dfc4bc83db325da8c41a92e619e2f8a8c9466699bf161031e9bfbedb311e3896

Analysis

max time kernel
179s
max time network
191s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
21-05-2024 19:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

647694575eb420c799639f502eb2ac71_JaffaCakes118.apk
Size

10.2MB
MD5

647694575eb420c799639f502eb2ac71
SHA1

b15e793d63b99599b35a94f5a3a696387d47c0d9
SHA256

dfc4bc83db325da8c41a92e619e2f8a8c9466699bf161031e9bfbedb311e3896
SHA512

b5dbed4d373bcdd1007f603c5b505c027f177c4752eafc8c1a05ee1881ec5591c781065b1cef7d2c318cd07c03047c3c8efd310072b38816c4305bebea6ac94a
SSDEEP

196608:m1GKXyqYm8SXd2RRdDOE+g1no5j8EL71qfp1fh+pHLh:wXT/mRRUviaLL7gPfh+rh

Score

8^/10

banker collection credential_access discovery evasion impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs
evasion

System Information Discovery
T1426

Processes:

com.devexpert.weather

ioc process

/sbin/su com.devexpert.weather
/system/app/Superuser.apk com.devexpert.weather
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.devexpert.weather

description ioc process

File opened for read /proc/cpuinfo com.devexpert.weather
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.devexpert.weather

description ioc process

File opened for read /proc/meminfo com.devexpert.weather

ioc	process
/sbin/su	com.devexpert.weather
/system/app/Superuser.apk	com.devexpert.weather

description	ioc	process
File opened for read	/proc/cpuinfo	com.devexpert.weather

description	ioc	process
File opened for read	/proc/meminfo	com.devexpert.weather

Loads dropped Dex/Jar 1 TTPs 7 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

Processes:

com.devexpert.weather

ioc	pid	process
/data/user/0/com.devexpert.weather/app_working/startapp.dex	5146	com.devexpert.weather
/data/user/0/com.devexpert.weather/app_working/startapp.dex	5146	com.devexpert.weather
/data/user/0/com.devexpert.weather/app_working/yandex.dex	5146	com.devexpert.weather
/data/user/0/com.devexpert.weather/app_working/yandex.dex	5146	com.devexpert.weather
/data/user/0/com.devexpert.weather/app_working/flurry.dex	5146	com.devexpert.weather
/data/user/0/com.devexpert.weather/app_working/flurry.dex	5146	com.devexpert.weather
/data/user/0/com.devexpert.weather/cache/1582435991586.jar	5146	com.devexpert.weather

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
collection credential_access impact

Clipboard Data
T1414

Transmitted Data Manipulation
T1641.001

Processes:

com.devexpert.weather

description ioc process

Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.devexpert.weather
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

Process Discovery
T1424

Processes:

com.devexpert.weather

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.devexpert.weather
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

System Network Configuration Discovery
T1422

Processes:

com.devexpert.weather

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.devexpert.weather
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

com.devexpert.weather

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.devexpert.weather
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

com.devexpert.weather

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.devexpert.weather
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Checks the presence of a debugger
evasion

description	ioc	process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.devexpert.weather

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.devexpert.weather

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.devexpert.weather

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.devexpert.weather

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.devexpert.weather

com.devexpert.weather
1⤵
- Checks if the Android device is rooted.
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:5146

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.devexpert.weather/app_working/flurry.dex

Filesize
641KB

MD5
323bc8808355cb3f103ddd69bdc68827

SHA1
a1562b4b5a3d93315a56506c5b82448c9c711220

SHA256
063d9bb14b2f8c90d9b876e6756e10d1bde67bff000224ddcc076f20555db1dd

SHA512
452c4b8db3cddb33d56dee3460969addced4382ace85275b414f2276a7f04e05ac82e61548d6a3075c1b7e731f9114a2e95f053e6ef0d4fcac3705df83cb300d

Download Submit
/data/data/com.devexpert.weather/app_working/startapp.dex

Filesize
546KB

MD5
b480a2d0f7235c543c43efc4db907fce

SHA1
e682ebf3bfe45c42c2cc310c387cfd2029766a3b

SHA256
c26ef4654f3070214c989e1f3a31a077f74275743ab38683bd45b165081ba677

SHA512
243500a7893ee22f496183fe025a9ba3994243da8fca6b7ece82a97a1867f73968a9302b0b559a01297303e5d083f0bc314111ae6f803a5fcb505c5fb3a059a7

Download Submit
/data/data/com.devexpert.weather/app_working/yandex.dex

Filesize
262KB

MD5
669ebf34f47502b7dd1eb5c23db81914

SHA1
cafc653f3a0f1d8b11717dd7eee9fb1ace2470ac

SHA256
31047d678521bb70c00a93ee55a721e283a5d8e8f9cde7e5ff29e389f21f3945

SHA512
60df31d84bbdd8138767e423c16ab46ea354c0161fbfe6648bffca99c450026991354dd45d0e36cad46447921583b5413a9f97145904781db50d84d6c84e1425

Download Submit
/data/data/com.devexpert.weather/cache/1582435991586.jar

Filesize
9KB

MD5
e8e0527a01aefdb89afd2c508f131da1

SHA1
f1103e6b260c657ceb3d95f1b023af3fda8b133a

SHA256
f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce

SHA512
fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34

Download Submit
/data/data/com.devexpert.weather/databases/http_auth.db

Filesize
20KB

MD5
62a3561989ede658cd16cc1f14199c1d

SHA1
6320791cdfd16b26450bf711bd6776d80a396912

SHA256
9ae0206411304ee027e0cfe3b4e6732ced5b423f99c33340dafb68d2b5b215f6

SHA512
c4ef43e702e053ee39153149d1fb11311c57c6ad5393ea905df942df8bcd3625e2224563eb4c35bfc45e140aa09135c5123f48d220fe622d9dcf2a4cdaf5dfe4

Download Submit
/data/data/com.devexpert.weather/databases/http_auth.db-journal

Filesize
512B

MD5
e7847d2e54fe34bca31e2ec476889f15

SHA1
2931f7aaad840c8e34bb5643d603bc129379aef8

SHA256
1e497774c730f1795169fa94422cac9a63830f7047bad317c9cee88835b6a04f

SHA512
3c68baa96f0067dd4ded5220a0ae9a38e5c5faba4e2360607566066e149a10ec6ca3dc3102239331051a69aa010fa972fa6f6048d1e4e42fc8c396bcb907e2c7

Download Submit
/data/data/com.devexpert.weather/databases/http_auth.db-journal

Filesize
8KB

MD5
21abec5ccfa2b4f860896807867830ba

SHA1
a77b878797cf8c2521d18d3a5e3cbc5a57920224

SHA256
0101e3e6e28922b640ce950a5b24eb9c24b2029bcd97394a3bc62945efb71c8d

SHA512
48fa9146be4e2da4e3dec0fd13ce9f89f5f43ed4eef2fc8c65e30dd125d51f0ed78e62bc4ec2d60bbc40fda4ac7d88c4a96fd982ee4ba72f8f3530ab04f4ef2e

Download Submit
/data/data/com.devexpert.weather/databases/http_auth.db-journal

Filesize
8KB

MD5
b6d57e8123f7a81fd8fb603abc64663d

SHA1
22a5a77bb14081612df29a07b2b1ae780d849d79

SHA256
737355d92ffc99b73ff818ba34c14c97c2923db1364e382d21632f354819147a

SHA512
3b7ba9ce774cde99cc40d3d9f3d356c29aa315891255e994cad4e0dfb6e3183ee5d2af290688abcb1049ea2d600d0b49344479835df3d750b7d63bd73b379de9

Download Submit
/data/data/com.devexpert.weather/databases/weather_info_v2.db

Filesize
32KB

MD5
5cf8b847961b8bf82fc0dae5ff2e70ed

SHA1
7daca6d16d2b3e1c2a3abc98209d349a8c88a23f

SHA256
ffe2b1f19e5acdb1dd357164b2c9eabc990c3c119919dc9f5e077aba01ee1e23

SHA512
ebfef0f2bb76e65d4c4cf52d9f16ea70ca45ca0ab86d68e3fa79fb874d37535d48fcd287c81550eb66d5d769c80fa79b2e451ee7c6b04076c9b848084c03625e

Download Submit
/data/data/com.devexpert.weather/databases/weather_info_v2.db-journal

Filesize
512B

MD5
e3123123ad45cd27827d2c679f74640e

SHA1
0d4cc0de369c6590635ecc5def679eb0ab25ba63

SHA256
7da42fb37d1848c56a12a86f770446f227a27dd7f493a89be02785dbd9064939

SHA512
4248a179e1a674a2c82c2e966b3206b3d16147ff3c0fb659f35bdbb61db13c8a7a9c57d49cd786a4703cba9736ebe6abbfdb88e2ab2409918bc773d7d4efe7dc

Download Submit
/data/data/com.devexpert.weather/databases/weather_info_v2.db-journal

Filesize
8KB

MD5
3545dff1a6afc97fff42d729a4a32706

SHA1
d2035994e64ff15aadc3287c35344213e3003039

SHA256
760c0d016136b995008d8d6c33d0afb5b41adca745245c600b58ba3ed1d2a2f6

SHA512
2d72d2f55cd6c878bc2670275ccbb194ca737707f98053e67155bdd0ed10b25f57f29789600175ea18011caa43e2c4ecf188a80f4cd7bd0d97ed47e2557dd55c

Download Submit
/data/data/com.devexpert.weather/databases/weather_info_v2.db-journal

Filesize
8KB

MD5
447fc4741c3b295a961bf4dbf656d623

SHA1
1e1189bb9075fd6bdca6f3d53e696a80acbf017e

SHA256
1d0e31852358c5e40ab28739d42a8de394cad32a1ff96e06c294007d21612269

SHA512
cb3e1f523a254b885b2e3f3def68072126adbfeec5905629b0b0dbdd5387667bdb83320ac1042e3be00e6e49164db765c7eecd1fb03e7430d51e1b4c5797a75c

Download Submit
/data/data/com.devexpert.weather/files/com.appbrain.ping

Filesize
2B

MD5
df4b078e642930c40eedf0c1d2a43fa1

SHA1
673518886991ef47df823826adf94c97576121bc

SHA256
e9619023f7ad0507ccc2f44d1ff58550018171c87f6d6f95c393cb2ca9eab3ba

SHA512
fe8f57f35ded27242a0464a6bc8ca97e7ef476c1be13c118d872a35ad1861727a6e0008f951389834d6a8e989bb1397cfa688b2386d55af5825592d653ba6844

Download Submit
/data/user/0/com.devexpert.weather/cache/1582435991586.jar

Filesize
20KB

MD5
fde2ee00cbd121cfab5290b078aa3ceb

SHA1
e2b77d5320e155e413d040a8c20020962065b2f8

SHA256
2897b0812077c654a9b3fbb0b6303d5cde681eeba7ad9981de65716c7810d685

SHA512
a9326aff8e454a2b4ac09984ef2a65fddd4dc146b4c44d839035549bff8c9fdaae490326d0b018f76c1ca2e4fb25426d74f550ca0950982fba632a023af99a56

Download Submit