Analysis
-
max time kernel
149s -
max time network
156s -
platform
android_x86 -
resource
android-x86-arm-20240221-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system -
submitted
29-04-2024 05:18
Static task
static1
Behavioral task
behavioral1
Sample
06e6d72d0d92a83967ea77ccc9f2bdb5_JaffaCakes118.apk
Resource
android-x86-arm-20240221-en
Behavioral task
behavioral2
Sample
06e6d72d0d92a83967ea77ccc9f2bdb5_JaffaCakes118.apk
Resource
android-x64-20240221-en
Behavioral task
behavioral3
Sample
06e6d72d0d92a83967ea77ccc9f2bdb5_JaffaCakes118.apk
Resource
android-x64-arm64-20240221-en
General
-
Target
06e6d72d0d92a83967ea77ccc9f2bdb5_JaffaCakes118.apk
-
Size
431KB
-
MD5
06e6d72d0d92a83967ea77ccc9f2bdb5
-
SHA1
b3dc0f4c3a05b054ebfd8b45d0eedac1a10af77e
-
SHA256
7da8f3b9e81d7cd194321630ef9f50adf45c19cd2215fbf353c6ad78491fac2e
-
SHA512
d19c3378b00c1fadc8e36824dd482e97b15534778444f0b76bc64ca74b1c62414d31748d6295bdb3052a60cfcd3cfd9850021d7e1fe46a72e015cb4760b3c1b9
-
SSDEEP
12288:1q+xe6D3TQwsgjGIDxVZVmqT9ZKtz1yBXkScVEOZnpCL:1N8SQqSEvLvvKtZy5kSc3ZnpCL
Malware Config
Extracted
xloader_apk
http://91.204.227.39:28844
Signatures
-
XLoader payload 1 IoCs
Processes:
resource yara_rule /data/data/com.torh.pkpc/files/dex family_xloader_apk2 -
XLoader, MoqHao
An Android banker and info stealer.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.torh.pkpcioc pid process /data/user/0/com.torh.pkpc/files/dex 4185 com.torh.pkpc /data/user/0/com.torh.pkpc/files/dex 4185 com.torh.pkpc -
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
Processes:
com.torh.pkpcdescription ioc process Framework service call android.app.IActivityManager.setServiceForeground com.torh.pkpc -
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
Processes:
com.torh.pkpcdescription ioc process Framework service call android.accounts.IAccountManager.getAccounts com.torh.pkpc -
Reads the content of the MMS message. 1 TTPs 1 IoCs
Processes:
com.torh.pkpcdescription ioc process URI accessed for read content://mms/ com.torh.pkpc -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
com.torh.pkpcdescription ioc process Framework service call android.app.IActivityManager.registerReceiver com.torh.pkpc -
Acquires the wake lock 1 IoCs
Processes:
com.torh.pkpcdescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock com.torh.pkpc -
Checks if the internet connection is available 1 TTPs 1 IoCs
Processes:
com.torh.pkpcdescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.torh.pkpc -
Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
Processes:
com.torh.pkpcdescription ioc process Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS com.torh.pkpc -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes:
com.torh.pkpcdescription ioc process Framework API call javax.crypto.Cipher.doFinal com.torh.pkpc
Processes
-
com.torh.pkpc1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's foreground persistence service
- Queries account information for other applications stored on the device
- Reads the content of the MMS message.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
- Requests disabling of battery optimizations (often used to enable hiding in the background).
- Uses Crypto APIs (Might try to encrypt user data)
PID:4185 -
ping -c 4 91.204.227.392⤵PID:4294
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Foreground Persistence
1Defense Evasion
Download New Code at Runtime
1Foreground Persistence
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
766KB
MD5a94e56982fdbb56095f2063d0560021b
SHA11366dc9b7351a298c3deec87783c0bb9e7d41e0b
SHA2569e7bf9d8214a0f1f3d91f0740ff7b8ee90100ed05fa1a21f2c03e1569e2fa540
SHA512f9715e2296319815495ffff4281eb4d53866fd0ababda1d32a507539d3ce06f673664e37466282ccbdd797c778c7ffa09d3046e21fba6fbf2c2bc2c35b470855
-
Filesize
1KB
MD5d2c6efc47f32b21f77038a350e6e20c9
SHA149fe9552047581b878e3fa26d96f56eaf37bf213
SHA256887d8d4201f92a3e4f847c0e0f8792c65c96b751ded989b72e4d269692a5cd8f
SHA512913ad8b36f2aa62e454bbe246d929c8bdaf15be5eca8f1b0edc159141b4cb62fe772bf9c8695a787b436c28cf6e9ddad3156c83e24861a4c6948114c92ebae0b