Analysis
- max time kernel
153s - max time network
160s - platform
android_x64 - resource
android-x64-20240506-en - resource tags
androidarch:x64arch:x86image:android-x64-20240506-enlocale:en-usos:android-10-x64system - submitted
09/05/2024, 15:07
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2a8a87da3a037fbe490c1087ca7e00c5_JaffaCakes118.apk
Resource
android-x86-arm-20240506-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2a8a87da3a037fbe490c1087ca7e00c5_JaffaCakes118.apk
Resource
android-x64-20240506-en
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
2a8a87da3a037fbe490c1087ca7e00c5_JaffaCakes118.apk
Resource
android-x64-arm64-20240506-en
9 signatures
150 seconds
General
- Target 2a8a87da3a037fbe490c1087ca7e00c5_JaffaCakes118.apk
- Size 2.3MB
- Sample240509-shcpgsba49
- SHA256 761c805132d2080ce6d68d117bb25a297570dbf9a6cb510fcd68bf99de8e3a39
- MD5 2a8a87da3a037fbe490c1087ca7e00c5
- SHA1 97b1a8623bc3903eb79c9d6da4bfd72a413e9e86
- SHA512 c79a77414bcc6d4838d9a7046faec3503507aa14f21fe09e6a03bf754ff19edc821199cd85572305397aaa7fdadd0075281502b4aa3df10e182fc2c0d01e44ab
- SSDEEP 49152:Vpx62yPWqeTrB+1motT/hUt3MlFkAQrRtuEX1vTr39:Tx6nar013/h6SFkAGHuCt
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
- Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.mdvmonsxa.lhqhmfqodr/app_fctorp/qodnigsofy.jar 5050 com.mdvmonsxa.lhqhmfqodr - Reads the contacts stored on the device. 1 TTPs 1 IoCs
description ioc Process URI accessed for read content://com.android.contacts/contacts com.mdvmonsxa.lhqhmfqodr - Reads the content of photos stored on the user's device. 1 TTPs 1 IoCs
description ioc Process URI accessed for read content://media/external/images/media com.mdvmonsxa.lhqhmfqodr - Reads the content of the SMS messages. 1 TTPs 1 IoCs
description ioc Process URI accessed for read content://sms/ com.mdvmonsxa.lhqhmfqodr - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.mdvmonsxa.lhqhmfqodr - Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.mdvmonsxa.lhqhmfqodr - Checks if the internet connection is available 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.mdvmonsxa.lhqhmfqodr - Reads information about phone network operator. 1 TTPs
Processes
-
com.mdvmonsxa.lhqhmfqodr1⤵
- Loads dropped Dex/Jar
- Reads the contacts stored on the device.
- Reads the content of photos stored on the user's device.
- Reads the content of the SMS messages.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
PID:5050
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.mdvmonsxa.lhqhmfqodr/app_fctorp/qodnigsofy.jar
- Size 1.3MB
- SHA256 2bd048ba88d634bb5ae468126c8a15512adc20e2d34dc1fdc95b3d697b35efcb
- MD5 911384c7a5dcf7687a5648d9a44b65e3
- SHA1 00cf45674e8bad8c4f189567e62d55d168d49a81
- SHA512 5d704d1d9370f52925b426a8a4d6d49d5475b2a3b36b9e504bab99219de435978d60617171aa913c0521c5c97fc88e89151ae7868a8daba1be9a109d7acb265d
- SSDEEP 24576:koub4YY/nM6mKEWDWQGZFJNnxqn/81WeId33FVHHQzhroDz50pyBuAbZ01w9Zh:kp4B/ny5lXU/GWeId33nnQxyz50pZ604
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/com.mdvmonsxa.lhqhmfqodr/app_fctorp/qodnigsofy.jar
- Size 3.4MB
- SHA256 6e074fea9a3c5083e173c908d25d4c13e10d49d00a0f3e4ef61b369b9409ebc5
- MD5 f88b900d1b9a248a801509464c45793c
- SHA1 b6b18d7dedd7d62509f9a740ef1a17d84c432944
- SHA512 d98f8b9570ff807df531f93ea4688e9e7e4a2ccecf820b6dfa27d6af0017c0fefb555b95a8ad4b376ed071e52b13afd03c795a353c9af793bc79fb4101b62cf5
- SSDEEP 24576:8KReTemKDteuqf60Zo3AGyJ+cXF/Q6bZQzG0u2Zs1CAgL06zV8LIFqwJvweYBdWM:ouqCywQQzU1aLxzaFB
- MD5 SHA1 SHA512 SSDEEP