472578f92dea4cb5105f2660fa8027f89c158442e9385ff060d9835fa938962b

Analysis

max time kernel
29s
max time network
132s
platform
android_x64
resource
android-x64-20240506-en
resource tags

androidarch:x64arch:x86image:android-x64-20240506-enlocale:en-usos:android-10-x64system
submitted
08/05/2024, 04:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
232d22ed02000c8b3eee0d2218263920_JaffaCakes118.apk
Size 4.4MB
Sample240508-ezn7ysdb28
SHA256 472578f92dea4cb5105f2660fa8027f89c158442e9385ff060d9835fa938962b
MD5 232d22ed02000c8b3eee0d2218263920
SHA1 d3d416c31d5c8021e3307d996a347cf052adbc8d
SHA512 b9b651e1120fb736224e1f45cf2f701fefaa9002b0519430b8f14ef2c0e29b0047701aeba72b591e87744ec9b75f1fa83674f787a0c64de3932135f4da5dd562
SSDEEP 98304:coC/uUVQUQlJQ7qsnmG3/OAUKL3pxnbyx97Os:cJ/uUVQU0i71FjL3pFM97Os
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection credential_access discovery evasion impact persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
5056	net.croz.myWay

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	net.croz.myWay

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	net.croz.myWay

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/net.croz.myWay/cache/1582435991586.jar	5056	net.croz.myWay

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	net.croz.myWay

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	net.croz.myWay

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	net.croz.myWay

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	net.croz.myWay

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	net.croz.myWay

net.croz.myWay
1⤵
- Removes its main activity from the application launcher
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:5056

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

1582435991586.jar

Path /data/data/net.croz.myWay/cache/1582435991586.jar
Size 9KB
SHA256 f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce
MD5 e8e0527a01aefdb89afd2c508f131da1
SHA1 f1103e6b260c657ceb3d95f1b023af3fda8b133a
SHA512 fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34
SSDEEP 192:uGJqbQwgQYuNUnEV4bAa0s/ombgmdxjX5fGpTVHb3qX:LkMwTTNdlns/ombJB
MD5 SHA1 SHA512 SSDEEP

Submit Download

rg.stocks.positions.db

Path /data/data/net.croz.myWay/databases/rg.stocks.positions.db
Size 28KB
SHA256 ff81e1c664ea6ef6c93f8bc4bbe4ea953209e596edea64e367df10c7321bfafc
MD5 0264beddffaa7477b7bc80c41977ddd1
SHA1 065238021ddf1afe32083f81bc6990fba46cb667
SHA512 16f890fedc115582852f0204b7f8dc3b49872125eb92c0c6419749209b76c5a905acb6fa0ed194a75e271279e3828ee777b199f6ee4ea9f1065a1882ea5b700c
SSDEEP 24:TLna3nWxfqJ9ZZaUFOvQbyPZA01qGSiGQQ:TTUnDKU0P311S
MD5 SHA1 SHA512 SSDEEP

Submit Download

rg.stocks.positions.db-journal

Path /data/data/net.croz.myWay/databases/rg.stocks.positions.db-journal
Size 512B
SHA256 0753e9c9cde5b07d49ed2974c0ba140c848f13a110e08912ae5b0e271530cc17
MD5 27d312663967eb7ea96d7bb22f5f195e
SHA1 692ae364cd3459eb2ec69f125c63cab998dc6c35
SHA512 3bb28d9623e614139b5a40b47f8860092a0787d4d52559f6f092fa7b137072f7e40e6bc10485822f767b7ed333bf68a1ce8d77a002251390dfbdc4755827c01d
MD5 SHA1 SHA512

Submit Download

rg.stocks.positions.db-journal

Path /data/data/net.croz.myWay/databases/rg.stocks.positions.db-journal
Size 8KB
SHA256 61bb95873aeb3fa45da8fd00c78b48b2f94f5d152de969828d1854477e4649c9
MD5 26d3fddfff525b4380790f57d1cbdf56
SHA1 2865e8fd64258de798e4a3e58ba166c7b605b963
SHA512 af5837f2d831c3c6f6c0299003a56398b10b77908cf9eea492848f25d912c36e1af0bf0a05d5e1d55a6bb41c3cac5685a52eb65250568ab550b9f2dcdda59852
SSDEEP 6:7+/l9xKbn10ARg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKqFn:7+tLoqLiuWdwRmBEyPbbF
MD5 SHA1 SHA512 SSDEEP

Submit Download

rg.stocks.positions.db-journal

Path /data/data/net.croz.myWay/databases/rg.stocks.positions.db-journal
Size 8KB
SHA256 b4a77c94850f10bbee4182f6a8bf432db0dc0c912a100f113c3aff6c36b926b6
MD5 0d602859f14c66efdd2c32347a53e6db
SHA1 68e5804623af6d799bb5242e051384e32f4a28ae
SHA512 7b8cf0f62f2525858c23182e72c0ccfd8dad51c7a385d88a92b27d5fff1907ec6d887c0b23e33817a8a2ea7d7bd3fae25926dde490ec810b8c7fcff26be3cde4
SSDEEP 6:7+/l9DlgPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKOs//Sg:7+thl4qLJdTRmBEyPbXsT
MD5 SHA1 SHA512 SSDEEP

Submit Download

btYPQQXGw

Path /data/data/net.croz.myWay/files/btYPQQXGw
Size 354KB
SHA256 b31857875e39c92774f4a3112168c1f47cb204487bc75410b0cd5ac9c288e5f6
MD5 14906bf771da984fbf2cc5364a3c915b
SHA1 baf32fe5f5b16c8e59b92d2b95e44f0cce26d7ee
SHA512 5fc9adc2d9bd6fa907a811eb80b7ad8f9f7fa99f003259abbeafe4804924966f69fe5dd5ffd6cf266623756d09cafa585dc74a63f3443075e7e05c3ffba763b6
SSDEEP 6144:/Kut4jmdTcEgQT9FUWT+OyN3WYKRnTPObNon0+HQBxXlK00xK0HG0keZ9ZxwWLEa:Fw1Ky8ZCYyvz2y/yT/1BK4w/w
MD5 SHA1 SHA512 SSDEEP

Submit Download

btYPQQXGw

Path /data/data/net.croz.myWay/files/btYPQQXGw
Size 631KB
SHA256 c5cee61278a6fb6644526d4671801b89d8a8ceb081d3bb77791dc79f0ab0de0d
MD5 b0ce26efe984c4fd089c30e79f644b42
SHA1 75d436ba4ccbf3616a5c182f475a1640ea353bab
SHA512 867dde7e410f9df952d5830802e532114d3674fa958727353825d31323176c505fa671d28627523e281fa7b7d3a5674dc2cd7f44aa74be30d9d115b12431a87a
SSDEEP 6144:7C1v4YmdTcEgXTWFUWpyW+N3WYKRnWPpbNonLKNSxX2Y1Vz5ePK+54nqgwzI0Vm7:aM5rlnqgBg0M4P4Fq430LTS6ZE
MD5 SHA1 SHA512 SSDEEP

Submit Download

gaClientId

Path /data/data/net.croz.myWay/files/gaClientId
Size 36B
SHA256 70c14c3fed6fc19e5432cfb982b8f70e8bba74247c4b12f8461f06fb41de9ae4
MD5 650533a26ff813b90b1d153b2e741a3e
SHA1 4a4d8ee774b15af5720e540268b5a9f09ca9329e
SHA512 aec33802553828dcc59d6d977918f88cff418c35c33febdffbc1bf56e8025de07464b6678a04f2ff6e84c9f4ec37cc9d545d3911dd7c52c47c45b35656d55ed2
MD5 SHA1 SHA512

Submit Download

1582435991586.jar

Path /data/user/0/net.croz.myWay/cache/1582435991586.jar
Size 20KB
SHA256 2897b0812077c654a9b3fbb0b6303d5cde681eeba7ad9981de65716c7810d685
MD5 fde2ee00cbd121cfab5290b078aa3ceb
SHA1 e2b77d5320e155e413d040a8c20020962065b2f8
SHA512 a9326aff8e454a2b4ac09984ef2a65fddd4dc146b4c44d839035549bff8c9fdaae490326d0b018f76c1ca2e4fb25426d74f550ca0950982fba632a023af99a56
SSDEEP 384:Za0jn+huC5sMvRuvypj6f2ZzJgm+poK+l8m4qxXpj/7wyxBLBiok+9VQ3AKm8:ZU5sMvu/f2/gm+pDAPzj/Dip+9y3AK7
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads