Analysis
-
max time kernel
149s -
max time network
131s -
platform
android_x86 -
resource
android-x86-arm-20240221-en -
resource tags
-
submitted
20-04-2024 18:46
General
-
Target
fd642953848d954af2a2733139e884f3_JaffaCakes118.apk
-
Size
3.2MB
-
MD5
fd642953848d954af2a2733139e884f3
-
SHA1
222240420ee054cace1202fd13ea97029eb922b1
-
SHA256
03c8cba14139423ec179759052b178852ef7a3884a969876c2123bec7f7f8c65
-
SHA512
df627de0e622f04cdb79ec7b260edfb7369daf95fc23eef3550d76542cac111afd111e517c323f8e183481551d24d3307e1cde389e14190158185dbee741f0c2
-
SSDEEP
98304:GPOqbet6/pUC+PozHjXu1DbrXU6HopT3W3M:GPOBtxMBooJ3H
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks if the internet connection is available 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads information about phone network operator. 1 TTPs
Processes
-
com.sqjuuzpr.ryxjuzs1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.sqjuuzpr.ryxjuzs/code_cache/secondary-dexes/base.apk.classes1.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.sqjuuzpr.ryxjuzs/code_cache/secondary-dexes/oat/x86/base.apk.classes1.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
378KB
MD5b11953d70ceeb77105f82251a3fc93e4
SHA1fb156b1198b7239b218358da2c17cf0511abff14
SHA2569dacc18d851223e579880e96ae92d7899ebeb3cae897e9115d4bbb1405cf93e5
SHA51243682f823db98f37586e66b0880443ba428bce6e6bb40f1770a6d8f0d0c098e88dd42cbf99a128f28cc1e6c2d067a5700d74f3362fb1cdac3446f41e88d83dbd
-
Filesize
902KB
MD5508514b943107433b9d6a027813b2af8
SHA101573be467fefcda5a1f180aad243ee2ffb88476
SHA2561a05673cd0d7961bc9c2e48482d03277b931c1c4c19e247b2e2b84033d9d9901
SHA512f7f1c0502fa3fc6d7e47f05113b6cf09713e5bea427bacd4a87e6b117de31e61de766de586a4dfbc2b4956b7dd815accae222ae4c8c4f02ca6e2683585266199
-
Filesize
902KB
MD5e095f5b8904f828bb3c5208a6b793116
SHA150b997f1924e5ddce9d3ce62b53db21c45c7791b
SHA2568009f9b2b0de069da9f7991b6acae899d58054df49347fe112b2771bef865469
SHA512de606e6fbc6b05eab1332ceb335b9ce79f35e28954967d448fcf358f78e879ba83c1dfa12fecfb342700e76052c5f937b54e38c83bd2ab4b9a3dd5c9abc1680f