a3a30aa5bef8c0f5f7a5c80d5a2af708d2283a61a37c202b1af494782ad7f88f

Analysis

max time kernel
8s
max time network
143s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
17/05/2024, 02:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e1587252cb904720fc26af46b201741_JaffaCakes118.apk
Size

30.6MB
MD5

4e1587252cb904720fc26af46b201741
SHA1

c287654b942fd6426a5b97586b3c7120b866780f
SHA256

a3a30aa5bef8c0f5f7a5c80d5a2af708d2283a61a37c202b1af494782ad7f88f
SHA512

e843e27084788a8eb174010491415de050e810217a8babf8c0ff5abc4877aabe974af2b6759ee516e8835f377e1b4c0d2962d245796d839fcd31e58cebe9b480
SSDEEP

786432:OIY3jogIQNq5Gl77xNY/nu/VzphSlbU85zOpB4gWUfqFhz:hY8gLQGh9NYfApolQf4gWr

Score

7^/10

discovery evasion

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.pooandplay.actionmoviemod/files/mzwres/updates/mzw.jar	4307	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.pooandplay.actionmoviemod/files/mzwres/updates/mzw.jar --output-vdex-fd=57 --oat-fd=62 --oat-location=/data/user/0/com.pooandplay.actionmoviemod/files/mzwres/updates/oat/x86/mzw.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.pooandplay.actionmoviemod/files/mzwres/updates/mzw.jar	4265	com.pooandplay.actionmoviemod

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.pooandplay.actionmoviemod

com.pooandplay.actionmoviemod
1⤵
- Loads dropped Dex/Jar
- Queries information about the current Wi-Fi connection
PID:4265
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.pooandplay.actionmoviemod/files/mzwres/updates/mzw.jar --output-vdex-fd=57 --oat-fd=62 --oat-location=/data/user/0/com.pooandplay.actionmoviemod/files/mzwres/updates/oat/x86/mzw.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4307
- getprop ro.board.platform
  2⤵
  PID:4334
- getprop ro.mediatek.platform
  2⤵
  PID:4354

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.pooandplay.actionmoviemod/files/mzwres/updates/mzw.jar

Filesize
868KB

MD5
548a355e9ab43cc847930638ec1bdee2

SHA1
8e8d50b35d5059f91fe65d6829ff5dcad50aaa95

SHA256
bfb26b7f54e142193e59a4f7bc9b796c3d745cbe02cbbb670af417cec2d1e044

SHA512
6a7f1da871115347a90fe4c0cc6851239e4b96cb128a202c658b914f1036bd7dd7aae17d041b8a025c2645595972957b044eb5aa3d83f9852c8f0ccba4a0f46e

Download Submit
/data/user/0/com.pooandplay.actionmoviemod/files/mzwres/updates/mzw.jar

Filesize
1.2MB

MD5
779f2fa750b8f7394df45265b6a1eb3a

SHA1
873068b10d43ff074229854845056adcae1af070

SHA256
a6c23d29e459e91d81c871d8699b2aeab5fc7dc7ee3b377977761f9fc17fe8ee

SHA512
a5846f8c8d13670dd56f5c1a7d6c228055d2dbec58359a71ce1ca841890611c236714efef9c6dbdb3a1d1f05076d897c2091632a69c776c52b7af58eefb90569

Download Submit
/data/user/0/com.pooandplay.actionmoviemod/files/mzwres/updates/mzw.jar

Filesize
1.2MB

MD5
89aa83521f6d62c720b3de8ba24afa7f

SHA1
c6bc1ef3e13d41e162ee41919bcf8f179cffc59b

SHA256
9187a6c1cb8af91fb6b23f24ade20eb473a7253c0b9019135defc590738835f3

SHA512
8a27441e1afc676f07b71e82f420c69cc7c12a2a71619964607709dc14c0dcfb6b7d081613c32d453dccd70a01d83424cf3892a73da046e115e55553d459c479

Download Submit
/storage/emulated/0/data/.systemid

Filesize
36B

MD5
43a213213c1995659951cf62fce34c28

SHA1
d6a8852e7adae1c1fb896c56987e7530d0e025b7

SHA256
746b2980f7b6d7f4f0f5ebddb4fc98503b534b77a5d0f76efd4faffa53bbf795

SHA512
877e01b18543f0b2465c4eb1562b8107952a0e7df73b6cf3b20933a612cf13cd6a58ce1892570494ff3059fce04ad92f68c7148feaa3bf3f94c4fcc0092e1db8

Download Submit
/storage/emulated/0/data/.systemmac

Filesize
17B

MD5
0f607264fc6318a92b9e13c65db7cd3c

SHA1
c1976429369bfe063ed8b3409db7c7e7d87196d9

SHA256
c248c629af1fe0a8c46b95668064c1d2952a9e91d207bc0cc3c5d584c2f7553a

SHA512
9dbd40b135b46c7be31b8c7d11c75b0b179af3a6550fca52ec447583aeb50aaaedb4b1e9373cf8826615149549a2efaee04efdc9a282e3a6b387c73099c13fb1

Download Submit