Malware Analysis Report

2024-10-19 12:04

Sample ID 240404-c4n2msch58
Target ad53ff0a6090ab4904bc589ebbf64bb0_JaffaCakes118
SHA256 3154684c4192a1ae7a00f9f61d3024e2d25a85508c512094a771f878c3130848
Tags
hydra banker collection discovery evasion infostealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Mobile Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3154684c4192a1ae7a00f9f61d3024e2d25a85508c512094a771f878c3130848

Threat Level: Known bad

The file ad53ff0a6090ab4904bc589ebbf64bb0_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

hydra banker collection discovery evasion infostealer trojan

Hydra

Makes use of the framework's Accessibility service

Loads dropped Dex/Jar

Looks up external IP address via web service

Reads information about phone network operator.

Declares broadcast receivers with permission to handle system events

Declares services with permission to bind to the system

Requests dangerous framework permissions

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-04 02:38

Signatures

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to request installing packages. android.permission.REQUEST_INSTALL_PACKAGES N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-04 02:37

Reported

2024-04-04 02:41

Platform

android-x86-arm-20240221-en

Max time kernel

150s

Max time network

158s

Command Line

com.vsmucodt.bhvxnft

Signatures

Hydra

banker trojan infostealer hydra

Makes use of the framework's Accessibility service

collection evasion
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.vsmucodt.bhvxnft/gmajmdghbe/fjfhhfzvhyyqggb/base.apk.hgynibx1.xhg N/A N/A
N/A /data/user/0/com.vsmucodt.bhvxnft/gmajmdghbe/fjfhhfzvhyyqggb/base.apk.hgynibx1.xhg N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Reads information about phone network operator.

discovery

Processes

com.vsmucodt.bhvxnft

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.vsmucodt.bhvxnft/gmajmdghbe/fjfhhfzvhyyqggb/base.apk.hgynibx1.xhg --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.vsmucodt.bhvxnft/gmajmdghbe/fjfhhfzvhyyqggb/oat/x86/base.apk.hgynibx1.odex --compiler-filter=quicken --class-loader-context=&

/system/bin/ndk_translation_program_runner_binfmt_misc /data/user/0/com.vsmucodt.bhvxnft/app_torfiles/tor /data/user/0/com.vsmucodt.bhvxnft/app_torfiles/tor -f /data/user/0/com.vsmucodt.bhvxnft/app_torfiles/torrc __OwningControllerProcess 4333

Network

Country Destination Domain Proto
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
GB 142.250.200.42:443 semanticlocation-pa.googleapis.com tcp
US 1.1.1.1:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
GB 142.250.179.238:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 172.217.16.238:443 android.apis.google.com tcp
FR 51.255.41.65:9001 tcp
US 154.35.175.225:443 tcp
DE 144.76.26.175:9011 tcp
RO 109.163.234.9:443 tcp
NL 194.109.206.212:443 tcp
SE 178.16.208.60:443 tcp

Files

/data/data/com.vsmucodt.bhvxnft/gmajmdghbe/fjfhhfzvhyyqggb/tmp-base.apk.hgynibx7316598529726155226.xhg

MD5 dc5e16107784652f5099f744c35ed328
SHA1 326589b22fb30cc39213ee5aa13b44d95528a60c
SHA256 a0f08f6b999f2f21496cfa5ee9ad32e809d6463a845177a9ba1ca47118f87081
SHA512 4a6080c88047254df20e473af9d231d8eb187691bcb6855ab980bd7ebc0137cf5e2064f3c7e8678b7b68292efee47af185f8a80f7d50722f2d6bed1926ea5d2c

/data/user/0/com.vsmucodt.bhvxnft/gmajmdghbe/fjfhhfzvhyyqggb/base.apk.hgynibx1.xhg

MD5 dde288fb8a3b26bc1e943fe18d2407c4
SHA1 4095f659245eb5e149d8e3c8cbd9a9fa70854d30
SHA256 fa5e6db97f003fad821603e02c949b6d3c07a3c63077cb6cf1e5f92dd8c2d3d5
SHA512 58dc81450aff626c175128373e70a9e6b6ef6aa8c03de0b22b12971bd091fa8b4da8f3244f0f56b35beeb51a65d9802b824e57af27a2ee2634033f08f80b3c79

/data/user/0/com.vsmucodt.bhvxnft/gmajmdghbe/fjfhhfzvhyyqggb/base.apk.hgynibx1.xhg

MD5 c75d5adb0ca0beb718c2534bde791dfa
SHA1 68145684528706d1bb0218f79ce8db0e71126498
SHA256 a17c902352d890c6235ee2162a08bc36fab2fd535b07a6de003510d07e55fed7
SHA512 0688265e7e508dad0189b75a23029c846f414122fdc9b4306fcacd6608ad12a27a1e50fadc41c2554e1d858f52ab5b1b7100145acf200a0dd54a971d6292768d

/data/data/com.vsmucodt.bhvxnft/app_torfiles/geoip

MD5 da86c56d98ea812ce6ab42691e4d1197
SHA1 e3c910f3b2a6c916c7be33a943091ef57048b72c
SHA256 9f65eab86508224b41cbf319314c070f33fdecb250d17247da83ab7b4d436159
SHA512 62095ef018a1e2664b380056141e54f224458727229b309f101b0961616a0e5feeaf8428b9b788df4a1408304a46f6d38bcaf9edda770dd6752251995ae49235

/data/data/com.vsmucodt.bhvxnft/app_torfiles/geoip6

MD5 18625900e4f9b58af0db8b4a621058df
SHA1 e8bd5b2e6554c27f718f1222667c09680d75f799
SHA256 296911c0f69a26b5fd65f4552f6a141d6cdbb5979f62b8b7db28e7b97e0698f5
SHA512 347006c25eeac5b5cccecd09dafe814cec569e4741c67d3a35dc47d605ef2110adbc0a4e689077c80216059a6a66454bfa525e3cb6fe5b03a781f1f3b8fac6c8

/data/data/com.vsmucodt.bhvxnft/app_torfiles/torrc

MD5 a5537c6e54c265bd4a318bdc057b604c
SHA1 00e834c03f908659e5beeb57a0828b22c2d09acc
SHA256 c0fbdadf36a2b1ef0b4287b66d3a94312915faf5f10b0861e494ea6c40b62c2e
SHA512 062a02b944e990ae4871b53e83fdf15322140f4c50df286488dc1c7ddad423708d4c4eeb97af7518c4bdb54547ee1188822cfacd4ca3ed7032961625a251cac9

/data/data/com.vsmucodt.bhvxnft/app_torfiles/tor

MD5 3ffe7e540a5be82f50eccd51dde09828
SHA1 e3d9711da7afed4bc89326d3bf80bbfcad7dc5cc
SHA256 805e8995ae913e691ff3e4b6a5fce1c7d11860940ace43a5187a1f548ddcb24b
SHA512 8679cb1df0f82a830e952d0e9628967839dc7a96c178c481dac96ab01c815dec107b4f1b22aa7481aa0071bff9c541d9cb559a0a7268782e3a75874fbbaba7cc

/data/data/com.vsmucodt.bhvxnft/app_torfiles/torrc

MD5 d7f9dc2b2dfbabda8875c0a58ad0ed8c
SHA1 24ffd3fc5647902447f613cfb86e7b7e473f4bd9
SHA256 2dd4f8bd7093ff1ff49e6da36b6753cede4ae8dc1b97a6b62551430624692768
SHA512 321c39254b37c7f51087d5123346f6be53ce05060ba52a7d6aa52080da92232833614498e75aa43e62c3aa33b21d90193e5f3a69ecbe60a2e0d8a52019b1aa84

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-04 02:37

Reported

2024-04-04 02:41

Platform

android-x64-20240221-en

Max time kernel

153s

Max time network

153s

Command Line

com.vsmucodt.bhvxnft

Signatures

Hydra

banker trojan infostealer hydra

Makes use of the framework's Accessibility service

collection evasion
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.vsmucodt.bhvxnft/gmajmdghbe/fjfhhfzvhyyqggb/base.apk.hgynibx1.xhg N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Reads information about phone network operator.

discovery

Processes

com.vsmucodt.bhvxnft

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 216.58.213.8:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
GB 142.250.178.14:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 216.58.212.206:443 android.apis.google.com tcp
GB 216.58.204.68:443 tcp
US 1.1.1.1:53 www.google.com udp
GB 142.250.187.228:443 www.google.com tcp
GB 142.250.187.238:443 tcp
GB 142.250.200.2:443 tcp

Files

/data/data/com.vsmucodt.bhvxnft/gmajmdghbe/fjfhhfzvhyyqggb/tmp-base.apk.hgynibx1299452750226043450.xhg

MD5 dc5e16107784652f5099f744c35ed328
SHA1 326589b22fb30cc39213ee5aa13b44d95528a60c
SHA256 a0f08f6b999f2f21496cfa5ee9ad32e809d6463a845177a9ba1ca47118f87081
SHA512 4a6080c88047254df20e473af9d231d8eb187691bcb6855ab980bd7ebc0137cf5e2064f3c7e8678b7b68292efee47af185f8a80f7d50722f2d6bed1926ea5d2c

/data/user/0/com.vsmucodt.bhvxnft/gmajmdghbe/fjfhhfzvhyyqggb/base.apk.hgynibx1.xhg

MD5 dde288fb8a3b26bc1e943fe18d2407c4
SHA1 4095f659245eb5e149d8e3c8cbd9a9fa70854d30
SHA256 fa5e6db97f003fad821603e02c949b6d3c07a3c63077cb6cf1e5f92dd8c2d3d5
SHA512 58dc81450aff626c175128373e70a9e6b6ef6aa8c03de0b22b12971bd091fa8b4da8f3244f0f56b35beeb51a65d9802b824e57af27a2ee2634033f08f80b3c79

/data/data/com.vsmucodt.bhvxnft/app_torfiles/geoip

MD5 da86c56d98ea812ce6ab42691e4d1197
SHA1 e3c910f3b2a6c916c7be33a943091ef57048b72c
SHA256 9f65eab86508224b41cbf319314c070f33fdecb250d17247da83ab7b4d436159
SHA512 62095ef018a1e2664b380056141e54f224458727229b309f101b0961616a0e5feeaf8428b9b788df4a1408304a46f6d38bcaf9edda770dd6752251995ae49235

/data/data/com.vsmucodt.bhvxnft/app_torfiles/geoip6

MD5 18625900e4f9b58af0db8b4a621058df
SHA1 e8bd5b2e6554c27f718f1222667c09680d75f799
SHA256 296911c0f69a26b5fd65f4552f6a141d6cdbb5979f62b8b7db28e7b97e0698f5
SHA512 347006c25eeac5b5cccecd09dafe814cec569e4741c67d3a35dc47d605ef2110adbc0a4e689077c80216059a6a66454bfa525e3cb6fe5b03a781f1f3b8fac6c8

/data/data/com.vsmucodt.bhvxnft/app_torfiles/torrc

MD5 a5537c6e54c265bd4a318bdc057b604c
SHA1 00e834c03f908659e5beeb57a0828b22c2d09acc
SHA256 c0fbdadf36a2b1ef0b4287b66d3a94312915faf5f10b0861e494ea6c40b62c2e
SHA512 062a02b944e990ae4871b53e83fdf15322140f4c50df286488dc1c7ddad423708d4c4eeb97af7518c4bdb54547ee1188822cfacd4ca3ed7032961625a251cac9

/data/data/com.vsmucodt.bhvxnft/app_torfiles/tor

MD5 3ffe7e540a5be82f50eccd51dde09828
SHA1 e3d9711da7afed4bc89326d3bf80bbfcad7dc5cc
SHA256 805e8995ae913e691ff3e4b6a5fce1c7d11860940ace43a5187a1f548ddcb24b
SHA512 8679cb1df0f82a830e952d0e9628967839dc7a96c178c481dac96ab01c815dec107b4f1b22aa7481aa0071bff9c541d9cb559a0a7268782e3a75874fbbaba7cc

/data/data/com.vsmucodt.bhvxnft/app_torfiles/torrc

MD5 d7f9dc2b2dfbabda8875c0a58ad0ed8c
SHA1 24ffd3fc5647902447f613cfb86e7b7e473f4bd9
SHA256 2dd4f8bd7093ff1ff49e6da36b6753cede4ae8dc1b97a6b62551430624692768
SHA512 321c39254b37c7f51087d5123346f6be53ce05060ba52a7d6aa52080da92232833614498e75aa43e62c3aa33b21d90193e5f3a69ecbe60a2e0d8a52019b1aa84

Analysis: behavioral3

Detonation Overview

Submitted

2024-04-04 02:37

Reported

2024-04-04 02:41

Platform

android-x64-arm64-20240221-en

Max time kernel

148s

Max time network

152s

Command Line

com.vsmucodt.bhvxnft

Signatures

Hydra

banker trojan infostealer hydra

Makes use of the framework's Accessibility service

collection evasion
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.vsmucodt.bhvxnft/gmajmdghbe/fjfhhfzvhyyqggb/base.apk.hgynibx1.xhg N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Reads information about phone network operator.

discovery

Processes

com.vsmucodt.bhvxnft

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.178.14:443 udp
GB 142.250.200.46:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.238:443 android.apis.google.com tcp
GB 142.250.187.238:443 android.apis.google.com tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 216.58.204.72:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
GB 142.250.200.36:443 tcp
GB 142.250.200.36:443 tcp

Files

/data/user/0/com.vsmucodt.bhvxnft/gmajmdghbe/fjfhhfzvhyyqggb/tmp-base.apk.hgynibx2780530102768431115.xhg

MD5 dc5e16107784652f5099f744c35ed328
SHA1 326589b22fb30cc39213ee5aa13b44d95528a60c
SHA256 a0f08f6b999f2f21496cfa5ee9ad32e809d6463a845177a9ba1ca47118f87081
SHA512 4a6080c88047254df20e473af9d231d8eb187691bcb6855ab980bd7ebc0137cf5e2064f3c7e8678b7b68292efee47af185f8a80f7d50722f2d6bed1926ea5d2c

/data/user/0/com.vsmucodt.bhvxnft/gmajmdghbe/fjfhhfzvhyyqggb/base.apk.hgynibx1.xhg

MD5 dde288fb8a3b26bc1e943fe18d2407c4
SHA1 4095f659245eb5e149d8e3c8cbd9a9fa70854d30
SHA256 fa5e6db97f003fad821603e02c949b6d3c07a3c63077cb6cf1e5f92dd8c2d3d5
SHA512 58dc81450aff626c175128373e70a9e6b6ef6aa8c03de0b22b12971bd091fa8b4da8f3244f0f56b35beeb51a65d9802b824e57af27a2ee2634033f08f80b3c79

/data/user/0/com.vsmucodt.bhvxnft/app_torfiles/geoip

MD5 da86c56d98ea812ce6ab42691e4d1197
SHA1 e3c910f3b2a6c916c7be33a943091ef57048b72c
SHA256 9f65eab86508224b41cbf319314c070f33fdecb250d17247da83ab7b4d436159
SHA512 62095ef018a1e2664b380056141e54f224458727229b309f101b0961616a0e5feeaf8428b9b788df4a1408304a46f6d38bcaf9edda770dd6752251995ae49235

/data/user/0/com.vsmucodt.bhvxnft/app_torfiles/geoip6

MD5 18625900e4f9b58af0db8b4a621058df
SHA1 e8bd5b2e6554c27f718f1222667c09680d75f799
SHA256 296911c0f69a26b5fd65f4552f6a141d6cdbb5979f62b8b7db28e7b97e0698f5
SHA512 347006c25eeac5b5cccecd09dafe814cec569e4741c67d3a35dc47d605ef2110adbc0a4e689077c80216059a6a66454bfa525e3cb6fe5b03a781f1f3b8fac6c8

/data/user/0/com.vsmucodt.bhvxnft/app_torfiles/torrc

MD5 a5537c6e54c265bd4a318bdc057b604c
SHA1 00e834c03f908659e5beeb57a0828b22c2d09acc
SHA256 c0fbdadf36a2b1ef0b4287b66d3a94312915faf5f10b0861e494ea6c40b62c2e
SHA512 062a02b944e990ae4871b53e83fdf15322140f4c50df286488dc1c7ddad423708d4c4eeb97af7518c4bdb54547ee1188822cfacd4ca3ed7032961625a251cac9

/data/user/0/com.vsmucodt.bhvxnft/app_torfiles/tor

MD5 3ffe7e540a5be82f50eccd51dde09828
SHA1 e3d9711da7afed4bc89326d3bf80bbfcad7dc5cc
SHA256 805e8995ae913e691ff3e4b6a5fce1c7d11860940ace43a5187a1f548ddcb24b
SHA512 8679cb1df0f82a830e952d0e9628967839dc7a96c178c481dac96ab01c815dec107b4f1b22aa7481aa0071bff9c541d9cb559a0a7268782e3a75874fbbaba7cc

/data/user/0/com.vsmucodt.bhvxnft/app_torfiles/torrc

MD5 d7f9dc2b2dfbabda8875c0a58ad0ed8c
SHA1 24ffd3fc5647902447f613cfb86e7b7e473f4bd9
SHA256 2dd4f8bd7093ff1ff49e6da36b6753cede4ae8dc1b97a6b62551430624692768
SHA512 321c39254b37c7f51087d5123346f6be53ce05060ba52a7d6aa52080da92232833614498e75aa43e62c3aa33b21d90193e5f3a69ecbe60a2e0d8a52019b1aa84