49c9e78833191d6725de5ce2ddf6eeafa8080e570256a6744fd5b13c099f3024

Analysis

max time kernel
6s
max time network
132s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
18/05/2024, 06:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5354427412407aab4188f914292e2294_JaffaCakes118.apk
Size 10.8MB
Sample240518-g1mfvsfd49
SHA256 49c9e78833191d6725de5ce2ddf6eeafa8080e570256a6744fd5b13c099f3024
MD5 5354427412407aab4188f914292e2294
SHA1 6fe03b3a9765c14d1ec52f810535d40ea5b2dcc1
SHA512 6bb7d278400ff472738122196329bfff03c753cf419056cab6242e8062e643779a70bec44ca6b4423337aa6b8099e1d4ac8f8fd3f5ce1cead9c4ce6bc0dbdb5f
SSDEEP 196608:lLIMbCZFk6OcdB5H2GJgfGjqNHhEvhLeGZ9s35RrVMHIJMQTStUimDo8/6:VIiKk6PgGye+1aeGZu3TKHIJCtdGv6
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

evasion impact

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.rshui.babirun/app_payload_apk/classes.zip	4271	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.rshui.babirun/app_payload_apk/classes.zip --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.rshui.babirun/app_payload_apk/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.rshui.babirun/app_payload_apk/classes.zip	4241	com.rshui.babirun

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.rshui.babirun

com.rshui.babirun
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4241
- /system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.rshui.babirun/app_payload_apk/classes.zip --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.rshui.babirun/app_payload_apk/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4271

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

classes.zip

Path /data/data/com.rshui.babirun/app_payload_apk/classes.zip
Size 146KB
SHA256 1a78da1737bf2c3c2d485178e0fddc5d4db3846a6bf5178b4892f9a073764348
MD5 d7ecc8840b06a4be7dd2fe94609aa48a
SHA1 d776c9bb51b5ac64266700a470005cb77799e63f
SHA512 c69fb6d97bcfc5236167f3ecba2de06e2b816f4854afca914b41f67c3860a0804837eef5d0fc18b4edee74a1ba02d208f12b7fcee99edb861d6f58e3cd646590
SSDEEP 3072:aQq3xqKjVLz1YhgPTB7m3xgiNaEYQkyDyOZmjqUT6NygwP:aQoVVvGu1W6iHtYOkjfP
MD5 SHA1 SHA512 SSDEEP

Submit Download