28ff56f012a5a2f3d9484483f7e101cd779a16dc40ca55134b942278dc0c7e6f

General

Target
06801922e51f9599b3f78a19c7be469c_JaffaCakes118.apk
Size 602KB
Sample240429-bphqmsed71
SHA256 28ff56f012a5a2f3d9484483f7e101cd779a16dc40ca55134b942278dc0c7e6f
MD5 06801922e51f9599b3f78a19c7be469c
SHA1 4104aa1fe43314df19b61165af1d6da2941778a4
SHA512 811fa3114754939e52383dcae81ecb5a79ce0410068ac37f645a4f583961beeeeab87c0b2c2cf2a022e98c69cbd90c1c20f7c1840276ea344d2564138f9f93a4
SSDEEP 12288:IEaFZvkGGNUuWW1NVwCKn6GAx1d9H1BY+0aTBpqSol2KpEhpX79w:IEaFmFN9v46flH72wOSoMK69w
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection credential_access discovery evasion impact persistence stealth trojan

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
5040	feifei.shasha1.meta.face

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	feifei.shasha1.meta.face

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	feifei.shasha1.meta.face

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/feifei.shasha1.meta.face/app_ttmp/t.jar	5040	feifei.shasha1.meta.face

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	feifei.shasha1.meta.face

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	feifei.shasha1.meta.face

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	feifei.shasha1.meta.face

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	feifei.shasha1.meta.face

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	feifei.shasha1.meta.face

feifei.shasha1.meta.face
1⤵
- Removes its main activity from the application launcher
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:5040

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Hide Artifacts

1

T1628

Suppress Application Icon

1

T1628.001

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Clipboard Data

1

T1414

Discovery

Software Discovery

1

T1418

Security Software Discovery

1

T1418.001

System Information Discovery

2

T1426

System Network Configuration Discovery

2

T1422

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Clipboard Data

1

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1

T1471

Data Manipulation

1

T1641

Transmitted Data Manipulation

1

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

t.jar.cur.prof

Path /data/data/feifei.shasha1.meta.face/app_ttmp/oat/t.jar.cur.prof
Size 646B
SHA256 31940a8c1ec3598763495dd634a5642ebf324aa7ee615dae2b477d9200ec3965
MD5 6129e70fd903c4d4d2549a0069f7ae95
SHA1 afebf7a509dbcca5779bb0c12de146416de317ab
SHA512 a57075d631f57c78d328a960f51c774351e7ecd4fcaab5f851763a8e5357e552262ee5b8673303e0f10a17e55583a3d69b55b06ba62f6f7231af494e168e5d3d
MD5 SHA1 SHA512

Submit Download

t.jar

Path /data/data/feifei.shasha1.meta.face/app_ttmp/t.jar
Size 276KB
SHA256 b30a95dff6f65f444472971c8aaf895ffc8e66e0117ce242ec4cb8a8a519a5ec
MD5 9aaea567e0c93e51718ba7eade0e83df
SHA1 0005116aad1779361b70093db00fed5ac090ae23
SHA512 2aef1034335d8752f4e25ce6c5823ce03019536cc6e51ee61b5291c77a0f356a2517e0cbe7f2c4cc2d897115dc856449a342cfdc247c9d34d313187d15b2f890
SSDEEP 6144:nSDZFxMVdn+sn8G3YAOG6/srJRPRt76NudrCAzmhaZisqOl3h:nKiVfnxo4Msr3RtlWhyqOlR
MD5 SHA1 SHA512 SSDEEP

Submit Download

feifei.shasha1.meta.faceb

Path /data/data/feifei.shasha1.meta.face/databases/feifei.shasha1.meta.faceb
Size 72KB
SHA256 fcb90b90e73a2a240c2bac34708b2bbd4bfdfe7b4cfbd30e05a1b9231f27d0a3
MD5 c430c9fe64b6c9eca7cba7d5a32cbe1e
SHA1 70179cc6c76cef14b926749fbbf9b096dc342eb1
SHA512 6a4c6102b4e0fdbff3ceadd43b93b6a4d1bba574199c4dfea917d13f49d030d4810739eca7807683f8fa8c31f0673d93058ff74fb67ed21f95a2bd353ddfc934
SSDEEP 48:T6i22dti3Hi6MbmX9MJbUKZb9pMJbc6sNd7UMJbEyAsInlnIH2bmX9MJb8O18OH9:Goti3H4mtqb9brqborIqb5cQsmtqbx
MD5 SHA1 SHA512 SSDEEP

Submit Download

feifei.shasha1.meta.faceb-journal

Path /data/data/feifei.shasha1.meta.face/databases/feifei.shasha1.meta.faceb-journal
Size 512B
SHA256 a856655f42d68490254592ac88c06551d9f5eda88d2c393bbad5a6252bb40311
MD5 458398e99e87263ed38379d47ad4eb3f
SHA1 5e8b195b062fa74a90c275a6259634d1936cecd6
SHA512 06bf31c0c81a3a36f931f83697f397d81d1c276a328448a1ea3e479f295daecf54b5a9e9c0cff354e986673a8e00a040b288f6f95ecd8cb663a083890e45067f
MD5 SHA1 SHA512

Submit Download

feifei.shasha1.meta.faceb-journal

Path /data/data/feifei.shasha1.meta.face/databases/feifei.shasha1.meta.faceb-journal
Size 8KB
SHA256 0976e69204618c87062b1d88ed24b9de0838e5bd047e5d5c0cac03dd3258277d
MD5 116559f92800c7ebe8779a8019f117da
SHA1 3d276106605105786dee9af1ed80de61d07792b4
SHA512 1ab5eba2476fb565c89d2d884a5bfdfa4a546a3bf56e2256c8400c8d4af1ced806c1b0390ea664d45f54dd3a371fef3270a40c76d26c2f0bc9d549b0137090c6
SSDEEP 6:7+/l9TRGn1nlpg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKMD:7+txRcpqLiuWdwRmBEyPbvD
MD5 SHA1 SHA512 SSDEEP

Submit Download

feifei.shasha1.meta.faceb-journal

Path /data/data/feifei.shasha1.meta.face/databases/feifei.shasha1.meta.faceb-journal
Size 8KB
SHA256 b60f6cb8623a13c7038071c7144be1586662f24bda5484c0458ea8294790271b
MD5 8eb6725db5a56140ccccddc177bde824
SHA1 a622c6684c664cb9188a75951fc4ed35e917654a
SHA512 6b4cdc027160b647069266341099a3f9b6f38240d9ba791b24d8907b2dbe5ce6f55543c3c866c5b963211974c9387baca0b2c7f99b4c2123e80f0771f1165470
SSDEEP 6:7+/l9AHPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKn/b:7+tIqLJdTRmBEyPbEb
MD5 SHA1 SHA512 SSDEEP

Submit Download

feifei.shasha1.meta.faceb-journal

Path /data/data/feifei.shasha1.meta.face/databases/feifei.shasha1.meta.faceb-journal
Size 12KB
SHA256 7cdacec38f723ee20689c1b44cc285902bc32270a4dbdda128a2569c9a32d08d
MD5 6ef5a70340d715e47554b0a4dccb3ae6
SHA1 81b986c6e2caf3d9d2058e2ac3fbb9faee3f65b3
SHA512 f84156a5026efeb5d715d51462b12c9b36d2d044408b5e96890ce46d25bd757a64bc07abb93bf79d34c4457f286f5d9561cd19eafb39625c4d7a83e7e2bbb437
SSDEEP 48:7Mikqr22dti3Hi6MbmX9MJbUKZb9pMJbc6sNd7UMJbEyAsInlnIH2bmX9MJb8O1d:7EYti3H4mtqb9brqborIqb5cQsmtqbxz
MD5 SHA1 SHA512 SSDEEP

Submit Download

t.jar

Path /data/user/0/feifei.shasha1.meta.face/app_ttmp/t.jar
Size 587KB
SHA256 1c65834d9ca018c6496a8b9957589d0e94657911b6635dc21a448d78f9238887
MD5 f72c3d07507c3e26d317e9117ba757d1
SHA1 cdede4739e9dd9fd95243aab5e44c24f93f825c3
SHA512 3420714252e7503abc13c99274d767b0bc08671d769460dc61823ab9470e145fb75c5dfaadc617d3a05cf251ed5ecf38ea7e8c1d7b343bca4d7e8296f1b805d4
SSDEEP 12288:PlCfVfqatnro0WFGEDsm8UFXvgUy7ayzAQBW7un0x83qFAbOZE/yNoj2hsna1wLs:wfNZEDFNQs7un0x83qFAbOZE/yNoj2hF
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads