8c2659074410ca59c0a6d49820c5b156fa9d1b42900e1c350cfe631629e7453e

Analysis

max time kernel
9s
max time network
130s
platform
android_x86
resource
android-x86-arm-20240506-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240506-enlocale:en-usos:android-9-x86system
submitted
09-05-2024 12:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

29ec9d894c24b8f8dcf647d89f76e731_JaffaCakes118.apk
Size

31.5MB
MD5

29ec9d894c24b8f8dcf647d89f76e731
SHA1

667b920be5e3d12c0d913b01c40ca50364903563
SHA256

8c2659074410ca59c0a6d49820c5b156fa9d1b42900e1c350cfe631629e7453e
SHA512

d56f03a1937516d613a50bac4f19e05ab60d8f31bf5518f05c9e2506d7242c79e69b8b2b7298eef17e93c5403006174d815a9e3d7805afcaf97d13080091d292
SSDEEP

786432:NDPAgDYtXSht5VwbrWBwIfUmvuHdNILKF+5KX1PNGp9Ch4NLy:NDvDWihtX8EpluHdNIEt11G+h4A

Score

7^/10

discovery evasion

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.tobiasornberg.knightgame/files/stares/updates/sta.jar	4371	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tobiasornberg.knightgame/files/stares/updates/sta.jar --output-vdex-fd=58 --oat-fd=63 --oat-location=/data/user/0/com.tobiasornberg.knightgame/files/stares/updates/oat/x86/sta.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.tobiasornberg.knightgame/files/stares/updates/sta.jar	4297	com.tobiasornberg.knightgame

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.tobiasornberg.knightgame
1⤵
- Loads dropped Dex/Jar
PID:4297
- getprop ro.board.platform
  2⤵
  PID:4328
- getprop ro.mediatek.platform
  2⤵
  PID:4347
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tobiasornberg.knightgame/files/stares/updates/sta.jar --output-vdex-fd=58 --oat-fd=63 --oat-location=/data/user/0/com.tobiasornberg.knightgame/files/stares/updates/oat/x86/sta.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4371

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.tobiasornberg.knightgame/files/stares/updates/sta.jar

Filesize
1.8MB

MD5
8ec43e10005ec4bc91c4e45b8e68e304

SHA1
66fb42cb11e77900e55cbd4a8e247841dad1c5ea

SHA256
18d90827352cf0ed3084c4f1f94d98026908f674914889e1e58c2ac5e68be63f

SHA512
6077f32c03361faa552bde6c7cb9676c6393a9b7a30a9622095e6eb93da484b29fd75edd955523c8b51d4e86fe4a19fbce5cc456f7612162dbdec76e43b563d6

Download Submit
/data/user/0/com.tobiasornberg.knightgame/files/stares/updates/sta.jar

Filesize
3.5MB

MD5
a76a0eec70efc99ea0ac64c07f6bec32

SHA1
8102d17f7690ba9697f1be3de7cedfb765e70d51

SHA256
aa563dff1eff005677766ff94f60884b3ca72e1b4e0e478dd8ba781269dca37e

SHA512
dff801c2e27bf4e62a1fb04f0a120a8be7f7cabc3640195dd3caacca4c6c3741eaeeb4d9e5afe151d6b8cf38684779acff4f99d37fe784329ca6b9ecfd2cd0c0

Download Submit
/data/user/0/com.tobiasornberg.knightgame/files/stares/updates/sta.jar

Filesize
3.5MB

MD5
f4e9864345c65cfda19a2f32209cc1ac

SHA1
a28bd5640006c97399085831a71f444cc9142123

SHA256
a908ee5efebad005c51ab86e6a47b56ea8f11b44129e149db376fa8d5eeb383c

SHA512
9b0f40b2f8eebed0817b5a1ab31ab61af2da9d2e3ae1f5b880b40552986e5bd192ed9d1c31c5fe74cf458a51e809f05300f1fade9e4c28a3517a3a1c6ffc5f7c

Download Submit
/storage/emulated/0/data/.systemid

Filesize
36B

MD5
3ccdaa4aa55a5da27eb696a686d0bc71

SHA1
e73ea05fa156207518ed14de7bc9d53430d57dd8

SHA256
2425b3fdcafbe3fe9565d5a6dc995485b63f3872551c23548c851013a544e480

SHA512
20d07a29bbe3ba546c7020f22d12222f50385f920286a7c6bbe62c8a77531908ace8715d28092552b23396baf1e22985faff074829b4b11e5b8e17b074b05f40

Download Submit