5c8dd6c1676d2c094b0ed7d36fb94e0993ccd7c74dc9f323e8fc98728ba27ef5

Analysis

max time kernel
13s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240506-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240506-enlocale:en-usos:android-9-x86system
submitted
12/05/2024, 14:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3a9ab32ea262a5def1a119b8ed5abce0_JaffaCakes118.apk
Size 31.9MB
Sample240512-rw2ebsdf72
SHA256 5c8dd6c1676d2c094b0ed7d36fb94e0993ccd7c74dc9f323e8fc98728ba27ef5
MD5 3a9ab32ea262a5def1a119b8ed5abce0
SHA1 9498a36cfaebfae3221b66de19eb728794068668
SHA512 eaec68e7e920705027ad6d27a725d19309b2f083491dc80e9b75e718330164416d9104740da9b360f2ef6f8c301c9bf37fa54609100e2e495598f42bbb071275
SSDEEP 786432:5k2UClPdy6mPk51IbX1fecMcTom9C/ipn6DMjOFYWYh:22PQ61TAf2m8/KJjZZh
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery evasion

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.shogo.valk/files/stares/updates/sta.jar	4617	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.shogo.valk/files/stares/updates/sta.jar --output-vdex-fd=65 --oat-fd=67 --oat-location=/data/user/0/com.shogo.valk/files/stares/updates/oat/x86/sta.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.shogo.valk/files/stares/updates/sta.jar	4503	com.shogo.valk

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.shogo.valk
1⤵
- Loads dropped Dex/Jar
PID:4503
- getprop ro.board.platform
  2⤵
  PID:4536
- getprop ro.mediatek.platform
  2⤵
  PID:4556
- getprop ro.board.platform
  2⤵
  PID:4576
- getprop ro.mediatek.platform
  2⤵
  PID:4597
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.shogo.valk/files/stares/updates/sta.jar --output-vdex-fd=65 --oat-fd=67 --oat-location=/data/user/0/com.shogo.valk/files/stares/updates/oat/x86/sta.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4617

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

libabcdefgh.so

Path /data/data/com.shogo.valk/app_plugin_lib/libabcdefgh.so
Size 61KB
SHA256 9a712cb778e9d43f8f4ea9fa2b9f4b8cc29daf74984d04f0c938dff21c118342
MD5 042246eb7c48a8cda97de99465e6a177
SHA1 f71816c4a80fbb7b63bfd6425d98db513aecb00a
SHA512 2d201619998113c5d2990c92c28c973d557872bc4bbde153b5fca39bfe0b799ef0e9bf8c29d1304847f8e6691d55649d04c6a82fe8f03e621c9e8da50c50faa8
SSDEEP 1536:UHHNUMGO/LhgFfaKShdyjxeaQ/AykEr/8MBvvChCTrRVTMGrV:UnNUc+a7p/ztBvvChCTrRVTlrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

sta.jar

Path /data/data/com.shogo.valk/files/stares/updates/sta.jar
Size 2.1MB
SHA256 8dc8a08cb4af889317d11fec26e2c1058f2af5056a4dbc25deaec8707073947f
MD5 e1dd5bacfa75b9cf6abf6eaa1635e3c7
SHA1 96a86954d989f634798c91523712c34eab06da3d
SHA512 e62c106f91d7a7202411a6938ed721fa695257f205e93772a87c59804a899a1bafd4887d48f2c9f33e5fe3ab6965227beb3fee007515ceb926e83d0e990fcc37
SSDEEP 49152:V1anRWSRRAeAOHy5mWr7cZVsjFrcZzVCuSlH7WKYnRgIpLLw:naRW0AqyJ0vsjFGzoNK7nRgIpLw
MD5 SHA1 SHA512 SSDEEP

Submit Download

sta.jar

Path /data/user/0/com.shogo.valk/files/stares/updates/sta.jar
Size 3.4MB
SHA256 44d11f57ecd7596d3e762da32bdb8ed4ba94a53c585c5d9de47007f1a20d5eb2
MD5 ce124386c7b2ae625849c583f83967c6
SHA1 ddafd6802992f51f0409839453ef9fc611ca735c
SHA512 38f68a23c35e34ad857146b2a42866225f7588697e1887a854a03613565785f1d2cddc512b21a37889db00ec9bc57f061cb2b4578c5a5b24bb53012b0efad553
SSDEEP 24576:LEXvLo1sDVRVvI79D2ntLyHMcvu1/ELojnvy/PfKzZIvEw+jzyJHSaNMTCde4ekE:4fPw78BELKyyILQyJt2gw
MD5 SHA1 SHA512 SSDEEP

Download

sta.jar

Path /data/user/0/com.shogo.valk/files/stares/updates/sta.jar
Size 3.4MB
SHA256 245b99a86572d6736a00b18cdd507b865df688f14bf2fe232be26ef5a6171330
MD5 387e3984e552f9a4f47309dfc453f82a
SHA1 0e629acc985bb3565f33339ff04e9e1b73675cfe
SHA512 3d81d00d68b5ce7c5f91ad5086793b592d6f8658d67f74cdbdb9418c726dfb4f491a50a94030358927d8fd60c2a72534a11c13602424968e3bb99551b493dcd6
SSDEEP 24576:LEXvLo1sDVRVvI79D2ntLyHMcvxRxELoICNmyHNq0vXQOaM17R8Lw+jzyJHSaNMv:4fPw7lxEL4tHN2+RhQyJt2gw
MD5 SHA1 SHA512 SSDEEP

Download

.systemid

Path /storage/emulated/0/data/.systemid
Size 36B
SHA256 7a232ae58c530d55d4c5cb5c73b0a10ba2a643e6c6585d902b886ad80f767335
MD5 28220f53f431f2a78e90492ac98a0a21
SHA1 f5ff4a2024dc40f1ca138ab18bdcdd3c036a3b03
SHA512 7373f3c65b97bbf83e024750cd7ddd80266a586339c0788e15cfba71971f5f69705ebece6682f9ff5cf13a09def94867433d3ce8e50a80a6510577806f87fc82
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads