abfd0c592a86e779c88151d4e4e4c6ec9d7ec29c39a902f3a2584a3c70390f75

Analysis

max time kernel
14s
max time network
158s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
20-04-2024 16:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd24a353333290823f091b8009e14442_JaffaCakes118.apk
Size

3.6MB
MD5

fd24a353333290823f091b8009e14442
SHA1

286dfdecb8fbc68edf97859b14a4e0c3c40dfee2
SHA256

abfd0c592a86e779c88151d4e4e4c6ec9d7ec29c39a902f3a2584a3c70390f75
SHA512

05e00a2dd441793a284ffe8adb9dbeef81971ee2a5e269bec5386110fc772ad0efe2f0f159bdc5d35dc4826b5bd85976ff4ddebbce456f4c98207effaa523316
SSDEEP

98304:RIhYqJ3fddrDdc9nNn4RreXSbfcGnWHpBwVbJszAewxegk:ihYqJ3lpm9Nn4VeXSodpBWb6wxegk

Score

7^/10

evasion impact

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.chzzxds.app/files/_RunDex_/ts.dex	4313	com.chzzxds.app
/data/user/0/com.chzzxds.app/files/_RunDex_/ts.dex	4382	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.chzzxds.app/files/_RunDex_/ts.dex --output-vdex-fd=57 --oat-fd=61 --oat-location=/data/user/0/com.chzzxds.app/files/_RunDex_/oat/x86/ts.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.chzzxds.app/files/_RunDex_/ts.dex	4313	com.chzzxds.app

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.chzzxds.app

com.chzzxds.app
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4313
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.chzzxds.app/files/_RunDex_/ts.dex --output-vdex-fd=57 --oat-fd=61 --oat-location=/data/user/0/com.chzzxds.app/files/_RunDex_/oat/x86/ts.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4382

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact