27e6fd78d0823e01c889ff1167032fdcc6e862566a459198a0da5de239c35fd1

Analysis

max time kernel
8s
max time network
176s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
16/05/2024, 08:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4a518d81c4d79935d56d5e11a677f333_JaffaCakes118.apk
Size

1.5MB
MD5

4a518d81c4d79935d56d5e11a677f333
SHA1

cc738d9c6d0df420a4b85da9fd21db87f516c2bd
SHA256

27e6fd78d0823e01c889ff1167032fdcc6e862566a459198a0da5de239c35fd1
SHA512

ffbbc3532bca96f24126fea4cd7ff63728be854731846469bab46c2e79001c7600b47d29623561aa18e85242162a2964c0bc15227d9385d5bc89ec08db0ff4fb
SSDEEP

24576:y/z9PTC16IpezVanLKwzF6OZS3qUDYoxNRXorMT86adRskrejMmoQwTWTKrrq2:y/z9PeQIpezqKl3qSZRXbgAHjMtWOvb

Score

8^/10

banker discovery evasion impact persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.train.time.search/files/searchq.jar	5108	com.train.time.search

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.train.time.search

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.train.time.search

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.train.time.search

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.train.time.search

com.train.time.search
1⤵
- Loads dropped Dex/Jar
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:5108

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.train.time.search/files/searchq.jar

Filesize
189KB

MD5
8efce37f082b45ebe7c54405da08240b

SHA1
dc4e23ffe3311e67066d21d3530dd877134f4d69

SHA256
30eb3fae3fd38035471ebfb0e0d9f22ce1cf09d5ad15fa00240478685c1afb87

SHA512
877d876ac517d4559f86d64da3ebc27e3130ee7356554e65717333d914139b11d5b511338a550306ed9ba9c7a8e141a90695fd6f4eefdb5f272ee7ab390a097d

Download Submit
/data/user/0/com.train.time.search/files/searchq.jar

Filesize
434KB

MD5
8d5cc189ea7ca0e8600200381c0f06be

SHA1
718bec6edf420d2b411e0f355d2937657f0d4387

SHA256
184e05131c2747b1558807ede0c5fe5ef766b649c0435e0ac8b86316652a273b

SHA512
24ea4e45147d2b3c391b09ad76d784e1c8ea1c0e8e03aaa23d90a12756c1204fc0df65396c97bfb3a8e357d247d1969e31833f6bac346d2fa6e371930b678484

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads