98c57bb1cd6ef93ee8742a8de9e49bf60a0a7fdc8efbadd5b719e0929a635953

Analysis

max time kernel
166s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
21/05/2024, 18:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

644cc7902d55c825bea755edc53e4da0_JaffaCakes118.apk
Size

18.2MB
MD5

644cc7902d55c825bea755edc53e4da0
SHA1

135ad43f5f32a8e81da19ddd5093896c21f2fbab
SHA256

98c57bb1cd6ef93ee8742a8de9e49bf60a0a7fdc8efbadd5b719e0929a635953
SHA512

1d96a143a9e47d77cce0db2d039e56207bceaa43d838bfb4bcc1796df27b9b120a470c0358a187af66e76f2801993f29466ee493b3bb67c7431c40d95020c5ab
SSDEEP

196608:1rSQ/54R8hNGUY/xuBJ2cRdU+ZrvOu/oYPJ5xE0egfHDyXqQ0QeLoseund07rZTs:xSPR8V7RjJw+fUfe0JTGK7sc3xbmqqTT

Score

7^/10

discovery evasion impact

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/cn.pingames.beymacmod/files/egame_temp.jar	4354	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/cn.pingames.beymacmod/files/egame_temp.jar --output-vdex-fd=114 --oat-fd=115 --oat-location=/data/user/0/cn.pingames.beymacmod/files/oat/x86/egame_temp.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/cn.pingames.beymacmod/files/egame_temp.jar	4295	cn.pingames.beymacmod

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	cn.pingames.beymacmod

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	cn.pingames.beymacmod

cn.pingames.beymacmod
1⤵
- Loads dropped Dex/Jar
- Queries information about the current Wi-Fi connection
- Uses Crypto APIs (Might try to encrypt user data)
PID:4295
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/cn.pingames.beymacmod/files/egame_temp.jar --output-vdex-fd=114 --oat-fd=115 --oat-location=/data/user/0/cn.pingames.beymacmod/files/oat/x86/egame_temp.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4354

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact