72462ea79720f98b9fb302bcaa3028117c55d6497c69ca9e952850c277b1a7ce

General

Target
0d916d99178d246b40e05bcd2529047a_JaffaCakes118.apk
Size 602KB
Sample240502-fmn7vsbe79
SHA256 72462ea79720f98b9fb302bcaa3028117c55d6497c69ca9e952850c277b1a7ce
MD5 0d916d99178d246b40e05bcd2529047a
SHA1 f7fd2406c3ac748ef7f6093b2bd467d9cb950848
SHA512 7fccf9532b62e6085296b4624abf9833341ed2f5443472de390f05f73fefb9a6cef3bf0f30eeba4fe2261e7864e962fbe2d18b103d8acc4770aaec3b9313ccc0
SSDEEP 12288:k+EaFZvkGGNUuWW1NVwCKn6GAx1d9H1BY+0aTBpqSol2KpELpX79Vf:ZEaFmFN9v46flH72wOSoMKU9J
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection credential_access discovery evasion impact persistence stealth trojan

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
5049	feifei.shasha7.meta.face

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	feifei.shasha7.meta.face

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	feifei.shasha7.meta.face

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/feifei.shasha7.meta.face/app_ttmp/t.jar	5049	feifei.shasha7.meta.face

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	feifei.shasha7.meta.face

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	feifei.shasha7.meta.face

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	feifei.shasha7.meta.face

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	feifei.shasha7.meta.face

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	feifei.shasha7.meta.face

feifei.shasha7.meta.face
1⤵
- Removes its main activity from the application launcher
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:5049

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Hide Artifacts

1

T1628

Suppress Application Icon

1

T1628.001

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Clipboard Data

1

T1414

Discovery

Software Discovery

1

T1418

Security Software Discovery

1

T1418.001

System Information Discovery

2

T1426

System Network Configuration Discovery

2

T1422

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Clipboard Data

1

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1

T1471

Data Manipulation

1

T1641

Transmitted Data Manipulation

1

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

t.jar.cur.prof

Path /data/data/feifei.shasha7.meta.face/app_ttmp/oat/t.jar.cur.prof
Size 643B
SHA256 a9f3abcbb9c042314761c9cdf7014be28d290783bf56249de40fbbc6bdc8a5c7
MD5 9c1c301e9bdb0c8b03bb5eb5153fcad3
SHA1 c6fc6122798bfb80fc851dc1c5d6681a13abf987
SHA512 78684958673d6dcbc81aea4259a3f2c33d1b61739d932cc0cd81b3fd09e110c169d948467214a740acf96b72b3708c1ec66bd127c0d86cdf166aa370a421779d
MD5 SHA1 SHA512

Submit Download

t.jar

Path /data/data/feifei.shasha7.meta.face/app_ttmp/t.jar
Size 276KB
SHA256 b30a95dff6f65f444472971c8aaf895ffc8e66e0117ce242ec4cb8a8a519a5ec
MD5 9aaea567e0c93e51718ba7eade0e83df
SHA1 0005116aad1779361b70093db00fed5ac090ae23
SHA512 2aef1034335d8752f4e25ce6c5823ce03019536cc6e51ee61b5291c77a0f356a2517e0cbe7f2c4cc2d897115dc856449a342cfdc247c9d34d313187d15b2f890
SSDEEP 6144:nSDZFxMVdn+sn8G3YAOG6/srJRPRt76NudrCAzmhaZisqOl3h:nKiVfnxo4Msr3RtlWhyqOlR
MD5 SHA1 SHA512 SSDEEP

Submit Download

feifei.shasha7.meta.faceb

Path /data/data/feifei.shasha7.meta.face/databases/feifei.shasha7.meta.faceb
Size 72KB
SHA256 dd2c831375a2e82d3cd0bc0a34ea7aa44a562fa05e286466c1716fd8be87c0c2
MD5 da80ba442895828879186066d51591d0
SHA1 0813667b8bac01faeaee1f4aa3649fef177a4a63
SHA512 acdb9a0ce1ae673555ed435703bf040959c3fc2c2a020d3b2cf4fa3a10a5d555f0af1eb8fbb51a2553b513ae033faecb7a70feda8e238b914242507691746345
SSDEEP 48:T6i22dti3Hi6MbmX9MJbUKZb9pMJbc6sNd7UMJbEyAsInlnIH2bmX9MJb8O18OH9:Goti3H4mtqb9brqborIqb5cQsmtqbx
MD5 SHA1 SHA512 SSDEEP

Submit Download

feifei.shasha7.meta.faceb-journal

Path /data/data/feifei.shasha7.meta.face/databases/feifei.shasha7.meta.faceb-journal
Size 512B
SHA256 b5c8d83168d52e93c9fb2ca197e8d67ccd5f0416a8f2014f959a7cbed59c2c5e
MD5 5e59071f9a660e81f240081dfdc0073d
SHA1 864288b622d6df4bd5443871529d20b63cdfda7b
SHA512 34ba818aa1706a1e5171283b83da897a6026318e495d3ba9923b9761bfe0b81d3efb368cbec0f3391fb3728dcc4d605e7ccaa51d9b7cf795a82baa252a96cecc
MD5 SHA1 SHA512

Submit Download

feifei.shasha7.meta.faceb-journal

Path /data/data/feifei.shasha7.meta.face/databases/feifei.shasha7.meta.faceb-journal
Size 8KB
SHA256 472e8c0fe6a854bf69938108f7dff0012abe8e1ec5edc1cfa2ba13e42c606076
MD5 b1f2903d9421e11e3209deced49f9f9f
SHA1 d2896d0283b642ecc941f96752e67fe0b8a292f6
SHA512 8147e4ca7996d0dcaebf3bd6a0659287590beafd1c42a5b098a9b2564b829574cf4c5f4d3cc92df52ae3bb42cbee290de34b0131ac201bd6c1c9911482f5039b
SSDEEP 6:7+/l9jn1Yg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKV:7+t8qLiuWdwRmBEyPbW
MD5 SHA1 SHA512 SSDEEP

Submit Download

feifei.shasha7.meta.faceb-journal

Path /data/data/feifei.shasha7.meta.face/databases/feifei.shasha7.meta.faceb-journal
Size 8KB
SHA256 a51ca2ac1c84f20aa325e6cfe3fc92991a23f07fc7a2e21f98ecbd2e441bba3c
MD5 ddf5368d2d66c1fbd2a6aa446f075230
SHA1 91b7d75820ac8947e91f4056f08841b63d839390
SHA512 ea6d58e88cc61ff6ed2b7d05d1fb2c2ac74cb395ee043f36dbfe68b88bb4901ef2aa26e9eae197fac122d6e6e6c29c3e725a5a7aafe566ec0d002749059e5381
SSDEEP 6:7+/l9LVPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKAJ/y:7+tpRqLJdTRmBEyPbDxy
MD5 SHA1 SHA512 SSDEEP

Submit Download

feifei.shasha7.meta.faceb-journal

Path /data/data/feifei.shasha7.meta.face/databases/feifei.shasha7.meta.faceb-journal
Size 12KB
SHA256 e28a8fbe410bff1d986b546eae32619ccbd83e2921c380731808438ffb58a282
MD5 b9446097b7323ac43ef546b8f077b4ed
SHA1 7720029ede3cdb877724f36a9f9542db1d385d08
SHA512 e76a0361f73d9fbf3c935247a44e54990e4325215f954bf949e9d530a51b20c73cc0808a484ce392b7fe57bf46e82323615a905b36594a403c2026c882b75daf
SSDEEP 48:7M4vX3qr22dti3Hi6MbmX9MJbUKZb9pMJbc6sNd7UMJbEyAsInlnIH2bmX9MJb8p:7/Yti3H4mtqb9brqborIqb5cQsmtqbxc
MD5 SHA1 SHA512 SSDEEP

Submit Download

t.jar

Path /data/user/0/feifei.shasha7.meta.face/app_ttmp/t.jar
Size 587KB
SHA256 1c65834d9ca018c6496a8b9957589d0e94657911b6635dc21a448d78f9238887
MD5 f72c3d07507c3e26d317e9117ba757d1
SHA1 cdede4739e9dd9fd95243aab5e44c24f93f825c3
SHA512 3420714252e7503abc13c99274d767b0bc08671d769460dc61823ab9470e145fb75c5dfaadc617d3a05cf251ed5ecf38ea7e8c1d7b343bca4d7e8296f1b805d4
SSDEEP 12288:PlCfVfqatnro0WFGEDsm8UFXvgUy7ayzAQBW7un0x83qFAbOZE/yNoj2hsna1wLs:wfNZEDFNQs7un0x83qFAbOZE/yNoj2hF
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads