dfc4bc83db325da8c41a92e619e2f8a8c9466699bf161031e9bfbedb311e3896

Analysis

max time kernel
179s
max time network
189s
platform
android_x64
resource
android-x64-arm64-20240514-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
submitted
21-05-2024 19:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

647694575eb420c799639f502eb2ac71_JaffaCakes118.apk
Size

10.2MB
MD5

647694575eb420c799639f502eb2ac71
SHA1

b15e793d63b99599b35a94f5a3a696387d47c0d9
SHA256

dfc4bc83db325da8c41a92e619e2f8a8c9466699bf161031e9bfbedb311e3896
SHA512

b5dbed4d373bcdd1007f603c5b505c027f177c4752eafc8c1a05ee1881ec5591c781065b1cef7d2c318cd07c03047c3c8efd310072b38816c4305bebea6ac94a
SSDEEP

196608:m1GKXyqYm8SXd2RRdDOE+g1no5j8EL71qfp1fh+pHLh:wXT/mRRUviaLL7gPfh+rh

Score

8^/10

banker collection credential_access discovery evasion impact

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 3 IoCs
evasion

System Information Discovery
T1426

Processes:

com.devexpert.weather

ioc process

/system/bin/su com.devexpert.weather
/system/app/Superuser.apk com.devexpert.weather
/sbin/su com.devexpert.weather
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.devexpert.weather

description ioc process

File opened for read /proc/cpuinfo com.devexpert.weather
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.devexpert.weather

description ioc process

File opened for read /proc/meminfo com.devexpert.weather

ioc	process
/system/bin/su	com.devexpert.weather
/system/app/Superuser.apk	com.devexpert.weather
/sbin/su	com.devexpert.weather

description	ioc	process
File opened for read	/proc/cpuinfo	com.devexpert.weather

description	ioc	process
File opened for read	/proc/meminfo	com.devexpert.weather

Loads dropped Dex/Jar 1 TTPs 7 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

Processes:

com.devexpert.weather

ioc	pid	process
/data/user/0/com.devexpert.weather/app_working/startapp.dex	4622	com.devexpert.weather
/data/user/0/com.devexpert.weather/app_working/startapp.dex	4622	com.devexpert.weather
/data/user/0/com.devexpert.weather/app_working/yandex.dex	4622	com.devexpert.weather
/data/user/0/com.devexpert.weather/app_working/yandex.dex	4622	com.devexpert.weather
/data/user/0/com.devexpert.weather/app_working/flurry.dex	4622	com.devexpert.weather
/data/user/0/com.devexpert.weather/app_working/flurry.dex	4622	com.devexpert.weather
/data/user/0/com.devexpert.weather/cache/1582435991586.jar	4622	com.devexpert.weather

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
collection credential_access impact

Clipboard Data
T1414

Transmitted Data Manipulation
T1641.001

Processes:

com.devexpert.weather

description ioc process

Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.devexpert.weather
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

Process Discovery
T1424

Processes:

com.devexpert.weather

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.devexpert.weather
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

System Network Configuration Discovery
T1422

Processes:

com.devexpert.weather

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.devexpert.weather
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

com.devexpert.weather

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.devexpert.weather
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Checks the presence of a debugger
evasion

description	ioc	process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.devexpert.weather

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.devexpert.weather

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.devexpert.weather

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.devexpert.weather

com.devexpert.weather
1⤵
- Checks if the Android device is rooted.
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries the mobile country code (MCC)
- Checks if the internet connection is available
PID:4622

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.devexpert.weather/app_working/flurry.dex

Filesize
641KB

MD5
323bc8808355cb3f103ddd69bdc68827

SHA1
a1562b4b5a3d93315a56506c5b82448c9c711220

SHA256
063d9bb14b2f8c90d9b876e6756e10d1bde67bff000224ddcc076f20555db1dd

SHA512
452c4b8db3cddb33d56dee3460969addced4382ace85275b414f2276a7f04e05ac82e61548d6a3075c1b7e731f9114a2e95f053e6ef0d4fcac3705df83cb300d

Download Submit
/data/user/0/com.devexpert.weather/app_working/startapp.dex

Filesize
546KB

MD5
b480a2d0f7235c543c43efc4db907fce

SHA1
e682ebf3bfe45c42c2cc310c387cfd2029766a3b

SHA256
c26ef4654f3070214c989e1f3a31a077f74275743ab38683bd45b165081ba677

SHA512
243500a7893ee22f496183fe025a9ba3994243da8fca6b7ece82a97a1867f73968a9302b0b559a01297303e5d083f0bc314111ae6f803a5fcb505c5fb3a059a7

Download Submit
/data/user/0/com.devexpert.weather/app_working/yandex.dex

Filesize
262KB

MD5
669ebf34f47502b7dd1eb5c23db81914

SHA1
cafc653f3a0f1d8b11717dd7eee9fb1ace2470ac

SHA256
31047d678521bb70c00a93ee55a721e283a5d8e8f9cde7e5ff29e389f21f3945

SHA512
60df31d84bbdd8138767e423c16ab46ea354c0161fbfe6648bffca99c450026991354dd45d0e36cad46447921583b5413a9f97145904781db50d84d6c84e1425

Download Submit
/data/user/0/com.devexpert.weather/cache/1582435991586.jar

Filesize
9KB

MD5
e8e0527a01aefdb89afd2c508f131da1

SHA1
f1103e6b260c657ceb3d95f1b023af3fda8b133a

SHA256
f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce

SHA512
fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34

Download Submit
/data/user/0/com.devexpert.weather/cache/1582435991586.jar

Filesize
20KB

MD5
fde2ee00cbd121cfab5290b078aa3ceb

SHA1
e2b77d5320e155e413d040a8c20020962065b2f8

SHA256
2897b0812077c654a9b3fbb0b6303d5cde681eeba7ad9981de65716c7810d685

SHA512
a9326aff8e454a2b4ac09984ef2a65fddd4dc146b4c44d839035549bff8c9fdaae490326d0b018f76c1ca2e4fb25426d74f550ca0950982fba632a023af99a56

Download Submit
/data/user/0/com.devexpert.weather/databases/http_auth.db

Filesize
20KB

MD5
ed710a8968441282a5939621c2771927

SHA1
b6ac28b3e32ea66790c52d6934608b5e71f3d5b8

SHA256
6e7b95a553c2528d6c564296a9e481a6d913074c35011a19f2da8e4807c53bb2

SHA512
547d7c530ad345edf6b880b7685d2ddf3770e595fe3a40041677cb0c296b15ec6d9e8ebf3f2db51624be41766a0af6764512f1c352d5fde22bdea81d7c08e364

Download Submit
/data/user/0/com.devexpert.weather/databases/http_auth.db-journal

Filesize
512B

MD5
1f4fd3b24724f969e55681e38b60f4d4

SHA1
24bf82397f865560c5d14ff00e85bf3bbed8c6b9

SHA256
36d398976d9ca8610f9fe425e29ebdc00a28910dc7e98b86055e80af788ff947

SHA512
1ca866c7b6017499469fdb3d176131f390b4d78d435b301fb57a1cde02795050201621ea4d07c7b4e744a2614074ebf07d3ed3ff6160b03550e5f64c003345b4

Download Submit
/data/user/0/com.devexpert.weather/databases/http_auth.db-journal

Filesize
8KB

MD5
a780943b6bfe97fff0a064713fe6b814

SHA1
ddbd9beaf9a0e5f5fcc966b7a25821dab4c9cdaa

SHA256
3338bbae7540b2d7360c2988be8bd7c68ce61f1e3effebacba6590c748c3b8f3

SHA512
ea59f4352baf7ca25fcd53e8c51c0e6bf1eb3b171f00df29bb78ebabd6118824feba0570f0826226c2c0dae5960cdd6b0afb111292f2b35efefa56963a2b96ff

Download Submit
/data/user/0/com.devexpert.weather/databases/http_auth.db-journal

Filesize
8KB

MD5
d889035162554d63f99add5412382fa2

SHA1
20e061e2a59f193b8b2d6049bd4dd5bee212d43d

SHA256
9cf25cc2e35a6f337871d1c5be1ec23a919b2979ad22d78772ccaa7bce0482c4

SHA512
0e0fc41fa7c1474ec79a6cf75585ce1823756b560ab15e1daefbbbe4deb5a8a2621d2e347dd1bacb4c31559bae92bdb7519e92b5a57217f68ea06714cf4fd840

Download Submit
/data/user/0/com.devexpert.weather/databases/weather_info_v2.db

Filesize
32KB

MD5
06bb211f300b0845fa9cc1defdf54daf

SHA1
f42fdc96e810e159a82edc887f544b5764a886a4

SHA256
5efe84b0725524854cf67e9cfe1c2cf5b2b292b9a036f4dde1e2d9d933d14808

SHA512
46d584d895d0a5abed4d5feddc36e753b69bf1fb023a90ab92938f580c72503b395aacffc7d67b47b5d4ae117c09ef090fdd18dcba15f8d5f32c814dd5a92ff2

Download Submit
/data/user/0/com.devexpert.weather/databases/weather_info_v2.db-journal

Filesize
512B

MD5
7080c07134952f566f08aa34212e5585

SHA1
7e9c99761e32155c08a678220ed3c6401e0ac9d8

SHA256
1b9871258fcddec0ad10161b462c81ab8f19e3112a03233e0bce0b682be145cb

SHA512
2633a13c2f99d9c1a56f1bc5af805079ed7524c39b6de7d696218be077f26539cda2893c4837b26088386312c24f71beaa6f08855afba91e5a484df5b536e59b

Download Submit
/data/user/0/com.devexpert.weather/databases/weather_info_v2.db-journal

Filesize
8KB

MD5
86f9e137f790c0fd09b10050456e1015

SHA1
5408bf5d17215612e89889665bb3b01f174afe8d

SHA256
96557a8ed07e78a2a0739e4271fc9130cd8b2dc703ee33c950058bf2c775df5d

SHA512
de60df08dc8b0fc005f50d557ef474e0b3b71a6a4bc362f94b82ebff10d0c7e960b726c902d61687ad6fe2a2e282e0e20294f65133d697e4a9297bc137b28c90

Download Submit
/data/user/0/com.devexpert.weather/databases/weather_info_v2.db-journal

Filesize
8KB

MD5
622d5bebe68a1a2f108581b68628be1b

SHA1
1729c810acc8e8895a78eeefb7caaf1bd992d187

SHA256
1fac0745673bb1f5e16642d16d1522c6a84c5a39eb9a3dcc09a309e339fbd74c

SHA512
a423fbbc90ae3b68df522f5e3c8ca2031e2007488edfa66e8f2bb6c69365b1af2557d2f3de69acbba90dc069835cff446bb98ecf3cbb76b1fada667b90c9824f

Download Submit
/data/user/0/com.devexpert.weather/files/com.appbrain.ping

Filesize
2B

MD5
df4b078e642930c40eedf0c1d2a43fa1

SHA1
673518886991ef47df823826adf94c97576121bc

SHA256
e9619023f7ad0507ccc2f44d1ff58550018171c87f6d6f95c393cb2ca9eab3ba

SHA512
fe8f57f35ded27242a0464a6bc8ca97e7ef476c1be13c118d872a35ad1861727a6e0008f951389834d6a8e989bb1397cfa688b2386d55af5825592d653ba6844

Download Submit