1 SHA512 SSDEEP

Submit Download

fields.jar

Path /data/user/0/com.bangkok.kngpmgbv.cwknzgcapmerxi/app_tfile/fields.jar
Size 281KB
SHA256 71c5cdeeaea45916c993908370cb7b1d60911d8e233dc9d1def0e75915e4548e
MD5 4654f352b1b2095d54e0945af0e3948c
SHA1 4819b9827e70025c72a74869a85c996d92603931
SHA512 a58ba607dbdb9af50beb9bec719e24c7d4e457e6bd9a6ef71460b0ee629f002788ac8a93d2d18728304c695fca3ac000138f19427c064cd66c628dab8a839ce3
SSDEEP 3072:1pvE7Pwv2RBvfjst2seA29yiNYoBwwimVEAlkT0mTXZ6QzS5C/4260XQlb0rI5cL:LdUqtZ29yToCwFzkT0M4tQrBXRyOpd
MD5 SHA1 SHA512 SSDEEP

Download

fields.jar

Path /data/user/0/com.bangkok.kngpmgbv.cwknzgcapmerxi/app_tfile/fields.jar
Size 281KB
SHA256 52132037e9b950a9cb48d6374ee2c6747a6bfe776e13a726395771f1b40ee9da
MD5 73b11c4c10150bbd4f29ad012dc11dde
SHA1 65c83ad32c29f9811c32eda75d7fcdc92ef42dda
SHA512 3e53b1ee22a00e60896da86d2695195e0965c93d190c4d1c0dba2eb5c611d670ee7693a9f8756858255e2b170cb82a753719dd4d6a827af437309b7a1dcc6f01
SSDEEP 3072:1pvE7Pwv2RBvf6O6V/xmK/EOrVLH1QhVHM4e1rSZV7IPelASJ0XQlb0rI5cVgZi7:LdUJaxyOBLejirHqxJQrBXRyOpd
MD5 SHA1 SHA512 SSDEEP

Download

sdsid

Path /storage/emulated/0/Download/sdsid
Size 4B
SHA256 fe675fe7aaee830b6fed09b64e034f84dcbdaeb429d9cccd4ebb90e15af8dd71
MD5 b8c37e33defde51cf91e1e03e51657da
SHA1 dd01903921ea24941c26a48f2cec24e0bb0e8cc7
SHA512 e3d0e2ef3cab0dab2c12f297e3bc618f6b976aced29b3a301828c6f9f1e1aabbe6dab06e1f899c9c2ae2ca86caa330115218817f4ce36d333733cb2b4c7afde7
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads