cefc25189f332ce95b39e2ac040ca0454981f676a0e2101f637b537a85646698

General

Target
4f4bc0c17e6e5b8c69d5fd828c0f6b00_JaffaCakes118.apk
Size 4.4MB
Sample240517-k4cbvabc34
SHA256 cefc25189f332ce95b39e2ac040ca0454981f676a0e2101f637b537a85646698
MD5 4f4bc0c17e6e5b8c69d5fd828c0f6b00
SHA1 4415f3fe00bf83f5f921dcc7c5dd3156ebd4dcef
SHA512 81817450d395fe0f93fde69bc4b507f5c622a3a4a4e20859bb7ed7f28995ba4bbd505ce4fe7a3b2e18a1bbfdb271d8841ca285d2f2f7754b582fc67b9288d617
SSDEEP 98304:41VxEVo43uzlr3RvOIPcNajvCt3/0LJfRuqo:OH/bhBXhj0v0LJfR8
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection credential_access discovery evasion impact

Malware Config

Signatures

Checks CPU information 2 TTPs 4 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.dcloud.BDMHJBJXC
File opened for read	/proc/cpuinfo	com.dcloud.BDMHJBJXC:pushcore
File opened for read	/proc/cpuinfo	com.dcloud.BDMHJBJXC:multiprocess
File opened for read	/proc/cpuinfo	com.dcloud.BDMHJBJXC:multiprocess

Checks memory information 2 TTPs 4 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.dcloud.BDMHJBJXC
File opened for read	/proc/meminfo	com.dcloud.BDMHJBJXC:pushcore
File opened for read	/proc/meminfo	com.dcloud.BDMHJBJXC:multiprocess
File opened for read	/proc/meminfo	com.dcloud.BDMHJBJXC:multiprocess

Obtains sensitive information copied to the device clipboard 2 TTPs 4 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.dcloud.BDMHJBJXC
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.dcloud.BDMHJBJXC:pushcore
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.dcloud.BDMHJBJXC:multiprocess
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.dcloud.BDMHJBJXC:multiprocess

Queries information about running processes on the device 1 TTPs 3 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.dcloud.BDMHJBJXC:pushcore
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.dcloud.BDMHJBJXC:multiprocess
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.dcloud.BDMHJBJXC:multiprocess

com.dcloud.BDMHJBJXC
1⤵
- Checks CPU information
- Checks memory information
- Obtains sensitive information copied to the device clipboard
PID:4308

com.dcloud.BDMHJBJXC:pushcore
1⤵
- Checks CPU information
- Checks memory information
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
PID:5170

com.dcloud.BDMHJBJXC:multiprocess
1⤵
- Checks CPU information
- Checks memory information
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
PID:5241

com.dcloud.BDMHJBJXC:multiprocess
1⤵
- Checks CPU information
- Checks memory information
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
PID:5482

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Clipboard Data

1

T1414

Discovery

Process Discovery

1

T1424

System Information Discovery

2

T1426

Lateral Movement

Collection

Clipboard Data

1

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

1

T1641

Transmitted Data Manipulation

1

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

1004

Path /data/user/0/com.dcloud.BDMHJBJXC/app_crashrecord/1004
Size 58B
SHA256 988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
MD5 0d210bfb2a0e1f1b4c082a6a0f79de07
SHA1 bb8ed9e364db79d1d9f2fcde3f15091893222faa
SHA512 536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1
MD5 SHA1 SHA512

Submit Download

1004

Path /data/user/0/com.dcloud.BDMHJBJXC/app_crashrecord/1004
Size 242B
SHA256 0f8030d946567b43fdb0cbcd65fe9d66f56093105bd3a78232af41ae29f450e0
MD5 9630b7a7aa14d9a1145c17a1949c2eaf
SHA1 6c6f3bf0549d730e98c79ee8287aa66cfaba3a4f
SHA512 3125a3173aa1041a47ec08c09c9cfe7f6e062ad323b47337df0396b2dad83bd7d383d1e18b8ab7a666aa73942a42bdcdac1ff4fb895f5ba5fd989ec262b5657a
MD5 SHA1 SHA512

Submit Download

download_upload

Path /data/user/0/com.dcloud.BDMHJBJXC/app_tbs/core_private/download_upload
Size 84B
SHA256 ac1ba128da317a676a0c6be92021bf763f87e5fad6d77aee32ff55eb9365fec6
MD5 d520751f794513250a5c624492ecf1d6
SHA1 77d78969f9c7d1971c05224ad3bbe6431f62e267
SHA512 8c4c61044819aad189ecac5cd339f4a7807c8dbf8fc113686c860967982f4a456d41d8e2969df1fea054a2a3e135b559f167afce9c6a8a578c58d8b020428bbf
MD5 SHA1 SHA512

Submit Download

download_upload

Path /data/user/0/com.dcloud.BDMHJBJXC/app_tbs/core_private/download_upload
Size 18KB
SHA256 9bfe29881f4d7bf4dedd3ec8210e8742e3855f74ad75bd13c46a00359211e1a4
MD5 879b9c2297b7422bb6fee4b97d07a642
SHA1 463c49584ba2f2e4b1b04280718970e9227706da
SHA512 0aecb8aa8c7a468274389ce50c7632c2ccb99d76308018e4d098f5bb0563148fac6994c6db366ff0464079914a6c84bbfa4e48bacf9798b8f6a0ff3ae11c84d0
SSDEEP 96:h3dqduLR2VVM8i2a2qyBTXHGhyFPdilucVdlVRuW:G+r2QpX
MD5 SHA1 SHA512 SSDEEP

Submit Download

download_upload

Path /data/user/0/com.dcloud.BDMHJBJXC/app_tbs/core_private/download_upload
Size 84B
SHA256 9b651675f9bc1443f12776b44758b94fa3395eebaa5f2de203d65ab59edbe67d
MD5 cf3a96299ead6c51cfab6c3cba3764d4
SHA1 8ccc9c50e02fd2b643a5bcb01d9dfac163ef85b6
SHA512 b9777579fe5018058a7d98a0768b0c24a8ad70a6c63af38b5826fa3e9c3bfe92f488cf1fbad5656697cc345b0071d896f00fd2d27107e2f2db506efb97e9d378
MD5 SHA1 SHA512

Submit Download

download_upload

Path /data/user/0/com.dcloud.BDMHJBJXC/app_tbs/core_private/download_upload
Size 16KB
SHA256 e8c67cf78e39ae8113c1890d939d8de4d68af72a6ff3c74cf62c49509240e5f4
MD5 cb3c6294bf70373627b0a22da46bede0
SHA1 71d4bdf4f1656bf4b385f74bfb2776fd11e9ea1d
SHA512 72c9e4ffdc9ed3e3dede0271d9c016f2fdd8977a836c94a0fe10b1d97ae22e5c9c2b8f2b2392f0951155e2b6c4bfe12b5b45dec471506baf9ad19fa14a05d39c
SSDEEP 48:TH85WuAriStwwuMN5meposSP/j8Vf8WKZxfJqWKHwhVWK56pPWKd:453AzwPrGFKnFKiUKcYKd
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_-journal

Path /data/user/0/com.dcloud.BDMHJBJXC/databases/bugly_db_-journal
Size 8KB
SHA256 e42f1a7ad9c65e9af7df00ba21376034852e99dbfb515b7359c15fccaf8730b4
MD5 e3fe4d2029b09cd7b27c841c254601aa
SHA1 730f53df5479de0c754e5dcce927b811a5436e3b
SHA512 6faa12255feb0ed950af11f85c9b1225106cc8890160e2c6e8137668c0c9778533697e9947c68e7b49a01aeb358feffa34ccef5712805706f3ec92238a031ca4
SSDEEP 48:7MlxfJqWKHwhVWK56pPWKJqX85WuAriStwwuMN5meposSV:7OFKiUKcYKJ953AzwV
MD5 SHA1 SHA512 SSDEEP

Submit Download

tbslog.txt (deleted)

Path /storage/emulated/0/Android/data/com.dcloud.BDMHJBJXC/files/tbslog/tbslog.txt (deleted)
Size 2KB
SHA256 df9a20ff6ccc09cbd6d5f7c0f76f3aafe7efc24c94cef9453e90a292bf1ab933
MD5 eea37e3a466aadd980927d896035b12a
SHA1 9a2391c508a2c8bedd187e86a29846bff7aff1d3
SHA512 afa151ba6f3591170997912abfd3ed10cb95782a8da8e7425bb0805d5cfbc1e43105d8e03c43ea4ac0ca64d17a7fb531dfeae55b8c57e765f6d80965f5d703da
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads