b071f23d5a5faafad2144f17afc9c38d23b30ef8eae37b318b7dcde0d9293414

General

Target
471b82b10abd662b32f9c0515c95f3bb_JaffaCakes118.apk
Size 1.8MB
Sample240515-vdgtraaf22
SHA256 b071f23d5a5faafad2144f17afc9c38d23b30ef8eae37b318b7dcde0d9293414
MD5 471b82b10abd662b32f9c0515c95f3bb
SHA1 bd6460829bfc51bb8df3bad88172bf63ac5f259a
SHA512 fad2645957d10eade0330c87507bccaa1823dc036fcd002e2c40bff14088346029e37c498d852f5af8224c135f170387bea70f7d3c13e02ad18ad619d8ddb205
SSDEEP 49152:vFeZJbAE5yo888si3EXMizSin90Qz73ZiG:vFi5dxJT19
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection credential_access discovery evasion execution impact persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4591	air.au.com.metro.DumbWaysToDie2.hack

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	air.au.com.metro.DumbWaysToDie2.hack

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	air.au.com.metro.DumbWaysToDie2.hack

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	air.au.com.metro.DumbWaysToDie2.hack

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	air.au.com.metro.DumbWaysToDie2.hack

air.au.com.metro.DumbWaysToDie2.hack
1⤵
- Removes its main activity from the application launcher
- Checks CPU information
- Checks memory information
- Obtains sensitive information copied to the device clipboard
- Schedules tasks to execute at a specified time
PID:4591

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

1

T1603

Persistence

Scheduled Task/Job

1

T1603

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1628

Suppress Application Icon

1

T1628.001

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Clipboard Data

1

T1414

Discovery

System Information Discovery

2

T1426

Lateral Movement

Collection

Clipboard Data

1

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

1

T1641

Transmitted Data Manipulation

1

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

evernote_jobs.db

Path /data/user/0/air.au.com.metro.DumbWaysToDie2.hack/databases/evernote_jobs.db
Size 16KB
SHA256 9d74f93afa5a179b1ba2f19f154b2880aa8b99c88209802099045a0874d2426a
MD5 58c0b6e45328752b20ac6e719ac034f8
SHA1 372b2638afd00bbbc4034657b3df3d2e428fb367
SHA512 2d347d5824b9ab701e341c89e8327a95fd6bab8e92ee15ce9550da368d773e22bff304072a4854df5ab763750a7401f7aa61a49e3292d62c27fa9f20536eb3ab
SSDEEP 12:TLpvpN0KkYrZASBMAB1G0d/P6dMbWAz9m9W3dOsuA3MTzeRmBEyPbBvOw:TLhpOKRvTZYAZ3mGSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

evernote_jobs.db

Path /data/user/0/air.au.com.metro.DumbWaysToDie2.hack/databases/evernote_jobs.db
Size 16KB
SHA256 ee8ad965f1e77019c9f35fc58f46fd40402aa1764131a4091e4c4d8390712eee
MD5 5f574e2246699d9968884badff5d351f
SHA1 b22207fe820313ee8a9c5fe1e1f7b58c4d2ab272
SHA512 94a6985964373d83d15f7819e193cf9d43b11ed518c79f11dba0f99755c55327ae3f9e99bb84455a762ab252155e3e6364e09c49de857765b906e09790897fab
SSDEEP 12:TL8UpN0KkYrZASBMAB1G0d/P6dMbWAz9m9W3dOsuA3MTzeRmBEyPbP/U7uu:TLRpOKRvTZYAZ3mGSP/UCu
MD5 SHA1 SHA512 SSDEEP

Submit Download

evernote_jobs.db-journal

Path /data/user/0/air.au.com.metro.DumbWaysToDie2.hack/databases/evernote_jobs.db-journal
Size 512B
SHA256 6f9f33ccaf28962e1bfa32b64b18fdfa96492b346aae865e016c460e92691d01
MD5 c70e643c1b731260fdbf342874985a94
SHA1 5bbeb0d36b615296adadf95f300cefa719376901
SHA512 7211e6864dcd88fa2049a7677b59116c9231ccf815c106d39768cb97d6330a3faaafc8ef42bc6c704579ece27f4e1d58ed70688c8c28837d4bb866066f4c88f8
MD5 SHA1 SHA512

Submit Download

evernote_jobs.db-journal

Path /data/user/0/air.au.com.metro.DumbWaysToDie2.hack/databases/evernote_jobs.db-journal
Size 8KB
SHA256 0e062b4ac26bc53451348e85aecedb98ec6a46f6081b3de67e7b955730f1f6b8
MD5 2c9cdb01ad07c6ba0fdd69bb47a2413f
SHA1 bcee3e281ba93835c708b54d9edd4e35fe69f873
SHA512 03ab5fb0eba75fcf06aa8b4e4c2a0a41eec4f2cf2b75a79568bd87bf6a91621ac1fb6a4e42df902e870c0cbeef3b9c96b54fc7ed6276de2257e530c44677378f
SSDEEP 6:7+/l9Un1ekg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKQ:7+tkqLiuWdYRmBEyPb7
MD5 SHA1 SHA512 SSDEEP

Submit Download

evernote_jobs.db-journal

Path /data/user/0/air.au.com.metro.DumbWaysToDie2.hack/databases/evernote_jobs.db-journal
Size 8KB
SHA256 52a7dd0b8ea3b54728106656ec14ee0d4f4eaf72e3ef2cdbeae4b8bdae4009b3
MD5 53c7e4f66cf92048710b5bf522e680ec
SHA1 fcbf703be6e1d8bb2966d8c6b26176e19727ccd9
SHA512 599ca61f7126cb025eb8a49e9503a367bb0bb0ec114a1b62200d5e598ac8e810de08832be80c79c2b284e9f401fd4344758b4f24a0b5d7ef1629a376b0229a9e
SSDEEP 6:7+/l9sKFPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKut/2:7+ttBqLJdeWRmBEyPb52
MD5 SHA1 SHA512 SSDEEP

Submit Download

evernote_jobs.db-journal

Path /data/user/0/air.au.com.metro.DumbWaysToDie2.hack/databases/evernote_jobs.db-journal
Size 8KB
SHA256 5f72e6061b82275bd853b81a744913ed96baee3cafc0191649e1903b1678da6b
MD5 1d6a34512fab27d47da1ce1ac21edace
SHA1 c8d3de0ff216ab9a96c54954f375261a23ebbb52
SHA512 3aed5fb34459bbbb733e98031191b8121c988e41f421fd27d4660c7d3c01df17ddf1760b72713a71254177ee63642d3f8e12f4fa4a844677f3615f5d3b41a2c9
SSDEEP 12:7+t5lopqLpvpN0KkYrZASBMAB1G0d/P6dMbWAz9m9W3dOsuA3MTzeRmBEyPb1n:7+tMpqLhpOKRvTZYAZ3mGS1n
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads