9544d149ed965ae3351f7be1032f295e40527c57921e23b3a0f12035169a015c

Analysis

max time kernel
11s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
22/05/2024, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6600ada3fd0cf5c0f7b65d04889125cf_JaffaCakes118.apk
Size 22.0MB
Sample240522-e43k5sca89
SHA256 9544d149ed965ae3351f7be1032f295e40527c57921e23b3a0f12035169a015c
MD5 6600ada3fd0cf5c0f7b65d04889125cf
SHA1 bce79781826ab2adf36585b223bc71b9f00f860a
SHA512 e958331aedd00bffa856c29d666cf129ad48b0530466829e30f6535cc8b92fa40b09c9fd21d2325f749f97dee77ba4bfd3ff70e7f7bda3f415d735978c7a1920
SSDEEP 393216:28GD5y2fZQPWp5HVK/exoOcBJoLzYATTV10sBINN28OdGGfZFf3KUx:2Xdy6mPk51KWG24OVdBILejKUx
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection discovery evasion persistence

Malware Config

Signatures

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	ly.pp.justpiano:remote

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/ly.pp.justpiano/files/stares/updates/sta.jar	4484	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/ly.pp.justpiano/files/stares/updates/sta.jar --output-vdex-fd=68 --oat-fd=71 --oat-location=/data/user/0/ly.pp.justpiano/files/stares/updates/oat/x86/sta.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/ly.pp.justpiano/files/stares/updates/sta.jar	4278	ly.pp.justpiano

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	ly.pp.justpiano:remote

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	ly.pp.justpiano:remote

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	ly.pp.justpiano:remote

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

ly.pp.justpiano
1⤵
- Loads dropped Dex/Jar
PID:4278
- getprop ro.board.platform
  2⤵
  PID:4390
- getprop ro.mediatek.platform
  2⤵
  PID:4418
- getprop ro.board.platform
  2⤵
  PID:4442
- getprop ro.mediatek.platform
  2⤵
  PID:4463
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/ly.pp.justpiano/files/stares/updates/sta.jar --output-vdex-fd=68 --oat-fd=71 --oat-location=/data/user/0/ly.pp.justpiano/files/stares/updates/oat/x86/sta.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4484

ly.pp.justpiano:remote
1⤵
- Requests cell location
- Queries information about the current nearby Wi-Fi networks
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:4314

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Execution Guardrails

T1627

Geofencing

T1627.001

Credential Access

Discovery

Location Tracking

T1430

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sta.jar

Path /data/data/ly.pp.justpiano/files/stares/updates/sta.jar
Size 2.1MB
SHA256 950b6ec9fc0e52116dad49cea91882149b4703e4bd6122b21eb0f503adfe0a56
MD5 0a2056b717e570789219c62b3db25494
SHA1 c007d694abe6b9bde185db858f7a18c3b498af7e
SHA512 97ce7f954b26f1a0d76c4e0c32720f064f521c2dd79f56ab402aac88dfd7ef56c8bd1ba4558e8b821d6a4f0951c9f315131abb16f2b24522e52c25964b5e31ca
SSDEEP 49152:z1anRWSRRAeAOHy5mWr7cZVsjFrcZzVCuSlH7WKYnRgIpLLw:paRW0AqyJ0vsjFGzoNK7nRgIpLw
MD5 SHA1 SHA512 SSDEEP

Submit Download

sta.jar

Path /data/user/0/ly.pp.justpiano/files/stares/updates/sta.jar
Size 3.4MB
SHA256 44d11f57ecd7596d3e762da32bdb8ed4ba94a53c585c5d9de47007f1a20d5eb2
MD5 ce124386c7b2ae625849c583f83967c6
SHA1 ddafd6802992f51f0409839453ef9fc611ca735c
SHA512 38f68a23c35e34ad857146b2a42866225f7588697e1887a854a03613565785f1d2cddc512b21a37889db00ec9bc57f061cb2b4578c5a5b24bb53012b0efad553
SSDEEP 24576:LEXvLo1sDVRVvI79D2ntLyHMcvu1/ELojnvy/PfKzZIvEw+jzyJHSaNMTCde4ekE:4fPw78BELKyyILQyJt2gw
MD5 SHA1 SHA512 SSDEEP

Download

sta.jar

Path /data/user/0/ly.pp.justpiano/files/stares/updates/sta.jar
Size 3.4MB
SHA256 245b99a86572d6736a00b18cdd507b865df688f14bf2fe232be26ef5a6171330
MD5 387e3984e552f9a4f47309dfc453f82a
SHA1 0e629acc985bb3565f33339ff04e9e1b73675cfe
SHA512 3d81d00d68b5ce7c5f91ad5086793b592d6f8658d67f74cdbdb9418c726dfb4f491a50a94030358927d8fd60c2a72534a11c13602424968e3bb99551b493dcd6
SSDEEP 24576:LEXvLo1sDVRVvI79D2ntLyHMcvxRxELoICNmyHNq0vXQOaM17R8Lw+jzyJHSaNMv:4fPw7lxEL4tHN2+RhQyJt2gw
MD5 SHA1 SHA512 SSDEEP

Download

con.dat

Path /storage/emulated/0/baidu/tempdata/con.dat
Size 12B
SHA256 f52db31332534833414abd5e870f78c810b8ebbe5b134bbf599506beecfd1b93
MD5 8d80bc8ea90e9cac010d3ddf97bda5f5
SHA1 f063bc0d356e6ba9ab1eb9a851131ffbefd8fa07
SHA512 9ea732dd572a9a4ba91b70891972230a09576687ca1bc19e62d5a98b5b84e0f2ae11985108008bc9fbccf357219b8bd3dbf146bb70752f618f70dc5d0c46a7c7
MD5 SHA1 SHA512

Submit Download

con.dat

Path /storage/emulated/0/baidu/tempdata/con.dat
Size 61KB
SHA256 9a712cb778e9d43f8f4ea9fa2b9f4b8cc29daf74984d04f0c938dff21c118342
MD5 042246eb7c48a8cda97de99465e6a177
SHA1 f71816c4a80fbb7b63bfd6425d98db513aecb00a
SHA512 2d201619998113c5d2990c92c28c973d557872bc4bbde153b5fca39bfe0b799ef0e9bf8c29d1304847f8e6691d55649d04c6a82fe8f03e621c9e8da50c50faa8
SSDEEP 1536:UHHNUMGO/LhgFfaKShdyjxeaQ/AykEr/8MBvvChCTrRVTMGrV:UnNUc+a7p/ztBvvChCTrRVTlrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

ls.db-shm

Path /storage/emulated/0/baidu/tempdata/ls.db-shm
Size 28KB
SHA256 18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
MD5 cf845a781c107ec1346e849c9dd1b7e8
SHA1 b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA512 4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

ls.db-wal

Path /storage/emulated/0/baidu/tempdata/ls.db-wal
Size 32KB
SHA256 2c01334405a319db3637a4228cd0379ff9d34e264ed882196cce58120ea7c987
MD5 747f9b163bc26ac7a770772ae7553ac6
SHA1 1eb2a4c0be0ab2ab34d670f7c774140710639670
SHA512 9f53560076e128d80cecc49cf6b208f9c94472e73b8c6d21965050c1acc77875e4c00f3951bca51608b5bcea8819730d19afeedc2f5e2f7828bccb67fe8ea3ac
SSDEEP 48:VgjgC8zNSP/ugxgigFgm/aKSP/ugag3g:F0PMavP
MD5 SHA1 SHA512 SSDEEP

Submit Download

yoh.dat

Path /storage/emulated/0/baidu/tempdata/yoh.dat
Size 4KB
SHA256 8ff0f6b3e7418b0b075fdf9d9ef1a9a508a929455a07123517e22abccd67b346
MD5 75229e9084930ca4b6194036d86fb526
SHA1 55f6a7362156b9d7773c8f3d8c5aa177117a810f
SHA512 be4313cde2ece23e093e319c2ce7ef4baa6d0e577f8dee5a7b26951df14b4c59e862fde3162d10cd06c028bcf3a0d1c73eb549f7eb018383922cc0accdc57a94
SSDEEP 96:/ax14We2saT362KzyWvcplGe362KzyWvcpl:/0maTNL
MD5 SHA1 SHA512 SSDEEP

Submit Download

yoh.dat

Path /storage/emulated/0/baidu/tempdata/yoh.dat
Size 24B
SHA256 9d908ecfb6b256def8b49a7c504e6c889c4b0e41fe6ce3e01863dd7b61a20aa0
MD5 1681ffc6e046c7af98c9e6c232a3fe0a
SHA1 d3399b7262fb56cb9ed053d68db9291c410839c4
SHA512 11bb994b5d2eab48b18667c7d8943e82c9011cb1d974304b8f2b6247a7e6b7f55ca2f7c62893644c3728d17dafd74ae3ba46271cf6287bb9e751c779a26fefc5
MD5 SHA1 SHA512

Submit Download

yom.dat

Path /storage/emulated/0/baidu/tempdata/yom.dat
Size 24B
SHA256 f0f5049c51879dd7da0ce4a43349b5b34ce053d072a0ca704f62cf22ba4a8412
MD5 a936690571e9104e1922dda4a0ba5bd1
SHA1 65f49c57edde2f96be2a1dbdfc3f7351f1e66554
SHA512 3be1c3693963aebdfc04e86b1c820ee0ec3cf0b200e6a4788ef1141f39fd6c2f77f4227247ae4affa66c0a6c027df8466cc0dcec1e67ebfb953e36bee97de394
MD5 SHA1 SHA512

Submit Download

.systemid

Path /storage/emulated/0/data/.systemid
Size 512B
SHA256 e39e174b88e66408cb9984a1405f807f0aed7560267dcf42431d5c3bfb5415a2
MD5 d6c621a2eb26ec0ad668bee191634057
SHA1 767f2951e093e668e48ec40babba696bbd7af278
SHA512 2ad1b68044bd7555b71800f24e385440800e75a55e27b8c1c2b0b6676cb716974d746bc72de940882da6bdd7128753f4fdf2f75a9b9454ff45d5542100c810af
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads