29dd9e53a5b10a1ce5825cfee804122d7f6abc5e762d73098fcf5c7b7046ab2c

Analysis

max time kernel
146s
max time network
154s
platform
android_x64
resource
android-x64-arm64-20240221-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
submitted
02/04/2024, 19:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9494d9482bcb6f3d07195dfdfd1401c1_JaffaCakes118.apk
Size 254KB
Sample240402-xrd15aaf55
SHA256 29dd9e53a5b10a1ce5825cfee804122d7f6abc5e762d73098fcf5c7b7046ab2c
MD5 9494d9482bcb6f3d07195dfdfd1401c1
SHA1 e9a942a0dbde2269d1c973d38c444ce606802b38
SHA512 46104046850916074fcceaaaa9944c15b7846d65da74828c30e413eaca565583f733f4fb5f77a1efddfee473040dc616284b69c034434947269554433cd7db55
SSDEEP 6144:byF34N/hBX7g3DWkfaT9O5bjhONLpkHn7id3nq6I:uaN/TLEhfaQ5bjhOpI2dU
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

evasion stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4379	net.droidjack.server

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	net.droidjack.server

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
43	0.tcp.ngrok.io
49	0.tcp.ngrok.io
25	0.tcp.ngrok.io

net.droidjack.server
1⤵
- Removes its main activity from the application launcher
- Acquires the wake lock
PID:4379

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SandroRat_Configuration_Database

Path /data/user/0/net.droidjack.server/databases/SandroRat_Configuration_Database
Size 16KB
SHA256 27df39c9b9de413f6bc5ccd57272857ef5500c20ffc8b4e90e35088b3f4af80f
MD5 70ab0184149f2a2235ce82b245bb5c3a
SHA1 ee3b0fbc494cf364705fddb1f3ff3503e4f70ffa
SHA512 52d291e398d4b4c5d754d02aa2afbce0b8f87c71b60ba5f29f2d6adc6f72318b97d7fc252fbb77a6cc721b6a7c0cf052c58ddd0648069bbeb5ab259089a22cd2
SSDEEP 6:l9bNFlqals1r/TMAIXIEFtLuJIs/FcERX4PBX4ogLugMBX4suuK0DqiOw:TLpEvMAIXINJIWfRmBEyPbBvOw
MD5 SHA1 SHA512 SSDEEP

Submit Download

SandroRat_Configuration_Database

Path /data/user/0/net.droidjack.server/databases/SandroRat_Configuration_Database
Size 16KB
SHA256 f02784e6e69a91bbdd728886c297b52211f3c203c1b52bfa69c737466004f029
MD5 3dcb8abeb0bfa1fd4504742be9bd2e03
SHA1 119c7615947d979766f1f92c0ef008b4ac86f4d9
SHA512 0ad53256202bb4f62a1adedabebaa5882bb791c3ef761ab2fa3a05b8ad497ee8388da4657efe3c46a57507699b4562e2e0c2ecebc62c50334b497a174edc4597
SSDEEP 6:l9bNFluls1ETMAIXIEFtLuJIs/FcERX4PBX4ogLugMBX4suuK+/jqTaw+8LOH:TL8EcMAIXINJIWfRmBEyPbP/ydbw
MD5 SHA1 SHA512 SSDEEP

Submit Download

SandroRat_Configuration_Database

Path /data/user/0/net.droidjack.server/databases/SandroRat_Configuration_Database
Size 16KB
SHA256 92e34183e961cc5d5930cc0254f766021307c8ec8a6dcaf2e2fcfffe511b71ba
MD5 f99ebc7609a929306d5259074bf08bbe
SHA1 2a8a3cb7918b7f7be44630ae497b9df303f8280e
SHA512 abe426b03dac27b98c83bd447e2598f59350d1d6e7a6d6ffbed10f4df7ff674f543ca1b5ad6aac0e6404e67f48482f7aaffb6ae6209dd9f7754484bf5548b892
SSDEEP 6:l9bNFl4/Sls1mGTMAIXIEFtLuJIs/FcERX4PBX4ogLugMBX4suuK+/20aUehVo+R:TLWuEm6MAIXINJIWfRmBEyPbP/yhobw
MD5 SHA1 SHA512 SSDEEP

Submit Download