Analysis
-
max time kernel
12s -
max time network
130s -
platform
android_x86 -
resource
android-x86-arm-20240221-en -
resource tags
-
submitted
28-04-2024 09:28
General
-
Target
04e10c3ee1c361baf4c4447e4937c4ee_JaffaCakes118.apk
-
Size
8.8MB
-
MD5
04e10c3ee1c361baf4c4447e4937c4ee
-
SHA1
52cdc8caabfd993ca92e13a47558ad7f5385e38e
-
SHA256
43f1a1b6be35e9067e53a627f001de750ba21ed0c9bb8d6ee3bf2b0134d95843
-
SHA512
d0dbb0de17f8ef923abcddc54e8db18d20493d5ca7e24be91cb204344903da08167d9d4c4ae8b9087e96ad8b1155fed8e676b62076e1a649f034dbec1343e231
-
SSDEEP
196608:FNR1/V4EozI9PHp4Vi4rBaoVyL3tcPqdVZI5l2TtTh2yt0Vmxjh3wC/:nzLC6R6MVyPq/ZI5lCPvGVm3p/
Malware Config
Signatures
-
Loads dropped Dex/Jar 1 TTPs 6 IoCs
Runs executable file dropped to the device during analysis.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.lion.zte.asp.gl1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.lion.zte.asp.gl/app_ded/AAwXAe5QYnBxNJgn8aCJCFeuF3LR9qur.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.lion.zte.asp.gl/app_ded/oat/x86/AAwXAe5QYnBxNJgn8aCJCFeuF3LR9qur.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.lion.zte.asp.gl/app_ded/JjlCPmZx37MqCiw7l1jZvHO99sZUqQxu.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.lion.zte.asp.gl/app_ded/oat/x86/JjlCPmZx37MqCiw7l1jZvHO99sZUqQxu.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Enterprise v15
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
652KB
MD51e603a58244882521962e34b843472a1
SHA1a3befb90faa53b2145b77843ac7cc2f30987c020
SHA2568c42ce19599e65a6beeff12c62d543a4024ad0c57a086c0e62525286ba1116e7
SHA5123a6101cbcc4647b29d5ac1a4c90ace0ddbc0c7815c5619831ecf9a53bc5be7ba913c7b597cca1620b811c1ce8ff891a6f0b0ec2249b5f5f50552189d3c45347c
-
Filesize
3.5MB
MD5ece73c1138f067857891e536a7aa84a2
SHA1a9a04324271fa95542819f4e00e348eadb4a3894
SHA256ad5f205ad35dcd53497bbd050fbfce8239d8d76c3c6639e1246ec4d02a5e8710
SHA51284ed6848b9723616f46457325c54c99a12cce4eba395920e5b3db924e8207fa11c23aa5e20af90562d4a68a6d6a640bb3d61d0f16e0ffde28c891b6fc49dadab
-
Filesize
652KB
MD5e88be757de04d7851cddcb31b43ef901
SHA19f26eddc15a4cf19d6d5cc2c6a90f269ea708cc8
SHA256d3d1d66d101f37cd597a21d250af1b20bef0b0df9e06b9f72e8134212dc5ab16
SHA512b584de2a39008fbc2fbae1354439adea21249cbdc9060cc35505c36036d22de1cbab06c78b86043f823dd7b8d04d0313bee9c7c06258cad78686e98b77ccf8df
-
Filesize
3.5MB
MD59ef77455479c7313878e876d41970fed
SHA113d816bf237217a6e223462c28f761615fa446f3
SHA2561878650f0a55e3d0b3896d32e8e79a0bf1a322ab46ab80531a06f04f16e2ea51
SHA512e0617fb5660c9a47954b629b8ba096180d1a891b1d06abd99a2a91ad90d47b8ba6d201536bd29338ed8e01ca9fee89c4b8e843def704e54d76c8d50ee661dd57