90f41db41514010dfeacabec6b629fa44dcc562f50d0517df2fc49d877ac5a66

Analysis

max time kernel
11s
max time network
130s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
22-05-2024 22:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68d21c26332047d31a5c662fccc4f82d_JaffaCakes118.apk
Size

1.7MB
MD5

68d21c26332047d31a5c662fccc4f82d
SHA1

e54b95913cb79c530177a80eec21b92a8f637dd6
SHA256

90f41db41514010dfeacabec6b629fa44dcc562f50d0517df2fc49d877ac5a66
SHA512

707bea350050fb9d77d5d1c81cec53848ff804591d872ae9d2e924bbee63f7e2ffffebb81a5f1e8891f248965b0ed2f5811f59d4bb035385b211789bfacf83c6
SSDEEP

24576:l4AE8959xl9YWKJbvSYuVtknTKvfpr+CDjAO02OZGpUgWN1C//0:Cyv3YWKJrSHonTyhDEHZXgWNO/0

Score

8^/10

banker collection discovery evasion impact persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
collection discovery evasion

Location Tracking
T1430

Geofencing
T1627.001

Processes:

com.otr.emhzkx

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.otr.emhzkx
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.otr.emhzkx

description ioc process

File opened for read /proc/meminfo com.otr.emhzkx

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.otr.emhzkx

description	ioc	process
File opened for read	/proc/meminfo	com.otr.emhzkx

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.otr.emhzkx/files/sen/CUbiBcTgQz.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.otr.emhzkx/files/sen/oat/x86/CUbiBcTgQz.odex --compiler-filter=quicken --class-loader-context=&com.otr.emhzkx/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.otr.emhzkx/files/Plugin2.apk --output-vdex-fd=59 --oat-fd=60 --oat-location=/data/user/0/com.otr.emhzkx/files/oat/x86/Plugin2.odex --compiler-filter=quicken --class-loader-context=&

ioc	pid	process
/data/user/0/com.otr.emhzkx/files/sen/CUbiBcTgQz.jar	4315	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.otr.emhzkx/files/sen/CUbiBcTgQz.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.otr.emhzkx/files/sen/oat/x86/CUbiBcTgQz.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.otr.emhzkx/files/sen/CUbiBcTgQz.jar	4289	com.otr.emhzkx
/data/user/0/com.otr.emhzkx/files/Plugin2.apk	4377	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.otr.emhzkx/files/Plugin2.apk --output-vdex-fd=59 --oat-fd=60 --oat-location=/data/user/0/com.otr.emhzkx/files/oat/x86/Plugin2.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.otr.emhzkx/files/Plugin2.apk	4289	com.otr.emhzkx

Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

Process Discovery
T1424

Processes:

com.otr.emhzkx

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.otr.emhzkx
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

System Network Connections Discovery
T1421

Processes:

com.otr.emhzkx

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.otr.emhzkx
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

System Network Configuration Discovery
T1422

Processes:

com.otr.emhzkx

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.otr.emhzkx
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads the content of SMS inbox messages. 1 TTPs 1 IoCs
collection

SMS Messages
T1636.004

Processes:

com.otr.emhzkx

description ioc process

URI accessed for read content://sms/inbox com.otr.emhzkx
Reads the content of the SMS messages. 1 TTPs 1 IoCs
collection

SMS Messages
T1636.004

Processes:

com.otr.emhzkx

description ioc process

URI accessed for read content://sms/ com.otr.emhzkx
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

com.otr.emhzkx

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.otr.emhzkx
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

com.otr.emhzkx

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.otr.emhzkx

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.otr.emhzkx

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.otr.emhzkx

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.otr.emhzkx

description	ioc	process
URI accessed for read	content://sms/inbox	com.otr.emhzkx

description	ioc	process
URI accessed for read	content://sms/	com.otr.emhzkx

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.otr.emhzkx

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.otr.emhzkx

Requests dangerous framework permissions 10 IoCs

Processes:

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Required to be able to access the camera device.	android.permission.CAMERA

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

com.otr.emhzkx

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.otr.emhzkx

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.otr.emhzkx

com.otr.emhzkx
1⤵
- Requests cell location
- Checks memory information
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Reads the content of SMS inbox messages.
- Reads the content of the SMS messages.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4289
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.otr.emhzkx/files/sen/CUbiBcTgQz.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.otr.emhzkx/files/sen/oat/x86/CUbiBcTgQz.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4315
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.otr.emhzkx/files/Plugin2.apk --output-vdex-fd=59 --oat-fd=60 --oat-location=/data/user/0/com.otr.emhzkx/files/oat/x86/Plugin2.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4377
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.otr.emhzkx/app_dex/utopay.jar --output-vdex-fd=116 --oat-fd=117 --oat-location=/data/user/0/com.otr.emhzkx/app_dex/oat/x86/utopay.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  PID:4491

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Execution Guardrails

T1627

Geofencing

T1627.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Protected User Data

T1636

SMS Messages

T1636.004

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.otr.emhzkx/app_dex/utopay.jar

Filesize
30KB

MD5
eb6089c1acfa9f12535e533aebee845e

SHA1
165e39ee07dcd9ed00fc2dc1ff466bc1d6b813c9

SHA256
b825cde84e3dddfc147c71265d2259c422d51a7e56d1dcdba1321e3119b1df07

SHA512
5b1bc26bcbcf05fc331865fb4dd572b673a52650d68ab4d9b028ea15219e0d93c1ec17996953436801913388d78e25c67ea33aa93544d65e96a799eb06cc70f5

Download Submit
/data/data/com.otr.emhzkx/databases/740410100062013

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.otr.emhzkx/databases/740410100062013-journal

Filesize
512B

MD5
a89da41340ad639bf431c845d31cffe4

SHA1
03668db6cc9a7a9ab6c7f961dce023ed5263f395

SHA256
6a1916f5d786e4fb5f99ac169db2af72f4ee4630808c6343a79d2df24cd410d2

SHA512
cc30f78c91e248c59ca5b069998641d615ac9400bd929e3f311ddce540857c9cae420dbab390ae93df65f922d90a9a9894f31e150c4331b3f81b1e4b30aef87b

Download Submit
/data/data/com.otr.emhzkx/databases/740410100062013-shm

Filesize
28KB

MD5
cf845a781c107ec1346e849c9dd1b7e8

SHA1
b44ccc7f7d519352422e59ee8b0bdbac881768a7

SHA256
18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

SHA512
4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

Download Submit
/data/data/com.otr.emhzkx/databases/740410100062013-wal

Filesize
140KB

MD5
81af04f00d08be0b6d7f2e62b806831d

SHA1
b3a568b2c2ee464adee1b04d2c6ce180bb906782

SHA256
b591162fafed50a4d11af4b6e74410ff6d353e5beea30dde1bc41eb2c0804ce9

SHA512
3cf06aace108ecaec0ce223942a47d29833df6e749fb186916f6859eb584e7b738c286c3afc27baebdd9d3a48abaca7ef0501cbfa88f82cf6c901e131a83d62e

Download Submit
/data/data/com.otr.emhzkx/databases/wochi_v4.db-journal

Filesize
512B

MD5
4b7c42c96ceb71ad516de5ef5c5b978b

SHA1
d9d45de2c3c69e5081fac29fcc8151a7474bc6d7

SHA256
91bb8e2395744a644daba8fb2fa854ec283929c61c817b96d12a35caacdac74a

SHA512
b62797d0c19c1c1292e6387b2d8e0a67f5697a63ff8270fd4d3871996ba629eca7311cf2054e0676d79e0f3f5886715a5231277c587b83aa1d0f33efe67245d6

Download Submit
/data/data/com.otr.emhzkx/databases/wochi_v4.db-wal

Filesize
20KB

MD5
6812c030c1e3d278edc34e49c2ce2ce1

SHA1
a1ab6ecf1f38518cb415934bb4f9c715f5dbea1c

SHA256
1e40022b29a04e970d9d41cfbfd0b7552954f015d5983cd2f27b489068988fc2

SHA512
e149955695a2a861f75a475780f461844fa98254c7fd93225ed2702ac5a62a8fa176fadc3b52a8290b2fe6f0a0361ebb44056dcbc94a8b4c78244d0e76a87446

Download Submit
/data/data/com.otr.emhzkx/files/Plugin2.apk

Filesize
99KB

MD5
3d216f8fddb9705a6720a285475837f1

SHA1
f053d23b284bfe2faf6e76d353ff052471e2de2c

SHA256
de7bf40574754a5144fa5cf3bc5e97f7adc7f5abebb18c41e8f0631917db4c0c

SHA512
38be39da8f96abc87109cfd57b2d63ddfa72971f023024a5b4ce1f97cd905a96a94e19eea19ae9b745f28d02c6689a4473627ce57ec85dce2018a77e699620cb

Download Submit
/data/data/com.otr.emhzkx/files/log.dat

Filesize
221B

MD5
ff9229f8e7c92d44d48e25206d43b021

SHA1
be3d75050c16c5b7484652ba292fdd6510f205d3

SHA256
77fc3599be409f7e73e643de843c0ebcfa20662964c498fc59e245c7f5e003a2

SHA512
be7b3aa8d670a2873c6b7bfd4ca93121fd2450723cbbc36d9d06d152fafa3ce90451f0a60ab56bc96bccb81cf5aae0167b404073db14dc17b9513ac73d455c58

Download Submit
/data/data/com.otr.emhzkx/files/sen/CUbiBcTgQz.jar

Filesize
790KB

MD5
ce817d7c1402dfc74bfa5974ed23d0ec

SHA1
6d9aeeedffcfe82a431b86149af03b8415ec6751

SHA256
5551be649df596de743dfc8448fae850b3c11bfb36ac91ab0ec308c141e5d025

SHA512
b532d6291bbf4c4ac64381a65a70356a8adb8bf4f3061be4596089bcd08046af6bd3bbaf371aa7cb992c099871a2e8a2be4c09f730b330aab713f94ed8c8b59b

Download Submit
/data/user/0/com.otr.emhzkx/files/Plugin2.apk

Filesize
201KB

MD5
ef019d14367b7346b1ae2419e9d445c8

SHA1
23d81fcf81f3a9f2a991ba4d0d135fe2a28aa188

SHA256
1d83642ede6b16a071676e895f547d056543b5b4622bbc9b9b4ab45e47bf9ba0

SHA512
ea582f21c6054c37c679c798e93116c9c18c9544c0feb78fb949bed7b2cd3122c8d7bb8ecef329829c2531764abeb6200f0af49ede97c3b0b7448bdb65a34a60

Download Submit
/data/user/0/com.otr.emhzkx/files/Plugin2.apk

Filesize
201KB

MD5
2a425e0fae74f20a2c475da937a619a2

SHA1
4d701c7e6d828aa96ba8a493720e7282c49ec741

SHA256
2c61a25f1ad5783bf82eea9faa2536cac4788ed3147bc1864d9ef17ea01be6a7

SHA512
44c8d2a837b606de99055badbd4b5e708424ca9809b1583d13aefadc4d4af974658dc3a3f179fc3047eef7167151c638ff66dd6c8d38121b6ecdfb464d2a5a60

Download Submit
/data/user/0/com.otr.emhzkx/files/sen/CUbiBcTgQz.jar

Filesize
1.9MB

MD5
ea28720c1e80a2b0a1ec95b71e302c0f

SHA1
071b1bdad99e5f64f630fdebbfe6d17407315680

SHA256
5a0fe54f7647fec9c02bbbe5762ab600e647648c3d09fed6dc0038cc0049bc57

SHA512
82f5bd1b63a6fe6e78b9b4384761e9e746479c58a3996a949f70bb681437a7b4d70b081c72607db21b7e660db23e433b69e94fe1834e1c5ded753f1d236c1bcf

Download Submit
/data/user/0/com.otr.emhzkx/files/sen/CUbiBcTgQz.jar

Filesize
1.9MB

MD5
a1ce081e8ab37db14a25a1c910756873

SHA1
39bda70d25a104d9f93236d6f8f20cffcf074d54

SHA256
6573d7b61a0e34fa30312efe86462538032f8dfdd9d0bbbd3c3c1d2f8f7d5523

SHA512
58b87d596326a83289070f994a31366113060ac1692a7ecc36c8db3dfe7a62fa60e4cfc3819d51d7b1a6288a89f291ffe96329e294c9f9c45da0bf45ec302fce

Download Submit