90f41db41514010dfeacabec6b629fa44dcc562f50d0517df2fc49d877ac5a66

Analysis

max time kernel
11s
max time network
130s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
22-05-2024 22:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68d21c26332047d31a5c662fccc4f82d_JaffaCakes118.apk
Size

1.7MB
MD5

68d21c26332047d31a5c662fccc4f82d
SHA1

e54b95913cb79c530177a80eec21b92a8f637dd6
SHA256

90f41db41514010dfeacabec6b629fa44dcc562f50d0517df2fc49d877ac5a66
SHA512

707bea350050fb9d77d5d1c81cec53848ff804591d872ae9d2e924bbee63f7e2ffffebb81a5f1e8891f248965b0ed2f5811f59d4bb035385b211789bfacf83c6
SSDEEP

24576:l4AE8959xl9YWKJbvSYuVtknTKvfpr+CDjAO02OZGpUgWN1C//0:Cyv3YWKJrSHonTyhDEHZXgWNO/0

Score

8^/10

banker collection discovery evasion impact persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

T1418.001
Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
collection discovery evasion

T1430

T1627.001

Processes:

com.otr.emhzkx

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.otr.emhzkx
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
evasion discovery

T1633.001

T1426

Processes:

com.otr.emhzkx

description ioc process

File opened for read /proc/meminfo com.otr.emhzkx

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.otr.emhzkx

description	ioc	process
File opened for read	/proc/meminfo	com.otr.emhzkx

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

T1407

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.otr.emhzkx/files/sen/CUbiBcTgQz.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.otr.emhzkx/files/sen/oat/x86/CUbiBcTgQz.odex --compiler-filter=quicken --class-loader-context=&com.otr.emhzkx/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.otr.emhzkx/files/Plugin2.apk --output-vdex-fd=59 --oat-fd=60 --oat-location=/data/user/0/com.otr.emhzkx/files/oat/x86/Plugin2.odex --compiler-filter=quicken --class-loader-context=&

ioc	pid	process
/data/user/0/com.otr.emhzkx/files/sen/CUbiBcTgQz.jar	4315	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.otr.emhzkx/files/sen/CUbiBcTgQz.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.otr.emhzkx/files/sen/oat/x86/CUbiBcTgQz.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.otr.emhzkx/files/sen/CUbiBcTgQz.jar	4289	com.otr.emhzkx
/data/user/0/com.otr.emhzkx/files/Plugin2.apk	4377	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.otr.emhzkx/files/Plugin2.apk --output-vdex-fd=59 --oat-fd=60 --oat-location=/data/user/0/com.otr.emhzkx/files/oat/x86/Plugin2.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.otr.emhzkx/files/Plugin2.apk	4289	com.otr.emhzkx

Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

T1424

Processes:

com.otr.emhzkx

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.otr.emhzkx
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

T1421

Processes:

com.otr.emhzkx

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.otr.emhzkx
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

T1422

Processes:

com.otr.emhzkx

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.otr.emhzkx
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

T1422
Reads the content of SMS inbox messages. 1 TTPs 1 IoCs
collection

T1636.004

Processes:

com.otr.emhzkx

description ioc process

URI accessed for read content://sms/inbox com.otr.emhzkx
Reads the content of the SMS messages. 1 TTPs 1 IoCs
collection

T1636.004

Processes:

com.otr.emhzkx

description ioc process

URI accessed for read content://sms/ com.otr.emhzkx
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

T1624.001

Processes:

com.otr.emhzkx

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.otr.emhzkx
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

T1421

Processes:

com.otr.emhzkx

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.otr.emhzkx

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.otr.emhzkx

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.otr.emhzkx

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.otr.emhzkx

description	ioc	process
URI accessed for read	content://sms/inbox	com.otr.emhzkx

description	ioc	process
URI accessed for read	content://sms/	com.otr.emhzkx

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.otr.emhzkx

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.otr.emhzkx

Requests dangerous framework permissions 10 IoCs

Processes:

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Required to be able to access the camera device.	android.permission.CAMERA

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

T1471

Processes:

com.otr.emhzkx

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.otr.emhzkx

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.otr.emhzkx

com.otr.emhzkx
1⤵
- Requests cell location
- Checks memory information
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Reads the content of SMS inbox messages.
- Reads the content of the SMS messages.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4289

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.otr.emhzkx/files/sen/CUbiBcTgQz.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.otr.emhzkx/files/sen/oat/x86/CUbiBcTgQz.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:4315

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.otr.emhzkx/files/Plugin2.apk --output-vdex-fd=59 --oat-fd=60 --oat-location=/data/user/0/com.otr.emhzkx/files/oat/x86/Plugin2.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:4377

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.otr.emhzkx/app_dex/utopay.jar --output-vdex-fd=116 --oat-fd=117 --oat-location=/data/user/0/com.otr.emhzkx/app_dex/oat/x86/utopay.odex --compiler-filter=quicken --class-loader-context=&
2⤵
PID:4491

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.otr.emhzkx/app_dex/utopay.jar
Filesize
30KB

MD5
eb6089c1acfa9f12535e533aebee845e

SHA1
165e39ee07dcd9ed00fc2dc1ff466bc1d6b813c9

SHA256
b825cde84e3dddfc147c71265d2259c422d51a7e56d1dcdba1321e3119b1df07

SHA512
5b1bc26bcbcf05fc331865fb4dd572b673a52650d68ab4d9b028ea15219e0d93c1ec17996953436801913388d78e25c67ea33aa93544d65e96a799eb06cc70f5

Download Submit
/data/data/com.otr.emhzkx/databases/740410100062013
Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.otr.emhzkx/databases/740410100062013-journal
Filesize
512B

MD5
a89da41340ad639bf431c845d31cffe4

SHA1
03668db6cc9a7a9ab6c7f961dce023ed5263f395

SHA256
6a1916f5d786e4fb5f99ac169db2af72f4ee4630808c6343a79d2df24cd410d2

SHA512
cc30f78c91e248c59ca5b069998641d615ac9400bd929e3f311ddce540857c9cae420dbab390ae93df65f922d90a9a9894f31e150c4331b3f81b1e4b30aef87b

Download Submit
/data/data/com.otr.emhzkx/databases/740410100062013-shm
Filesize
28KB

MD5
cf845a781c107ec1346e849c9dd1b7e8

SHA1
b44ccc7f7d519352422e59ee8b0bdbac881768a7

SHA256
18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

SHA512
4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

Download Submit
/data/data/com.otr.emhzkx/databases/740410100062013-wal
Filesize
140KB

MD5
81af04f00d08be0b6d7f2e62b806831d

SHA1
b3a568b2c2ee464adee1b04d2c6ce180bb906782

SHA256
b591162fafed50a4d11af4b6e74410ff6d353e5beea30dde1bc41eb2c0804ce9

SHA512
3cf06aace108ecaec0ce223942a47d29833df6e749fb186916f6859eb584e7b738c286c3afc27baebdd9d3a48abaca7ef0501cbfa88f82cf6c901e131a83d62e

Download Submit
/data/data/com.otr.emhzkx/databases/wochi_v4.db-journal
Filesize
512B

MD5
4b7c42c96ceb71ad516de5ef5c5b978b

SHA1
d9d45de2c3c69e5081fac29fcc8151a7474bc6d7

SHA256
91bb8e2395744a644daba8fb2fa854ec283929c61c817b96d12a35caacdac74a

SHA512
b62797d0c19c1c1292e6387b2d8e0a67f5697a63ff8270fd4d3871996ba629eca7311cf2054e0676d79e0f3f5886715a5231277c587b83aa1d0f33efe67245d6

Download Submit
/data/data/com.otr.emhzkx/databases/wochi_v4.db-wal
Filesize
20KB

MD5
6812c030c1e3d278edc34e49c2ce2ce1

SHA1
a1ab6ecf1f38518cb415934bb4f9c715f5dbea1c

SHA256
1e40022b29a04e970d9d41cfbfd0b7552954f015d5983cd2f27b489068988fc2

SHA512
e149955695a2a861f75a475780f461844fa98254c7fd93225ed2702ac5a62a8fa176fadc3b52a8290b2fe6f0a0361ebb44056dcbc94a8b4c78244d0e76a87446

Download Submit
/data/data/com.otr.emhzkx/files/Plugin2.apk
Filesize
99KB

MD5
3d216f8fddb9705a6720a285475837f1

SHA1
f053d23b284bfe2faf6e76d353ff052471e2de2c

SHA256
de7bf40574754a5144fa5cf3bc5e97f7adc7f5abebb18c41e8f0631917db4c0c

SHA512
38be39da8f96abc87109cfd57b2d63ddfa72971f023024a5b4ce1f97cd905a96a94e19eea19ae9b745f28d02c6689a4473627ce57ec85dce2018a77e699620cb

Download Submit
/data/data/com.otr.emhzkx/files/log.dat
Filesize
221B

MD5
ff9229f8e7c92d44d48e25206d43b021

SHA1
be3d75050c16c5b7484652ba292fdd6510f205d3

SHA256
77fc3599be409f7e73e643de843c0ebcfa20662964c498fc59e245c7f5e003a2

SHA512
be7b3aa8d670a2873c6b7bfd4ca93121fd2450723cbbc36d9d06d152fafa3ce90451f0a60ab56bc96bccb81cf5aae0167b404073db14dc17b9513ac73d455c58

Download Submit
/data/data/com.otr.emhzkx/files/sen/CUbiBcTgQz.jar
Filesize
790KB

MD5
ce817d7c1402dfc74bfa5974ed23d0ec

SHA1
6d9aeeedffcfe82a431b86149af03b8415ec6751

SHA256
5551be649df596de743dfc8448fae850b3c11bfb36ac91ab0ec308c141e5d025

SHA512
b532d6291bbf4c4ac64381a65a70356a8adb8bf4f3061be4596089bcd08046af6bd3bbaf371aa7cb992c099871a2e8a2be4c09f730b330aab713f94ed8c8b59b

Download Submit
/data/user/0/com.otr.emhzkx/files/Plugin2.apk
Filesize
201KB

MD5
ef019d14367b7346b1ae2419e9d445c8

SHA1
23d81fcf81f3a9f2a991ba4d0d135fe2a28aa188

SHA256
1d83642ede6b16a071676e895f547d056543b5b4622bbc9b9b4ab45e47bf9ba0

SHA512
ea582f21c6054c37c679c798e93116c9c18c9544c0feb78fb949bed7b2cd3122c8d7bb8ecef329829c2531764abeb6200f0af49ede97c3b0b7448bdb65a34a60

Download Submit
/data/user/0/com.otr.emhzkx/files/Plugin2.apk
Filesize
201KB

MD5
2a425e0fae74f20a2c475da937a619a2

SHA1
4d701c7e6d828aa96ba8a493720e7282c49ec741

SHA256
2c61a25f1ad5783bf82eea9faa2536cac4788ed3147bc1864d9ef17ea01be6a7

SHA512
44c8d2a837b606de99055badbd4b5e708424ca9809b1583d13aefadc4d4af974658dc3a3f179fc3047eef7167151c638ff66dd6c8d38121b6ecdfb464d2a5a60

Download Submit
/data/user/0/com.otr.emhzkx/files/sen/CUbiBcTgQz.jar
Filesize
1.9MB

MD5
ea28720c1e80a2b0a1ec95b71e302c0f

SHA1
071b1bdad99e5f64f630fdebbfe6d17407315680

SHA256
5a0fe54f7647fec9c02bbbe5762ab600e647648c3d09fed6dc0038cc0049bc57

SHA512
82f5bd1b63a6fe6e78b9b4384761e9e746479c58a3996a949f70bb681437a7b4d70b081c72607db21b7e660db23e433b69e94fe1834e1c5ded753f1d236c1bcf

Download Submit
/data/user/0/com.otr.emhzkx/files/sen/CUbiBcTgQz.jar
Filesize
1.9MB

MD5
a1ce081e8ab37db14a25a1c910756873

SHA1
39bda70d25a104d9f93236d6f8f20cffcf074d54

SHA256
6573d7b61a0e34fa30312efe86462538032f8dfdd9d0bbbd3c3c1d2f8f7d5523

SHA512
58b87d596326a83289070f994a31366113060ac1692a7ecc36c8db3dfe7a62fa60e4cfc3819d51d7b1a6288a89f291ffe96329e294c9f9c45da0bf45ec302fce

Download Submit