aa466eff576c8e6500e3ada97993f6b2d489881f965be0ccb6b2f804543114a2

General

Target
516df1e1a4a556599a30ceebd9660a32_JaffaCakes118.apk
Size 263KB
Sample240331-j19x9sha93
SHA256 aa466eff576c8e6500e3ada97993f6b2d489881f965be0ccb6b2f804543114a2
MD5 516df1e1a4a556599a30ceebd9660a32
SHA1 1c8229f4fe06a4d63eba381e3e4332dcc69c938f
SHA512 e671db2ec516bbb7a1d7308a5123bfd2768c6866316a11c03de2268cc0465999524482097616c5b3ce5ce3bbe899bb6b22956517c718cfedbfb66fd313e201a3
SSDEEP 6144:P1PNvivXSCeVvnD2IJOsBFaw4IzEsS/ZXBc2Y4MT5fNK:P7i6tQIwsBFa/IvcR9UK
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
5029	com.bangkok.kngpmgbv.cwknzgcapmerxi

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.bangkok.kngpmgbv.cwknzgcapmerxi/app_tfile/fields.jar	5029	com.bangkok.kngpmgbv.cwknzgcapmerxi

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.bangkok.kngpmgbv.cwknzgcapmerxi

com.bangkok.kngpmgbv.cwknzgcapmerxi
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:5029

com.bangkok.kngpmgbv.cwknzgcapmerxi:RemoteProcess
1⤵
PID:5067

com.bangkok.kngpmgbv.cwknzgcapmerxi:guard
1⤵
PID:5426

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Hide Artifacts

1

T1628

Suppress Application Icon

1

T1628.001

Credential Access

Discovery

System Network Configuration Discovery

1

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fields.jar

Path /data/data/com.bangkok.kngpmgbv.cwknzgcapmerxi/app_tfile/fields.jar
Size 138KB
SHA256 e900cb4c3fe9d8f45196a7457e9645c65b0f3cde820f4161950252cff67a4d97
MD5 cceb8db3b057d24673d49eda229e9892
SHA1 b18f6353b2156410249079a3b7b86ef3a530e8ee
SHA512 4a42cde3165a706e823caa1362001ed8aa647caf22325a4f2554c64fc4ebcd79afe44fe5eab5474221806f26e7aca9d2901026de6e597ef62fe867f123e4bd57
SSDEEP 3072:KmCi2YMNjc0deii5lYQWVS75lpPQ8NR3h/EiVxqgtp:PCZHZpeiYoVoy8NR3h1VxbX
MD5 SHA1 SHA512 SSDEEP

Submit Download

fields.jar.cur.prof

Path /data/data/com.bangkok.kngpmgbv.cwknzgcapmerxi/app_tfile/oat/fields.jar.cur.prof
Size 369B
SHA256 51491488aa5999f64c4d74c50676559497e9890b2a3978cdc8f07dc782e945ec
MD5 6de41202d76cfb91657a014430e7f33d
SHA1 1c066a98ee1dae3493881522b42a6978ef72ffee
SHA512 765ef4f4ca7a832af8677b8cb38b705a5cf809b6d321f7d86bcb03471d5e55d8c9b8dc04dbad9f89b10febd5e87b29d29e1bd36fa91259ba00ea863ad1225236
MD5 SHA1 SHA512

Submit Download

tbcom.bangkok.kngpmgbv.cwknzgcapmerxi

Path /data/data/com.bangkok.kngpmgbv.cwknzgcapmerxi/databases/tbcom.bangkok.kngpmgbv.cwknzgcapmerxi
Size 36KB
SHA256 b5023c1c2354845e52c945166be1111d7565a000e57ea18d8ce2943c73580e81
MD5 ae8aa93151da27ce1348c21d6ea98a45
SHA1 d187ce29f387717ea0c7d2919a77945a6f04a954
SHA512 7bc212292c6dd5192e2d714d1e06c3109f133bf0f5bddb4dd4113a4b9ab3a8db3ba7e1cab4a7da44724361b8d7d53cdde3d50506cf7264fb00d7b4521014c85a
SSDEEP 24:TLqOfl8M/LxIx2pq4WwHkuEHV6psLT0vGSgIQQ:TPGqdIgpT1EHV6e8eS
MD5 SHA1 SHA512 SSDEEP

Submit Download

tbcom.bangkok.kngpmgbv.cwknzgcapmerxi-journal

Path /data/data/com.bangkok.kngpmgbv.cwknzgcapmerxi/databases/tbcom.bangkok.kngpmgbv.cwknzgcapmerxi-journal
Size 512B
SHA256 f22e0f122765720cbad7e0bbe5442a5409df14e1da39024b75c53d558df9de46
MD5 cbaf148965c51a8b9bead5be8858a8f0
SHA1 1ef0c978cb4849c72c26638aa4d95c318a983779
SHA512 92978e127dd06790e7edf76b189be562b9419e7c4fd6803c6f794596b8ab6d5e3e2d96ed513660a2cd81eceb7e009ab7c5ce3fcb34d4ac0df231c60107ecaac9
MD5 SHA1 SHA512

Submit Download

tbcom.bangkok.kngpmgbv.cwknzgcapmerxi-journal

Path /data/data/com.bangkok.kngpmgbv.cwknzgcapmerxi/databases/tbcom.bangkok.kngpmgbv.cwknzgcapmerxi-journal
Size 8KB
SHA256 c8cda9f19a79a195cf32b7b97c1669db9e52b3a7ba4129877fb853f02c0409e5
MD5 26d666dd6347aba2649f1ec0f6b1e75e
SHA1 bd991c0d9addee4ace268fe7cee21393497245b2
SHA512 a4c1d40c8b312bab82b2c13f9ef385be2728259df11595cf04fc33ee31dd8d7de7ea4b92e754b8ed03db6a7dba352692bfaae0f128f0f0f8a69bc06964bdd92e
SSDEEP 6:7+/l9S4n1eg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKgS/:7+tcbqLiuWdwRmBEyPby/
MD5 SHA1 SHA512 SSDEEP

Submit Download

tbcom.bangkok.kngpmgbv.cwknzgcapmerxi-journal

Path /data/data/com.bangkok.kngpmgbv.cwknzgcapmerxi/databases/tbcom.bangkok.kngpmgbv.cwknzgcapmerxi-journal
Size 8KB
SHA256 42927f9f0ce6443a8532a0f6811bad81dc82eafa06470fa39113335370c478c3
MD5 3d9c1020dc6710271498b8bdbfea04d0
SHA1 e9b00fcc0489ef82c9603fda4c2f0af5b9e79d62
SHA512 8744bfdfffa6f9a6255307aa4ea50075e9d7d0dba3dde11128e94097b0ef5560d8c0cdef32c5e4b2d9bae8ba389a5e4480af76a468722b357b34d845e1c718ca
SSDEEP 6:7+/l9zPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKQ7/nA:7+tBqLJdTRmBEyPbXnA
MD5 SHA1 SHA512 SSDEEP

Submit Download

fields.jar

Path /data/user/0/com.bangkok.kngpmgbv.cwknzgcapmerxi/app_tfile/fields.jar
Size 281KB
SHA256 52132037e9b950a9cb48d6374ee2c6747a6bfe776e13a726395771f1b40ee9da
MD5 73b11c4c10150bbd4f29ad012dc11dde
SHA1 65c83ad32c29f9811c32eda75d7fcdc92ef42dda
SHA512 3e53b1ee22a00e60896da86d2695195e0965c93d190c4d1c0dba2eb5c611d670ee7693a9f8756858255e2b170cb82a753719dd4d6a827af437309b7a1dcc6f01
SSDEEP 3072:1pvE7Pwv2RBvf6O6V/xmK/EOrVLH1QhVHM4e1rSZV7IPelASJ0XQlb0rI5cVgZi7:LdUJaxyOBLejirHqxJQrBXRyOpd
MD5 SHA1 SHA512 SSDEEP

Download

sdsid

Path /storage/emulated/0/Download/sdsid
Size 4B
SHA256 fe675fe7aaee830b6fed09b64e034f84dcbdaeb429d9cccd4ebb90e15af8dd71
MD5 b8c37e33defde51cf91e1e03e51657da
SHA1 dd01903921ea24941c26a48f2cec24e0bb0e8cc7
SHA512 e3d0e2ef3cab0dab2c12f297e3bc618f6b976aced29b3a301828c6f9f1e1aabbe6dab06e1f899c9c2ae2ca86caa330115218817f4ce36d333733cb2b4c7afde7
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads