db8a7583df80c79dda290434af202de5de218ff38ecfd9e977aec1977e794b6b

General

Target

0df80383a517371fcc01370017d2dfbb_JaffaCakes118.apk
Size

165KB
MD5

0df80383a517371fcc01370017d2dfbb
SHA1

99a217e20798504d3d9f1e27f95f511741cca695
SHA256

db8a7583df80c79dda290434af202de5de218ff38ecfd9e977aec1977e794b6b
SHA512

9a6acc23317b65d5e16020cf08d26069b98ea04086ecae3bb16bda05823861bd167cf01f1aca4cef8b1c50e6ec036cf12f47f243d5265d7ab3ca2080f6d2100c
SSDEEP

3072:WpnmHdXawlFeVi+BjPx3ylsk8NxJdDITlwHeUA/NkGF2c/2ePY2pFfj:Um3E06xJmTS+UA/NkV78YCFfj

Score

8^/10

banker collection credential_access discovery evasion impact stealth trojan

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4594	com.master.erfz.vqbwqgpnzn

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.master.erfz.vqbwqgpnzn

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.master.erfz.vqbwqgpnzn/app_tfile/config.jar	4594	com.master.erfz.vqbwqgpnzn

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.master.erfz.vqbwqgpnzn

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.master.erfz.vqbwqgpnzn

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.master.erfz.vqbwqgpnzn

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.master.erfz.vqbwqgpnzn

com.master.erfz.vqbwqgpnzn
1⤵
- Removes its main activity from the application launcher
- Checks memory information
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries account information for other applications stored on the device
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4594

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Hide Artifacts

1

T1628

Suppress Application Icon

1

T1628.001

Virtualization/Sandbox Evasion

1

T1633

System Checks

1

T1633.001

Credential Access

Clipboard Data

1

T1414

Discovery

Software Discovery

1

T1418

Security Software Discovery

1

T1418.001

System Information Discovery

1

T1426

System Network Configuration Discovery

1

T1422

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Clipboard Data

1

T1414

Stored Application Data

1

T1409

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1

T1471

Data Manipulation

1

T1641

Transmitted Data Manipulation

1

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.master.erfz.vqbwqgpnzn/app_tfile/config.jar

Filesize
127KB

MD5
454ef9f79671f57962f69108986d5ec3

SHA1
96086de711b1def503e49b9b90b9263ec8dabfab

SHA256
c3dab1b8b86257971e033958a667f6b256ab575494df1ed6a9921520a787789c

SHA512
097d3ebd8183227487b611a7468570fcd5146ff17f0ab0e2172c7a5d9b0ead03fba2414c729ebcddc9bdc6acc063a537c3f2208898da2fcd01f3d82b6876122f

Download Submit
/data/user/0/com.master.erfz.vqbwqgpnzn/app_tfile/config.jar

Filesize
258KB

MD5
11f663c8da263a6965f54de6d7bc993d

SHA1
49fb24cf75401e2dec37f42c4747ef9a854d7693

SHA256
f4749b55dc2bcc87d08beab051c154bfce0636669f2c8e129d5d9b06626a3948

SHA512
6ee13e0b42d5fb859d9e099637b42a194fe3d41f9b0c3a4f07a543a5cbabac7bbb058f2da151e8b12b8cbe4333d285c7f241b17919ddbbcd816a4b588248e513

Download Submit
/data/user/0/com.master.erfz.vqbwqgpnzn/databases/tbcom.master.erfz.vqbwqgpnzn

Filesize
36KB

MD5
ebfd4869bb86abd638bc48b891f3e1c8

SHA1
a27f262fe7a41ec9976d457416447f8b78c80e03

SHA256
5f49bca53de766023101cc1ac8dda79a83c485fce8d9138452b39d1853d2fe0f

SHA512
062fd15e0a34619071834f2d81889e6a100c3a707e53621b16d584182a57c690f6a24a73e19fb77678d857fde477935811a963998a73d7ffe971d6ebd9cafb07

Download Submit
/data/user/0/com.master.erfz.vqbwqgpnzn/databases/tbcom.master.erfz.vqbwqgpnzn-journal

Filesize
512B

MD5
299e847c1319147952e6660a89e2300d

SHA1
719b0dd3af21733ddc04abc849a0e32ce9fd7bc0

SHA256
5a2adb334f8c680d651af23f2ff030214d2ff71e43ffb3b017eb01fe8ed762b2

SHA512
32a2ddc449f1f180dccde353d15db9f7d7fcb214d8db9ab5b00e0e3b8671668b38a89f9902522d0fe855e270f5d982d4cb276da8757b166858a468bbaf44c9f0

Download Submit
/data/user/0/com.master.erfz.vqbwqgpnzn/databases/tbcom.master.erfz.vqbwqgpnzn-journal

Filesize
8KB

MD5
dfc2ffc93cc323d44b028497cc8f7f1a

SHA1
6facd8902bed9e8b842b0d6a840fac07555a186d

SHA256
3704d7559d39057348116fb5815c1f43d702ed49a0bd9bc80ba18a804f61c29c

SHA512
75e3876d7fa0310dd8fffcd541172c622c359e31043856a59c38a73e180571f46e1c73a46a0e89d5897002cd5935b3ec7d19d80e9cb2311d79de8cb78b9b8030

Download Submit
/data/user/0/com.master.erfz.vqbwqgpnzn/databases/tbcom.master.erfz.vqbwqgpnzn-journal

Filesize
8KB

MD5
e5c4bf504bad620c49bc66450a10db7b

SHA1
e777e575b790a6efb914b2f8c234e9c8778c7b20

SHA256
37a0c9a2d79040cc82c0ac798fcd9fca87f4058d76dd210a77000a4b0e7726f2

SHA512
e1b1fb8d4491f3987759611dc6244190cfa2e3f9b4051ac1263e2d9263058b1046f485faefd5cd2769231e5ac4cc35029b77517bc63ccb7c2e418f66a685cb8e

Download Submit
/storage/emulated/0/Download/sdsid

Filesize
4B

MD5
b8c37e33defde51cf91e1e03e51657da

SHA1
dd01903921ea24941c26a48f2cec24e0bb0e8cc7

SHA256
fe675fe7aaee830b6fed09b64e034f84dcbdaeb429d9cccd4ebb90e15af8dd71

SHA512
e3d0e2ef3cab0dab2c12f297e3bc618f6b976aced29b3a301828c6f9f1e1aabbe6dab06e1f899c9c2ae2ca86caa330115218817f4ce36d333733cb2b4c7afde7

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads