Analysis
-
max time kernel
154s -
max time network
146s -
platform
android_x64 -
resource
android-x64-20240221-en -
resource tags
-
submitted
20-04-2024 18:46
General
-
Target
fd642953848d954af2a2733139e884f3_JaffaCakes118.apk
-
Size
3.2MB
-
MD5
fd642953848d954af2a2733139e884f3
-
SHA1
222240420ee054cace1202fd13ea97029eb922b1
-
SHA256
03c8cba14139423ec179759052b178852ef7a3884a969876c2123bec7f7f8c65
-
SHA512
df627de0e622f04cdb79ec7b260edfb7369daf95fc23eef3550d76542cac111afd111e517c323f8e183481551d24d3307e1cde389e14190158185dbee741f0c2
-
SSDEEP
98304:GPOqbet6/pUC+PozHjXu1DbrXU6HopT3W3M:GPOBtxMBooJ3H
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks if the internet connection is available 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads information about phone network operator. 1 TTPs
Processes
-
com.sqjuuzpr.ryxjuzs1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
378KB
MD5b11953d70ceeb77105f82251a3fc93e4
SHA1fb156b1198b7239b218358da2c17cf0511abff14
SHA2569dacc18d851223e579880e96ae92d7899ebeb3cae897e9115d4bbb1405cf93e5
SHA51243682f823db98f37586e66b0880443ba428bce6e6bb40f1770a6d8f0d0c098e88dd42cbf99a128f28cc1e6c2d067a5700d74f3362fb1cdac3446f41e88d83dbd
-
Filesize
902KB
MD5e095f5b8904f828bb3c5208a6b793116
SHA150b997f1924e5ddce9d3ce62b53db21c45c7791b
SHA2568009f9b2b0de069da9f7991b6acae899d58054df49347fe112b2771bef865469
SHA512de606e6fbc6b05eab1332ceb335b9ce79f35e28954967d448fcf358f78e879ba83c1dfa12fecfb342700e76052c5f937b54e38c83bd2ab4b9a3dd5c9abc1680f