Analysis
-
max time kernel
150s -
max time network
120s -
platform
android_x86 -
resource
android-x86-arm-20240221-en -
resource tags
-
submitted
18-04-2024 10:17
General
-
Target
f7c9818a25d2bbcbbf464ad5cd4da13c_JaffaCakes118.apk
-
Size
2.8MB
-
MD5
f7c9818a25d2bbcbbf464ad5cd4da13c
-
SHA1
35cebb81310d40329792105deb2706798a799e2c
-
SHA256
1437e111cfc3d76f3397bafc21a4ec81ad08d592ade86645fbbe552f61d7cfbd
-
SHA512
24270fc57f351a5e8eb01909c11376305b72e65d41239e5fcfb110866a1581388bccb855760b87769f3c6249b83ba73eee7ad5c1303da23752a957f2b0add5f1
-
SSDEEP
49152:xc9ma8/sQibfUuCltdJbTs/k+tfSuND4v8SC/mTR95ndMtDb5D2iED5sZ1dtXIaX:xcgyQib8Z7TMk8TND4vxcmTvw5DiDCfB
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Makes use of the framework's Accessibility service 2 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads information about phone network operator. 1 TTPs
Processes
-
com.llldjydh.tpolrlz1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.llldjydh.tpolrlz/code_cache/secondary-dexes/base.apk.classes1.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.llldjydh.tpolrlz/code_cache/secondary-dexes/oat/x86/base.apk.classes1.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
343KB
MD5a4a3588d014de7ba37b239e049c77285
SHA100c31b7ad4a8848fc258d52e15e333656cbcc228
SHA25607bbc2aaba4b2a0c95cb7e90044fd515a78fc96d678d807034eff94630eeee06
SHA512e0fc44be247555b1d396d73d28073587221af415b2957039e337057b969cc911593956ab80175dd55f614cafc79df7faaef22a99a8852559c83991434e71bb1c
-
Filesize
817KB
MD50c8806dacc9e6c7467c8e4c23cebbc17
SHA1053330daf73f696d5d2042bc5946bc7e9113c670
SHA2569f0b91a98e4a5f9b07ba2d6bfc19baa557667e76dc6442c22ef3fad76849dfec
SHA512c87c0cae709bfa591212445465991d5f71cc55e5e8a1d2bbf07e5e7284a2dfcc5fb66532f6d12f81f70abaf5492bacdc0f1171cb0a3cbb2560689a294d4fb42b
-
Filesize
817KB
MD5f63966c50ea4eed0d2ad9183b842efdd
SHA1ff3787b8a1e285482c8f154e05c4a2b696fabb2d
SHA2560f2017b7f0b8a662df4725742be504af37e4a9bdfe4e7abdea5f7fed5bd671ac
SHA512c03246eb2f8d5c73fe05dd3dba966429ac96470e825bff0bc8897490aba26530fad876e78d892166d08daf8c359629272059c8b829a453a60a1ecd4605e3066f