8bc5aa6069591a64d6c33fe8701db0174808db0fbd4f18ab7167f84e4e9010c6

Analysis

max time kernel
9s
max time network
127s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
01/05/2024, 15:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c23e56b8d2c74a7e69d32b702564cac_JaffaCakes118.apk
Size

1.6MB
MD5

0c23e56b8d2c74a7e69d32b702564cac
SHA1

c8f86bbd26086292b3b1570bcd16d02cb8e40b64
SHA256

8bc5aa6069591a64d6c33fe8701db0174808db0fbd4f18ab7167f84e4e9010c6
SHA512

9f87e325ca32522eb5499d9bd34365d26c03f394ce1e86bd3f9597715f33f1ccb78406fd147b3982664abf8c685fa37ca39794b786a4f7d98dce978b961596ec
SSDEEP

49152:8irFrn1kion1XwrWqlGjcsYDptOQmT12MYZmY94:N9n1khgrWq0jlYDpgQm7g4

Score

7^/10

discovery evasion impact

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.rxm.yyiszm/files/less/OBviXtim.jar	4318	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.rxm.yyiszm/files/less/OBviXtim.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.rxm.yyiszm/files/less/oat/x86/OBviXtim.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.rxm.yyiszm/files/less/OBviXtim.jar	4284	com.rxm.yyiszm

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.rxm.yyiszm

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.rxm.yyiszm

com.rxm.yyiszm
1⤵
- Loads dropped Dex/Jar
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4284
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.rxm.yyiszm/files/less/OBviXtim.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.rxm.yyiszm/files/less/oat/x86/OBviXtim.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4318

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact