dfc4bc83db325da8c41a92e619e2f8a8c9466699bf161031e9bfbedb311e3896

Analysis

max time kernel
177s
max time network
183s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
21-05-2024 19:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

647694575eb420c799639f502eb2ac71_JaffaCakes118.apk
Size

10.2MB
MD5

647694575eb420c799639f502eb2ac71
SHA1

b15e793d63b99599b35a94f5a3a696387d47c0d9
SHA256

dfc4bc83db325da8c41a92e619e2f8a8c9466699bf161031e9bfbedb311e3896
SHA512

b5dbed4d373bcdd1007f603c5b505c027f177c4752eafc8c1a05ee1881ec5591c781065b1cef7d2c318cd07c03047c3c8efd310072b38816c4305bebea6ac94a
SSDEEP

196608:m1GKXyqYm8SXd2RRdDOE+g1no5j8EL71qfp1fh+pHLh:wXT/mRRUviaLL7gPfh+rh

Score

8^/10

banker discovery evasion persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs
evasion

System Information Discovery
T1426

Processes:

com.devexpert.weather

ioc process

/system/app/Superuser.apk com.devexpert.weather
/sbin/su com.devexpert.weather
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.devexpert.weather

description ioc process

File opened for read /proc/cpuinfo com.devexpert.weather
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.devexpert.weather

description ioc process

File opened for read /proc/meminfo com.devexpert.weather

ioc	process
/system/app/Superuser.apk	com.devexpert.weather
/sbin/su	com.devexpert.weather

description	ioc	process
File opened for read	/proc/cpuinfo	com.devexpert.weather

description	ioc	process
File opened for read	/proc/meminfo	com.devexpert.weather

Loads dropped Dex/Jar 1 TTPs 10 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

Processes:

com.devexpert.weather/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.devexpert.weather/app_working/startapp.dex --output-vdex-fd=85 --oat-fd=86 --oat-location=/data/user/0/com.devexpert.weather/app_working/oat/x86/startapp.odex --compiler-filter=quicken --class-loader-context=&/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.devexpert.weather/app_working/yandex.dex --output-vdex-fd=85 --oat-fd=86 --oat-location=/data/user/0/com.devexpert.weather/app_working/oat/x86/yandex.odex --compiler-filter=quicken --class-loader-context=&/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.devexpert.weather/app_working/flurry.dex --output-vdex-fd=85 --oat-fd=86 --oat-location=/data/user/0/com.devexpert.weather/app_working/oat/x86/flurry.odex --compiler-filter=quicken --class-loader-context=&

ioc	pid	process
/data/user/0/com.devexpert.weather/app_working/startapp.dex	4325	com.devexpert.weather
/data/user/0/com.devexpert.weather/app_working/startapp.dex	4469	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.devexpert.weather/app_working/startapp.dex --output-vdex-fd=85 --oat-fd=86 --oat-location=/data/user/0/com.devexpert.weather/app_working/oat/x86/startapp.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.devexpert.weather/app_working/startapp.dex	4325	com.devexpert.weather
/data/user/0/com.devexpert.weather/app_working/yandex.dex	4325	com.devexpert.weather
/data/user/0/com.devexpert.weather/app_working/yandex.dex	4495	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.devexpert.weather/app_working/yandex.dex --output-vdex-fd=85 --oat-fd=86 --oat-location=/data/user/0/com.devexpert.weather/app_working/oat/x86/yandex.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.devexpert.weather/app_working/yandex.dex	4325	com.devexpert.weather
/data/user/0/com.devexpert.weather/app_working/flurry.dex	4325	com.devexpert.weather
/data/user/0/com.devexpert.weather/app_working/flurry.dex	4521	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.devexpert.weather/app_working/flurry.dex --output-vdex-fd=85 --oat-fd=86 --oat-location=/data/user/0/com.devexpert.weather/app_working/oat/x86/flurry.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.devexpert.weather/app_working/flurry.dex	4325	com.devexpert.weather
/data/user/0/com.devexpert.weather/cache/1582435991586.jar	4325	com.devexpert.weather

Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

Process Discovery
T1424

Processes:

com.devexpert.weather

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.devexpert.weather
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

System Network Configuration Discovery
T1422

Processes:

com.devexpert.weather

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.devexpert.weather
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

com.devexpert.weather

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.devexpert.weather
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

com.devexpert.weather

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.devexpert.weather
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Checks the presence of a debugger
evasion

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.devexpert.weather

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.devexpert.weather

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.devexpert.weather

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.devexpert.weather

com.devexpert.weather
1⤵
- Checks if the Android device is rooted.
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:4325

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.devexpert.weather/app_working/startapp.dex --output-vdex-fd=85 --oat-fd=86 --oat-location=/data/user/0/com.devexpert.weather/app_working/oat/x86/startapp.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:4469

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.devexpert.weather/app_working/yandex.dex --output-vdex-fd=85 --oat-fd=86 --oat-location=/data/user/0/com.devexpert.weather/app_working/oat/x86/yandex.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:4495

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.devexpert.weather/app_working/flurry.dex --output-vdex-fd=85 --oat-fd=86 --oat-location=/data/user/0/com.devexpert.weather/app_working/oat/x86/flurry.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:4521

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.devexpert.weather/app_working/flurry.dex

Filesize
641KB

MD5
323bc8808355cb3f103ddd69bdc68827

SHA1
a1562b4b5a3d93315a56506c5b82448c9c711220

SHA256
063d9bb14b2f8c90d9b876e6756e10d1bde67bff000224ddcc076f20555db1dd

SHA512
452c4b8db3cddb33d56dee3460969addced4382ace85275b414f2276a7f04e05ac82e61548d6a3075c1b7e731f9114a2e95f053e6ef0d4fcac3705df83cb300d

Download Submit
/data/data/com.devexpert.weather/app_working/startapp.dex

Filesize
546KB

MD5
b480a2d0f7235c543c43efc4db907fce

SHA1
e682ebf3bfe45c42c2cc310c387cfd2029766a3b

SHA256
c26ef4654f3070214c989e1f3a31a077f74275743ab38683bd45b165081ba677

SHA512
243500a7893ee22f496183fe025a9ba3994243da8fca6b7ece82a97a1867f73968a9302b0b559a01297303e5d083f0bc314111ae6f803a5fcb505c5fb3a059a7

Download Submit
/data/data/com.devexpert.weather/app_working/yandex.dex

Filesize
262KB

MD5
669ebf34f47502b7dd1eb5c23db81914

SHA1
cafc653f3a0f1d8b11717dd7eee9fb1ace2470ac

SHA256
31047d678521bb70c00a93ee55a721e283a5d8e8f9cde7e5ff29e389f21f3945

SHA512
60df31d84bbdd8138767e423c16ab46ea354c0161fbfe6648bffca99c450026991354dd45d0e36cad46447921583b5413a9f97145904781db50d84d6c84e1425

Download Submit
/data/data/com.devexpert.weather/cache/1582435991586.jar

Filesize
9KB

MD5
e8e0527a01aefdb89afd2c508f131da1

SHA1
f1103e6b260c657ceb3d95f1b023af3fda8b133a

SHA256
f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce

SHA512
fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34

Download Submit
/data/data/com.devexpert.weather/databases/http_auth.db

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.devexpert.weather/databases/http_auth.db-journal

Filesize
512B

MD5
8584a70f5a23096cf4bff3ffdf6984b9

SHA1
7d6034c5f3b738e29437cc70e00155f64025a9ce

SHA256
c73c2d20c06ffeddacb5fd4a0dbf9ec18526ed7beb8d9b1d8947140254929a00

SHA512
7f851b591132964b769d890d5048e1ad3e1083dc3350248935736a818f2a277e340b093e94e4eb989a2442901d3a971db4bd537d2b4a260f98356968585832b7

Download Submit
/data/data/com.devexpert.weather/databases/http_auth.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.devexpert.weather/databases/http_auth.db-wal

Filesize
32KB

MD5
184819e05fdf2d0e0500e5a831e5d532

SHA1
ef709e92e7731e71813fc891f7becf9c094c9a17

SHA256
17b74a97e43d48198ccd9d51ecf772144bcc9f9a4bf2fe7248e7a6a40f3d7703

SHA512
e587b2ea3904a114aea0b5242eec6246bf69bf6f26beb7cfa6e82738ae8fc9af2212d3d4b7e8457f54b239ab136254f3785edae571c858a5dd8590b8ca8a9c58

Download Submit
/data/data/com.devexpert.weather/databases/weather_info_v2.db-journal

Filesize
512B

MD5
6d8711645be86428a860f16f55cffe86

SHA1
6f42dcce455e3896ba859e7608940d9c74d87d08

SHA256
56c7a7187a77d82f349d1524f133ca37ae6e9d7729744892fcf6a47bdf37c1fb

SHA512
8ebb8ee8094a7b23ca3ba2af9c7f7a1faab6a6e87f38bcb675163c615e88b15f19cb4e9bc718ddd7a9af1f0cc453372323185d92d09a1ae29f81d57a3e0d090b

Download Submit
/data/data/com.devexpert.weather/databases/weather_info_v2.db-wal

Filesize
44KB

MD5
24b8445ec386451ccb31f3b8f6ae1aa8

SHA1
9d583872cdd498336d720415f0b71af7c2518d65

SHA256
67af09108c3c26949891dd8860834a6dd3f3537fbcfbfac60c82bac759267085

SHA512
79453cd54de17c73b9471f8fd0a0d12df8ba5f4d434fac08d3a3c815339bea4545c296501a970b3da2c51dfbe459d1a30f4a61caf6a613c44dd2a6dc25a15048

Download Submit
/data/data/com.devexpert.weather/files/com.appbrain.ping

Filesize
2B

MD5
df4b078e642930c40eedf0c1d2a43fa1

SHA1
673518886991ef47df823826adf94c97576121bc

SHA256
e9619023f7ad0507ccc2f44d1ff58550018171c87f6d6f95c393cb2ca9eab3ba

SHA512
fe8f57f35ded27242a0464a6bc8ca97e7ef476c1be13c118d872a35ad1861727a6e0008f951389834d6a8e989bb1397cfa688b2386d55af5825592d653ba6844

Download Submit
/data/user/0/com.devexpert.weather/app_working/flurry.dex

Filesize
641KB

MD5
06875f55981c880daa41951976beb927

SHA1
2bd66ce9518592375c4ac78ea8860e453173d6f6

SHA256
38fd30b6fcaa55231d711b69964cd1873e35d2e8ca587fcfdfddcd837eff33dc

SHA512
9ba87efbf28a96cf86fb76ab7a7428da26cff650ea46dba21f0d0bbe1f2d5bf3977fb7007c41edd503158a86c53ed5a4ebece10a34a98c5fa9d2f4bd90c68188

Download Submit
/data/user/0/com.devexpert.weather/app_working/startapp.dex

Filesize
546KB

MD5
bd7f8e24a17133555981d48644a10877

SHA1
1505395b66fccf934df6dcb07eda77b9b3685b0f

SHA256
593d0398ef2a8c2a69ac8a0daf2dcf8a77bcf130c20e811abec78c8554584852

SHA512
1ee2cac48d4a6f8847aa9ac453ed221b6da22bfc52151539689a1776be5e12fee7f3ebe1fc7adcc51dafb8daf75be35f40e8d5e3d350c25e23100591a24385fe

Download Submit
/data/user/0/com.devexpert.weather/app_working/yandex.dex

Filesize
262KB

MD5
94e7a7cec4a945e1383f8c7fe54d0d67

SHA1
47b6a2abb1b82f50d3c86a6b56e80448363e9fd9

SHA256
b576125fd8553d6de1581ae73e2e7faf334d4a67802adaf53d833a7b0f18857f

SHA512
203c2ecb23fdff8e89072fcd3ec1d7fbd73a46e06a46f2fb6a314dc918b92783fad4af8d9d42f1936fcdd2dade651ec523d0c6fcc91e452085b56850ce0db141

Download Submit
/data/user/0/com.devexpert.weather/cache/1582435991586.jar

Filesize
20KB

MD5
fde2ee00cbd121cfab5290b078aa3ceb

SHA1
e2b77d5320e155e413d040a8c20020962065b2f8

SHA256
2897b0812077c654a9b3fbb0b6303d5cde681eeba7ad9981de65716c7810d685

SHA512
a9326aff8e454a2b4ac09984ef2a65fddd4dc146b4c44d839035549bff8c9fdaae490326d0b018f76c1ca2e4fb25426d74f550ca0950982fba632a023af99a56

Download Submit