Overview

overview

8

Static

static

6

5834c60b5f...18.apk

android-9-x86

8

5834c60b5f...18.apk

android-10-x64

8

5834c60b5f...18.apk

android-11-x64

8

plugin-deploy.apk

android-9-x86

plugin-deploy.apk

android-10-x64

plugin-deploy.apk

android-11-x64

Analysis

  • max time kernel
    179s
  • max time network
    139s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240514-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
  • submitted
    19/05/2024, 02:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    5834c60b5f15cf27c423eb210a884d33_JaffaCakes118.apk
  • Size 3.1MB
  • Sample240519-ddmlkafa69
  • SHA256 e23229d237617432509880ba8233738da62a951b0e83311fd930c9e5ce240b73
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
bankerdiscoveryevasionimpact

Malware Config

Signatures

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Loads dropped Dex/Jar 1 TTPs 29 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Checks if the internet connection is available 1 TTPs 29 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 30 IoCs
    impact

Processes

  • com.falcon.weiba.pet
    1⤵
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4595
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4637
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4703
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4747
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4793
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4833
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4879
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5033
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5074
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5112
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5154
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5192
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5232
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5279
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5319
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5361
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5399
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5442
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5480
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5520
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5560
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5598
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5641
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5679
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5719
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5759
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5797
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5838
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Loads dropped Dex/Jar
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5878
  • com.falcon.weiba.pet:bdservice_v1
    1⤵
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5916

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        plugin-deploy.jar
        • Path /data/user/0/com.falcon.weiba.pet/app_push_lib/plugin-deploy.jar
        • Size 206KB
        • SHA256 98e9cbd6ab2be4896f8a835749a2fb5ad2903a819411ee0fe22e4414a096ce91
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        plugin-deploy.jar
        • Path /data/user/0/com.falcon.weiba.pet/app_push_lib/plugin-deploy.jar
        • Size 516KB
        • SHA256 de6be84627740fa2bcb1932a928a147270f525ba4e565ad7a8d49dac8100fe55
        • MD5 SHA1 SHA512 SSDEEP
        Download

        plugin-deploy.key
        • Path /data/user/0/com.falcon.weiba.pet/app_push_lib/plugin-deploy.key
        • Size 16KB
        • SHA256 8e2ff6e18fd6780ae8ab2dbed53f3e45d35f94396ad6c21591ae8c3090136963
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        journal.tmp
        • Path /data/user/0/com.falcon.weiba.pet/cache/uil-images/journal.tmp
        • Size 31B
        • SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
        • MD5 SHA1 SHA512
        Submit Download

        17bar.db3
        • Path /data/user/0/com.falcon.weiba.pet/databases/17bar.db3
        • Size 16KB
        • SHA256 b65f9ff66e7b1020d03340d50313829aedd403acd8821b53707a881b28efd99b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        17bar.db3-journal
        • Path /data/user/0/com.falcon.weiba.pet/databases/17bar.db3-journal
        • Size 512B
        • SHA256 eb3781704394da4908e0a89af0e662c058dd973350b5dab9596c1d7eb40820a6
        • MD5 SHA1 SHA512
        Submit Download

        17bar.db3-journal
        • Path /data/user/0/com.falcon.weiba.pet/databases/17bar.db3-journal
        • Size 8KB
        • SHA256 91aafe2f3a464133ee0d9139c5de83dc43610ec87e94bba6d2f8670beb6ba5ab
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        17bar.db3-journal
        • Path /data/user/0/com.falcon.weiba.pet/databases/17bar.db3-journal
        • Size 8KB
        • SHA256 3a4ffb6138cdb96aee586fc06640a9d0bb7ad62ddd26b11d7c03f8d518f41a0e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        TDtcagent.db
        • Path /data/user/0/com.falcon.weiba.pet/files/TDtcagent.db
        • Size 20KB
        • SHA256 afda99cac30a1252906f34bc4bc815b4db688b5aa0ddf82d25f658d625cd7a1a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        TDtcagent.db
        • Path /data/user/0/com.falcon.weiba.pet/files/TDtcagent.db
        • Size 24KB
        • SHA256 1153301c66b3c2956f33ac6cded090a367d9846af048d0674eefa047fff53c19
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        TDtcagent.db
        • Path /data/user/0/com.falcon.weiba.pet/files/TDtcagent.db
        • Size 32KB
        • SHA256 4e596e1c353c0a4168ec5a393fd881e3b539b33d584adac18146c331b92db9a9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        TDtcagent.db-journal
        • Path /data/user/0/com.falcon.weiba.pet/files/TDtcagent.db-journal
        • Size 512B
        • SHA256 3ddc1a5cb10eb8672ebf9ee805a2665a0cdc8db4f66d9999db55299b7e3fed67
        • MD5 SHA1 SHA512
        Submit Download

        TDtcagent.db-journal
        • Path /data/user/0/com.falcon.weiba.pet/files/TDtcagent.db-journal
        • Size 8KB
        • SHA256 edfebf7d02b6d7bb2d00eb269687daa054690495c20312af79c332644fe7cb40
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        TDtcagent.db-journal
        • Path /data/user/0/com.falcon.weiba.pet/files/TDtcagent.db-journal
        • Size 4KB
        • SHA256 754ef77b62d9aaf23050a4310c68cfde042052cae326e9603d73f934e8fa8dd8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        TDtcagent.db-journal
        • Path /data/user/0/com.falcon.weiba.pet/files/TDtcagent.db-journal
        • Size 8KB
        • SHA256 9e89aa97b74b59d60d87e793cae96b842c7b805d97cd380dd34d482bba1519e6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        TDtcagent.db-journal
        • Path /data/user/0/com.falcon.weiba.pet/files/TDtcagent.db-journal
        • Size 8KB
        • SHA256 419dd339a848ba92fd28472dacb6385ae3d2630ee2e3a64c412554ab212e180d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        TDtcagent.db-journal
        • Path /data/user/0/com.falcon.weiba.pet/files/TDtcagent.db-journal
        • Size 12KB
        • SHA256 2c72d09f54a4dd606f741e069e9bea8600e6badcc8bf487d7e72f61b7a66fc0d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        pushstat_4.3.db-journal
        • Path /storage/emulated/0/baidu/pushservice/database/storage/emulated/0/baidu/pushservice/database/pushstat_4.3.db-journal
        • Size 8KB
        • SHA256 10664ba381b0c10f8e24f45ee5eace724108c70cc9ba3b27c6aa36c072d5e63b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        pushstat_4.3.db-journal
        • Path /storage/emulated/0/baidu/pushservice/database/storage/emulated/0/baidu/pushservice/database/pushstat_4.3.db-journal
        • Size 8KB
        • SHA256 413fc0f00c3291de86b3bb1d811bb2c0fe2ecb6ea4131f9add62a1290f3c6feb
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download