Overview

overview

8

Static

static

6

5834c60b5f...18.apk

android-9-x86

8

5834c60b5f...18.apk

android-10-x64

8

5834c60b5f...18.apk

android-11-x64

8

plugin-deploy.apk

android-9-x86

plugin-deploy.apk

android-10-x64

plugin-deploy.apk

android-11-x64

Analysis

  • max time kernel
    177s
  • max time network
    151s
  • platform
    android_x64
  • resource
    android-x64-20240514-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
  • submitted
    19/05/2024, 02:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    5834c60b5f15cf27c423eb210a884d33_JaffaCakes118.apk
  • Size 3.1MB
  • Sample240519-ddmlkafa69
  • SHA256 e23229d237617432509880ba8233738da62a951b0e83311fd930c9e5ce240b73
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
bankerdiscoveryevasionimpactpersistence

Malware Config

Signatures

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Loads dropped Dex/Jar 1 TTPs 31 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 31 IoCs
    persistence
  • Checks if the internet connection is available 1 TTPs 31 IoCs
    discovery
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 31 IoCs
    impact

Processes

  • com.falcon.weiba.pet
    1⤵
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5116
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5174
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5315
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5407
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5453
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5492
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5533
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5570
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5671
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5750
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5789
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5828
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5865
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5905
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5943
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5982
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:6022
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:6061
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:6102
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:6139
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:6179
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:6216
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:6255
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:6295
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:6332
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:6374
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:6411
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:6450
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:6491
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:6528
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:6567

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        plugin-deploy.jar
        • Path /data/data/com.falcon.weiba.pet/app_push_lib/plugin-deploy.jar
        • Size 206KB
        • SHA256 6f3c12a4aa10b2dc3c13c75b0c75c8fdf91e75631e3f6ef4e8ab41ef7192448d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        plugin-deploy.key
        • Path /data/data/com.falcon.weiba.pet/app_push_lib/plugin-deploy.key
        • Size 16KB
        • SHA256 5517d449181b6b5522c9bf4cfc1a6985817f685eff6ba2ae9e234de30c7a8c87
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        17bar.db3
        • Path /data/data/com.falcon.weiba.pet/databases/17bar.db3
        • Size 16KB
        • SHA256 928af8e0212f839f34b5dd8a4a1fa188cbd69fcd08c0938bf1af17e7564a6327
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        17bar.db3-journal
        • Path /data/data/com.falcon.weiba.pet/databases/17bar.db3-journal
        • Size 512B
        • SHA256 dc929485062225018c21dd965460a88211d8c32fb32990f8cb05279ecbf5c088
        • MD5 SHA1 SHA512
        Submit Download

        17bar.db3-journal
        • Path /data/data/com.falcon.weiba.pet/databases/17bar.db3-journal
        • Size 8KB
        • SHA256 cc17bccc27a2c4106a8100dce82705b8c7bb9ed37a6c4efb3bb4ad1fffb4b557
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        17bar.db3-journal
        • Path /data/data/com.falcon.weiba.pet/databases/17bar.db3-journal
        • Size 8KB
        • SHA256 0091a08fe444adfc6116a7d56f36017d5a9f80ef4705f03d3edd9ed3a6a3cfba
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        TDtcagent.db
        • Path /data/data/com.falcon.weiba.pet/files/TDtcagent.db
        • Size 20KB
        • SHA256 8f323c599f68b529f9e0b5e811268d0a503376d558c7bb4cf942826dfb52c81f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        TDtcagent.db
        • Path /data/data/com.falcon.weiba.pet/files/TDtcagent.db
        • Size 24KB
        • SHA256 b39e0c0ddf0126e19d7a1d1a53e6d8d37c17e2f5c4dc310627f2f24bb446eef1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        TDtcagent.db
        • Path /data/data/com.falcon.weiba.pet/files/TDtcagent.db
        • Size 32KB
        • SHA256 65ca5a0cf65f0510e225ca2057765d724590c98759ccfb0991c22945eccdc626
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        TDtcagent.db-journal
        • Path /data/data/com.falcon.weiba.pet/files/TDtcagent.db-journal
        • Size 512B
        • SHA256 c1f8f43808c9e222a3882d4d789c54226db4939d6674ee6945eeaa760dabd765
        • MD5 SHA1 SHA512
        Submit Download

        TDtcagent.db-journal
        • Path /data/data/com.falcon.weiba.pet/files/TDtcagent.db-journal
        • Size 8KB
        • SHA256 91cb90ee0e45075b46240d3a2e4376305588b1d59343b1d7cf06b7162aee1a02
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        TDtcagent.db-journal
        • Path /data/data/com.falcon.weiba.pet/files/TDtcagent.db-journal
        • Size 4KB
        • SHA256 87ff0668b82143eaebfb6b0f2da486dfc539e900c7273ac770c52a15e7e745c1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        TDtcagent.db-journal
        • Path /data/data/com.falcon.weiba.pet/files/TDtcagent.db-journal
        • Size 8KB
        • SHA256 27a2a81faac9638fa3619c136396aa79b546bf0ef6da7b4d07fa5f36dd1bf993
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        TDtcagent.db-journal
        • Path /data/data/com.falcon.weiba.pet/files/TDtcagent.db-journal
        • Size 8KB
        • SHA256 c4a5609ce56c00f684e64cdb1e6a700297b4640ed58100ae5bca1303b2a2deb8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        TDtcagent.db-journal
        • Path /data/data/com.falcon.weiba.pet/files/TDtcagent.db-journal
        • Size 12KB
        • SHA256 6b36b0ec0ef63b8509f99058b6b2cadd942792bc680180f3ce85ace1f68f1993
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        plugin-deploy.jar
        • Path /data/user/0/com.falcon.weiba.pet/app_push_lib/plugin-deploy.jar
        • Size 516KB
        • SHA256 de6be84627740fa2bcb1932a928a147270f525ba4e565ad7a8d49dac8100fe55
        • MD5 SHA1 SHA512 SSDEEP
        Download

        journal.tmp
        • Path /storage/emulated/0/Android/data/com.falcon.weiba.pet/cache/uil-images/journal.tmp
        • Size 31B
        • SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
        • MD5 SHA1 SHA512
        Submit Download

        pushstat_4.3.db-journal
        • Path /storage/emulated/0/baidu/pushservice/database/storage/emulated/0/baidu/pushservice/database/pushstat_4.3.db-journal
        • Size 8KB
        • SHA256 66b99318e4db84d22b978fef2d44b1de08cd044253c88aa776641162f835e1c1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        pushstat_4.3.db-journal
        • Path /storage/emulated/0/baidu/pushservice/database/storage/emulated/0/baidu/pushservice/database/pushstat_4.3.db-journal
        • Size 8KB
        • SHA256 0ce6a0763eda079c4e26f3105da9c55a8af5542ef88c1b89af648603da35f69e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download