Analysis

  • max time kernel
    9s
  • max time network
    130s
  • platform
    android_x86
  • resource
    android-x86-arm-20240506-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240506-enlocale:en-usos:android-9-x86system
  • submitted
    13/05/2024, 10:24

General

  • Target

    3f04e519d4138f38c8477264b4186ac7_JaffaCakes118.apk

  • Size

    1.7MB

  • MD5

    3f04e519d4138f38c8477264b4186ac7

  • SHA1

    55f4743bcb57c56ad3f156eca0cd951d8d2009b1

  • SHA256

    72955544129e840a5784b3e69cba1d9a2e5ab500b14f6af39ca344561276d7ca

  • SHA512

    771322daed61f0a70e7b1bb65e060595cbb5541bdeb2161321a4867cac04a0fe7500d63ba7b60a9cebec218aab967d699a5fce6ad908bb36c8b8e2f235f2f60a

  • SSDEEP

    24576:3Vk8omUHxlytLHdX8fKMFN329d4p0DR/V+CDj54m4Y0xTcKYTcI2GsKp:3VVomUHHC9XeKMa0qhDum4TlnUsu

Malware Config

Signatures

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Requests cell location 2 TTPs 1 IoCs

    Uses Android APIs to to get current cell location.

  • Checks memory information 2 TTPs 1 IoCs

    Checks memory information which indicate if the system is an emulator.

  • Loads dropped Dex/Jar 1 TTPs 8 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads the content of SMS inbox messages. 1 TTPs 1 IoCs
  • Reads the content of the SMS messages. 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Checks if the internet connection is available 1 TTPs 1 IoCs
  • Requests dangerous framework permissions 17 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.muc.tfefvn
    1⤵
    • Requests cell location
    • Checks memory information
    • Loads dropped Dex/Jar
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Reads the content of SMS inbox messages.
    • Reads the content of the SMS messages.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4245
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.muc.tfefvn/files/hul/ALlsMTgRTg.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.muc.tfefvn/files/hul/oat/x86/ALlsMTgRTg.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4271
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.muc.tfefvn/files/Pdd.apk --output-vdex-fd=60 --oat-fd=64 --oat-location=/data/user/0/com.muc.tfefvn/files/oat/x86/Pdd.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4344
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.muc.tfefvn/app_dex/utopay.jar --output-vdex-fd=74 --oat-fd=75 --oat-location=/data/user/0/com.muc.tfefvn/app_dex/oat/x86/utopay.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4377
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.muc.tfefvn/files/yl_plugin.apk --output-vdex-fd=76 --oat-fd=78 --oat-location=/data/user/0/com.muc.tfefvn/files/oat/x86/yl_plugin.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4405

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • /data/data/com.muc.tfefvn/app_dex/utopay.jar

          Filesize

          30KB

          MD5

          eb6089c1acfa9f12535e533aebee845e

          SHA1

          165e39ee07dcd9ed00fc2dc1ff466bc1d6b813c9

          SHA256

          b825cde84e3dddfc147c71265d2259c422d51a7e56d1dcdba1321e3119b1df07

          SHA512

          5b1bc26bcbcf05fc331865fb4dd572b673a52650d68ab4d9b028ea15219e0d93c1ec17996953436801913388d78e25c67ea33aa93544d65e96a799eb06cc70f5

        • /data/data/com.muc.tfefvn/databases/740410100062013-journal

          Filesize

          512B

          MD5

          fd39fac712cbf22f95fdf254a9cdb120

          SHA1

          31098a761abc1354441bb8de87c05f11d8eccf1a

          SHA256

          35239a8e63bba1db317414f445158a3c8196e84fb4c3f64b21d50d4c9dc86788

          SHA512

          8284c4eae095798a58b6ff9942e02c2bcd30fd78a50e1ff9f57d15027397953ac3f31d13f23767cdf9e85c7a58ac7c087e1ea5661f4c7a88fe4375be02e91a10

        • /data/data/com.muc.tfefvn/databases/740410100062013-wal

          Filesize

          16KB

          MD5

          c569d2d6f0b05176e0b41fe49919fdf3

          SHA1

          450324c07d2f242b8812e932f87181ac5628d69b

          SHA256

          5df879b3e17a5b58435bb598cac1d131530301953167083c4a07de6b9625e5cf

          SHA512

          afd1da5a95f91c14409e4a8f3adf8414b8105e3acafc2cb53e3c544cfec8678552192a8810f9e4385d8400517a51e401e75dd729480547d2f996b38fce6f0908

        • /data/data/com.muc.tfefvn/databases/wochi_v4.db

          Filesize

          4KB

          MD5

          f2b4b0190b9f384ca885f0c8c9b14700

          SHA1

          934ff2646757b5b6e7f20f6a0aa76c7f995d9361

          SHA256

          0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

          SHA512

          ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

        • /data/data/com.muc.tfefvn/databases/wochi_v4.db-journal

          Filesize

          512B

          MD5

          4f5c5d752980cb497985e24f6ec048b1

          SHA1

          68ecc43e0c8a0c7694a7e46072079c980da080e2

          SHA256

          9004c96364d29f8cc169bfed6804a99b35bd992730fb83de909c02abd604aee9

          SHA512

          a04b086aa1e386d8bc4f3d4de803d8cbd42ec65d3df0baacab38344b8d537db25647a7d19c7e6faa71873ae811902418e84267f8c6ed8a91f5785cfc31af61b9

        • /data/data/com.muc.tfefvn/databases/wochi_v4.db-shm

          Filesize

          28KB

          MD5

          cf845a781c107ec1346e849c9dd1b7e8

          SHA1

          b44ccc7f7d519352422e59ee8b0bdbac881768a7

          SHA256

          18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

          SHA512

          4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

        • /data/data/com.muc.tfefvn/databases/wochi_v4.db-wal

          Filesize

          20KB

          MD5

          e6d9ac659e6677a2437313d402f42b80

          SHA1

          b6d35b0a7918aa714483cfe7cf0ac2fcb8cfb6c1

          SHA256

          6abdfed68f8134264b83f4eee09228877804474cab2641608ac148dec135f1bf

          SHA512

          fe0136d62d4e26591c13c3a9c69518062213ef416921f7b818d556cbbd0f18266cbb6f38267131b80a8d815f7bbf1b0eb4e55b7e613f08303b352c00165cef13

        • /data/data/com.muc.tfefvn/files/Pdd.apk

          Filesize

          99KB

          MD5

          e8fbf92c750dbd6fb316be82a6b7b7ae

          SHA1

          2a6ae9568698807cacc8cf4349556446c996b136

          SHA256

          2a3cb93d0ca14a1d0b0820c2a26df502a461fb2546ef4587524087c130553f10

          SHA512

          7848191878b5b8ba2d5020c7be953e70ccc4d392d29e400a65a57cd3731604933125de1d81b3732d251b3450fd4766a814ccd01f3975beda2499a9ba585a26e0

        • /data/data/com.muc.tfefvn/files/hul/ALlsMTgRTg.jar

          Filesize

          772KB

          MD5

          329d0b850ccdf2dd34bf5d9468295cc5

          SHA1

          dec87c248664b61ff9840e6a54588744a0d34dd3

          SHA256

          04252d41de33657c78bb1bdd80b20be5d83e33d201c2f23c54dc1ad1ceeee991

          SHA512

          e33f6674c11fafad05b4f8d5fecb8e39733dc122b0b53ca9178a6762299113156399f171e460f15f4bce53e95d09d8c0fdd90db1832ef74af282e81f9adc5fb8

        • /data/data/com.muc.tfefvn/files/log.dat

          Filesize

          221B

          MD5

          ff9229f8e7c92d44d48e25206d43b021

          SHA1

          be3d75050c16c5b7484652ba292fdd6510f205d3

          SHA256

          77fc3599be409f7e73e643de843c0ebcfa20662964c498fc59e245c7f5e003a2

          SHA512

          be7b3aa8d670a2873c6b7bfd4ca93121fd2450723cbbc36d9d06d152fafa3ce90451f0a60ab56bc96bccb81cf5aae0167b404073db14dc17b9513ac73d455c58

        • /data/data/com.muc.tfefvn/files/yl_plugin.apk

          Filesize

          58KB

          MD5

          5a4c666b43ee7f2b6995aaf3527e4a4d

          SHA1

          b205bcb022797f3b16635db139c7524c0c388adc

          SHA256

          05eb3e1ca331b8c6a1f60f92abb2bddbac54a7b2c229ac07bf26c756297fe72a

          SHA512

          c84fceddbf9928110fc3b85e0989b9cedd06383007ff99dea5a25096d8f892ab52d30ed9b52b72211449041f1274ead85bb42929ec269b58b6b0e616a8545e17

        • /data/user/0/com.muc.tfefvn/app_dex/utopay.jar

          Filesize

          67KB

          MD5

          3b8bb9a8679ac8c24e8d179fc5bae999

          SHA1

          e6ea7a1095524087f481ba04321c4cb6fd2426f3

          SHA256

          83c996c0d067b5f516897480f427dfffdcfb49ab7654dac9b805376bbd49e1db

          SHA512

          abf1cbed7a8cf4a29d7a32a83f15aa0a6c9e2be8484c2dd8d9bf16a76e337b17b9c05efa0773598806b3d3da4fe3a9217b583abb9aaf5e3dc054dc77b10cae63

        • /data/user/0/com.muc.tfefvn/app_dex/utopay.jar

          Filesize

          67KB

          MD5

          5220524411d0bacd600da60814d1ee9f

          SHA1

          fef7210ff44e757328bc0ff7aae7bb2191cbf634

          SHA256

          6286a800597b845785eb664710253ebd20771737dddd5b80067e0e9d37c804b2

          SHA512

          b2d8af5019c176d682634747d83320e609fb6122ef850f4069a0c78c2415d242087099cf60ecb03039a9ab71902a4e3b22e9cf144de89e506991fb93280f6a5f

        • /data/user/0/com.muc.tfefvn/files/Pdd.apk

          Filesize

          201KB

          MD5

          b91783059376e2bebfd7c24802289350

          SHA1

          9e0f855404908f993a3beb146e7a4e83789674bd

          SHA256

          46245d65e1d96038918f77ed8412bcde6a72b513c94a72369a751251f568e73c

          SHA512

          c50af3f34a519fdb34aa9be70128c55c57df169f8112887f17f9dece581a15cd9b6702939ee4f77370bb33a5d2fe449610c42e699008d4233344d406c3563f30

        • /data/user/0/com.muc.tfefvn/files/Pdd.apk

          Filesize

          201KB

          MD5

          a4237ef36f11c2db307f6d9701da0062

          SHA1

          5d11008a4b9275034db8904e538f7115a429ef0d

          SHA256

          32f697f7444c79efe23be55fdcdab52c8e6f5cd43474cd1735602675feb5639e

          SHA512

          6921b3cbb4e6a062eb9408c06e46e6d6cd7554f6e485b8f6275d8df3b7a8d23b26220c0cb979d3fe919fb6622d5d49160769b0567eebe61488cc4c7708f3b34d

        • /data/user/0/com.muc.tfefvn/files/hul/ALlsMTgRTg.jar

          Filesize

          1.8MB

          MD5

          47b903db4755bded81796df10598727f

          SHA1

          a8467d4305c6d583bc2bce002d5d7aa0c20b9138

          SHA256

          2ea43ee22dd851a9ea2560342697d4bb49be0f7231f61f1cd335b6c5102e310e

          SHA512

          d4ff62156840e12d225bfa616599e69e845c84c16088b39327bd3a0e24dc53b569c05983d5df06fa3bebc024078dd59dfb511bbecbf0fa546365931e73d48fc3

        • /data/user/0/com.muc.tfefvn/files/hul/ALlsMTgRTg.jar

          Filesize

          1.8MB

          MD5

          fe81101dd31e4c9cb4a417a2dceffd30

          SHA1

          5486003b6dd78151f69443240b922a72e717bfee

          SHA256

          7838a807176b78303461c359eec997b6decc1a28926e5803f46c407fceda1db5

          SHA512

          5d3dc98a6abeb0b02e061e8972d420a6becf4ac7696dc3ef0ce46d7c9114079ecd3a284af2d88d0244aa3a6df15b4809239e920328240f8fd67083ff6a27b53e

        • /data/user/0/com.muc.tfefvn/files/yl_plugin.apk

          Filesize

          123KB

          MD5

          9fc68c74fcdf2ca6c0252ed39de275f0

          SHA1

          84438de24f01ade937d2f1a0f70c797e616b7199

          SHA256

          87751b4f40f3cf03b3e2a1e5eb9ef248ad79a8f47304d2a527939ed634ac8f2c

          SHA512

          10feb413b7a89f92339dd1d1a9538fdb22009279778d985f6649faf0af7cd1d5998adff439cad6b99ec2aade6b235b72385a83d9943e5b5898eb7ecdd7a398e8

        • /data/user/0/com.muc.tfefvn/files/yl_plugin.apk

          Filesize

          123KB

          MD5

          918890b3fc5a3dc184a57d027ead24da

          SHA1

          c638f375f49bc4731b633bdc001aeeadf9462039

          SHA256

          57d03ac2189851d5069515da6997e12ca307c145aa21679da001477df5f81836

          SHA512

          fd9bfe41ce4041dc8c7db17df2a2164a24ea96372c212399c499f94d1fb7d95d430b8a7eb86041b9b2db88dfca0cf39e53cba2dad1e346aebed29e4ca5deb2ef