Analysis
- max time kernel
9s - max time network
162s - platform
android_x86 - resource
android-x86-arm-20240514-en - resource tags
- submitted
22/05/2024, 03:22
General
- Target 65d62b4677d6c5892a3f7ad4d1a80968_JaffaCakes118.apk
- Size 15.8MB
- Sample240522-dw4b2aae69
- SHA256 5a8e2df62e7931f08b291aa7869671441a0f28b75e35717f5f8ef5a374195122
Malware Config
Signatures
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
- Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
- Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
- Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
- Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
- Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
- Queries the mobile country code (MCC) 1 TTPs 1 IoCs
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
- Checks if the internet connection is available 1 TTPs 1 IoCs
- Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.mfw.roadbook1⤵
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.mfw.roadbook/app_push_lib/plugin-deploy.jar --output-vdex-fd=123 --oat-fd=124 --oat-location=/data/user/0/com.mfw.roadbook/app_push_lib/oat/x86/plugin-deploy.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
plugin-deploy.jar
plugin-deploy.key
umeng_it.cache
plugin-deploy.jar
plugin-deploy.jar
defaultCache
db
db
db-journal
db-shm
db-wal
035073e7d4db5ae62e89894d60793b99
056d59f3b32deefb55aa8826339c6709
06d21ee5686d822cf6ce7843346d140f
0712fb7b42809c96a1788536f8306cbc
0773ecaf704025b5cecaf9d3b9c6e85b
08fccff1bc5b02f5f0def36242e3d228
0d4c2b584799c1101951a50690b00689
1063e94125536f05f4a7b4d230b85be3
11ea801f6643011e8567b8338c9b4ab7
121bf6575b8361d2029a53d4400f47c6
129895d860b16fb5343ee270d17b050b
1a18c2e1e88d6299c548e913164edc0a
1db99878018446c027797fcaea84d951
1fb8b44e97931537edee0c778b0cdd6f
2305bd40155f01d18107e18d0ff17695
30c5e63fd20bfc8519c630aca8579d7c
35d97f56b2e6c0368ba9f8ac357d42c6
388dc5d16b742cfc3a0d0d59fe8323e1
45994125c3123c1676f21bd9e8add248
57e3ee860aa0e76df338f8faf20e621b
57e6afa86c205544e0641e35060bb6eb
58bf8dda913fd679e42c037939771ba1
5b8c49112069f630c7257c5d12efb77d
5c76f882b71bd1d6a33ecef8bdf205c3
5e132e72c9528af97b9544f75404c1b3
6904964efa3b753f882416a8e98b827f
6aebb6dcbf22da9a731854e4a8e32c4c
6cef4c25a7b476c9f32722855186555a
6ee522235de99a3f16a539523c7b42a7
704239551e6a653942db374139e92ae7
75bba3167091e92a99a5368dc58ff162
77fe9362a0c5406aeab794bd234b7e82
7e17eca897213c27cef87c3b8f1c09a4
830847e5e5ef8c150642f39a40b579e9
88ef29774f9828df072e5de68b8f0845
8c6069eab002ad8ee13a0d71deee08dc
8e35e1bfcb6762fc981efd02ee7a3851
91664a2b069beea8f5274ce80893f15b
92f8cdff3396fc8752e18584bb6edaec
a39a91b70b6f99d4c3d03b65ab2837c0
a56a0648ed69b760cbc64d41c68effb6
b6259cca6b74383e7eb22e72dabd9772
b77df21ae0a150f6f2a33dcfcb92736c
b78d53fa8b72e07151197903279cbe4b
ba712b2328017ee5c255003e4fb349dd
bd365ccb1355435c65cdfe4f1157a58e
bee46cdca8c8c4a0d0116e0e598846cf
bf20468bd4332566cc55c842ec4884c6
c082946246ea1c3e3b7e87581e61103d
c129c778716635c3a2de0aa6bf7ff687
c1cfdc84d018905d23a1726a43a0e10b
c329f3c52c972c88619a0c83ed90101d
c71156191fd0fea3010f7222bfe74ad2
d4194274aeca415b8ce3c6596dc4dd5c
d5c118163a082b673666cc383ae50993
d600dcdfd1ad077466112443d47a53a8
d7b1499fb4184e331eb9841179793530
d9e37a4bae8c1e5898658c6f4eb35913
d9e755b39e5c273e0b3ca7cbb7437b0b
da98925b31098d447c1b99b8dfd5469f
dab179194b4377672efaa94631d98d89
dd9aabf17dffcd843202eb6306b8c7e6
e1e9209b579bbbdcd6a5b39715f2473b
e281c03f3f4264755c340a39bf7d8065
e30397d1efa736c800a6c3445a1c8074
e4e0340f83b0ed0d409665c06f7f8d69
e8a0b4d98f84a97f60a09497d97177e1
efedfff8d256d5a17a7dd535e31b550f
f1e8b1055ba35bf76f57a4b7ab80a86a
fd7df6032dee5df4017f9c9ab252e74e
.dk