29dd9e53a5b10a1ce5825cfee804122d7f6abc5e762d73098fcf5c7b7046ab2c

General

Target
9494d9482bcb6f3d07195dfdfd1401c1_JaffaCakes118.apk
Size 254KB
Sample240402-xrd15aaf55
SHA256 29dd9e53a5b10a1ce5825cfee804122d7f6abc5e762d73098fcf5c7b7046ab2c
MD5 9494d9482bcb6f3d07195dfdfd1401c1
SHA1 e9a942a0dbde2269d1c973d38c444ce606802b38
SHA512 46104046850916074fcceaaaa9944c15b7846d65da74828c30e413eaca565583f733f4fb5f77a1efddfee473040dc616284b69c034434947269554433cd7db55
SSDEEP 6144:byF34N/hBX7g3DWkfaT9O5bjhONLpkHn7id3nq6I:uaN/TLEhfaQ5bjhOpI2dU
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

evasion stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
5032	net.droidjack.server

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	net.droidjack.server

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
6	0.tcp.ngrok.io
22	0.tcp.ngrok.io
30	0.tcp.ngrok.io

net.droidjack.server
1⤵
- Removes its main activity from the application launcher
- Acquires the wake lock
PID:5032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1628

Suppress Application Icon

1

T1628.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SandroRat_Configuration_Database

Path /data/data/net.droidjack.server/databases/SandroRat_Configuration_Database
Size 16KB
SHA256 4da0f7c511a540be366bd92014b6279194cf5da3c47ddb8acb48526f1ad967ab
MD5 ab9b76032f3671e636504f620ed4d205
SHA1 21e1e3ef5f95af48acdd224ef1f40ff12467521d
SHA512 9e133dfb122855076eec7967f0e73fef6f8cdd655b32f9ee5d8cc7de1114212d10764839359b38b63e73772517910662109d87336a8507a99ca1085758841725
SSDEEP 6:l9bNFlqals1XMAIXIEFtLuJIs/FcERX4PBX4ogLugMBX4suuK0DqiOw:TLpEXMAIXINJIWfRmBEyPbBvOw
MD5 SHA1 SHA512 SSDEEP

Submit Download

SandroRat_Configuration_Database

Path /data/data/net.droidjack.server/databases/SandroRat_Configuration_Database
Size 16KB
SHA256 7b70360e7320d753e534d28e2955c11780ffebb99405beb3b02c1e9ca87bd2e6
MD5 85ce313c20a8b011661a026d2cdfae08
SHA1 11b4c6c4b53019df75f848b61858899aeb3c22c6
SHA512 44b9eff34cd3b3da92fd23ab4379703f95512cddc8ef93363a7ce17f017e00fb9e676b3ebcc967b1cf77bcda5202ff37f51b6743e9250fa04262ae964f34c34a
SSDEEP 6:l9bNFluls1ENMAIXIEFtLuJIs/FcERX4PBX4ogLugMBX4suuK+/jqTaw+8LOH:TL8EENMAIXINJIWfRmBEyPbP/ydbw
MD5 SHA1 SHA512 SSDEEP

Submit Download

SandroRat_Configuration_Database

Path /data/data/net.droidjack.server/databases/SandroRat_Configuration_Database
Size 16KB
SHA256 eed85ddb4b8c35fd71dd0de2dce1cc7d66ff64a064581635b32524690d8ea3bb
MD5 4312c971b08306f17a624c580a8429a6
SHA1 4109186f09628f723cfccb91e06b15643522511b
SHA512 9e7e5b06d586e0fe5aa512fcf7a690d6f527b04d760994e284dbbcff09cb4289445e9f2efd5aa856da790daffe06037ba74f784b97febffed9879698c74ba813
SSDEEP 6:l9bNFl4/Sls1OqMAIXIEFtLuJIs/FcERX4PBX4ogLugMBX4suuK+/20aUehVo+8E:TLWuEOqMAIXINJIWfRmBEyPbP/yhobw
MD5 SHA1 SHA512 SSDEEP

Submit Download