75c7a9686219864a8903ce6862a709bc9482559531d122f7ef70dfdb0e02107c

Analysis

max time kernel
11s
max time network
130s
platform
android_x86
resource
android-x86-arm-20240506-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240506-enlocale:en-usos:android-9-x86system
submitted
10/05/2024, 02:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d03045b48941f43d83846fb8e62d550_JaffaCakes118.apk
Size

24.8MB
MD5

2d03045b48941f43d83846fb8e62d550
SHA1

5154fb217e4993b89c21813f305a549d2506f3f8
SHA256

75c7a9686219864a8903ce6862a709bc9482559531d122f7ef70dfdb0e02107c
SHA512

2739d4156d942ae41298a801cee860e17a4bec9c1030314f529d35f8bce708882c8a616808878c86eb7d9e98dc386df237362eb8f9a371e0e2e98ae7c73cff8f
SSDEEP

786432:FJMc/byRYcjAkI7Tnd2Hy2Gh7QE8z3LtKCXrsh5g:FJDbe+Tnph7QDLMCQhm

Score

7^/10

discovery evasion

Malware Config

Signatures

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.hoplite.broadsword1

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.hoplite.broadsword1/app_app_apk/broadsword1.dat.jar	4308	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.hoplite.broadsword1/app_app_apk/broadsword1.dat.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.hoplite.broadsword1/app_app_apk/oat/x86/broadsword1.dat.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.hoplite.broadsword1/app_app_apk/broadsword1.dat.jar	4278	com.hoplite.broadsword1

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.hoplite.broadsword1

com.hoplite.broadsword1
1⤵
- Checks CPU information
- Loads dropped Dex/Jar
- Acquires the wake lock
PID:4278
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.hoplite.broadsword1/app_app_apk/broadsword1.dat.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.hoplite.broadsword1/app_app_apk/oat/x86/broadsword1.dat.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4308

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.hoplite.broadsword1/databases/DownloadsDB

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.hoplite.broadsword1/databases/DownloadsDB-journal

Filesize
512B

MD5
bc95cf7032e0b3c6f248a7ca92343b43

SHA1
577fb99bb3b225551117e0317075a8f0e58b65ed

SHA256
dc16e1fe04b195fd3af6f7fc8cdf46d0edf0b603b5e85a171e7ed78da82eac01

SHA512
a4d5d7bc60f7d17e397354f33d46e2b359df9d19a3cdbf4e31d18d7446c59d51725d41a5ea4a61d0445e8849aa814dc588dc163c4b67ca856d5aa4257a151520

Download Submit
/data/data/com.hoplite.broadsword1/databases/DownloadsDB-wal

Filesize
40KB

MD5
8c16e660032944ae2aaeb48a1077e4c4

SHA1
071915b6806de500c7678a79e80c979079f3c92e

SHA256
655bc661c85377a1c77b84d5a280dca02f7e01fec53bd8338d734ad61f2f0627

SHA512
d3b4b54a94288c5a3ae7cb23566b5ad9e50c6c63c62c5e6cff9d58d3448c9acee9f42d943e71ac918c4b64729709a8e5dcfd36a209f778d5de075407f1737c19

Download Submit
/data/data/com.hoplite.broadsword1/files/rDYARANyb

Filesize
378KB

MD5
d4501e3ed3c335b1aa53e69fb766ace7

SHA1
764522c9fd06b208af97c3888332d80f58434774

SHA256
1f603cadb7e2b39355a917ea54c6fd4f6730c60b3d7c183f82decb89c1e34c4a

SHA512
aee18eaeb6703966ae9f282a21689a7329562b79d6f3a2d71678478a21b0d9defe62f8e97c1170223412b66ca746459f04054943e8dbd0815b9f8908ced00eb4

Download Submit
/data/user/0/com.hoplite.broadsword1/app_app_apk/broadsword1.dat.jar

Filesize
507KB

MD5
a419e094eba4b7856645983c2b1bb410

SHA1
c426fdcc886199f07efc4987c28998bf55487287

SHA256
5a892630f55822cfe0577f58e71c06637551b89c49c66defc1d5e8a7ac122389

SHA512
b08f168675ef3d2a19d057b18969f0aa06f639c96300c6e43a5736247e18d52b70b2d02c2ca9d0f445ca7ed4c9c78ed50bab89d38c043e6f4c61158f21cecb77

Download Submit
/data/user/0/com.hoplite.broadsword1/app_app_apk/broadsword1.dat.jar

Filesize
507KB

MD5
7be9b4f0e121a6df0e59240d76e5299a

SHA1
a1e4310a556a65c61e7cb8a3ce5d305ea45ee7aa

SHA256
09dd189ca671e0a67db9e9c8388135ad9ebb0f7a76396fb1e83c1561e5bb0b09

SHA512
6a57d8c4f5237ac1f00f086891772cb40da9830b6248b2c296b68ff274a7f6f84c1161110011e3c7a8ab762d40506a3a676183393a9ec8faf54c157a537e272a

Download Submit