e4db9da1ce50018da322df7ed6b2bba251f45ef8e7faa9f96280e7cf1f4bfd8a

General

Target

66271a818c9d645a3325ff740bb68649_JaffaCakes118.apk
Size

27.3MB
MD5

66271a818c9d645a3325ff740bb68649
SHA1

b59497038983e83b7b391c36f175567a36902a11
SHA256

e4db9da1ce50018da322df7ed6b2bba251f45ef8e7faa9f96280e7cf1f4bfd8a
SHA512

7422e9f1e6befd7c76ad3bd977df33c885be2b64987c19b97a07ff4eb1a191804c6464d32d73a7a2f6dddc586d8cea92163c9645d2086966c1bf8357174e52b1
SSDEEP

786432:3pDUoVtIVlb19DQLqDgyQWcTom9C/ipn6DMjOFYWYP:5rSLfOem8/KJjZZP

Score

7^/10

discovery evasion

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.appnoxious.dabmod/files/stares/updates/sta.jar --output-vdex-fd=57 --oat-fd=62 --oat-location=/data/user/0/com.appnoxious.dabmod/files/stares/updates/oat/x86/sta.odex --compiler-filter=quicken --class-loader-context=&com.appnoxious.dabmod

ioc	pid	process
/data/user/0/com.appnoxious.dabmod/files/stares/updates/sta.jar	4417	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.appnoxious.dabmod/files/stares/updates/sta.jar --output-vdex-fd=57 --oat-fd=62 --oat-location=/data/user/0/com.appnoxious.dabmod/files/stares/updates/oat/x86/sta.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.appnoxious.dabmod/files/stares/updates/sta.jar	4273	com.appnoxious.dabmod

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

System Network Connections Discovery
T1421

Processes:

com.appnoxious.dabmod

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.appnoxious.dabmod
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.appnoxious.dabmod

com.appnoxious.dabmod
1⤵
- Loads dropped Dex/Jar
- Queries information about the current Wi-Fi connection
PID:4273

getprop ro.board.platform
2⤵
PID:4351

getprop ro.mediatek.platform
2⤵
PID:4370

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.appnoxious.dabmod/files/stares/updates/sta.jar --output-vdex-fd=57 --oat-fd=62 --oat-location=/data/user/0/com.appnoxious.dabmod/files/stares/updates/oat/x86/sta.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:4417

getprop ro.board.platform
2⤵
PID:4446

getprop ro.mediatek.platform
2⤵
PID:4464

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Credential Access

Discovery

System Network Configuration Discovery

1

T1422

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.appnoxious.dabmod/files/stares/updates/sta.jar
Filesize
1.0MB

MD5
b1a590ed02c586df1e69c62749410853

SHA1
82528aeb58a3fd4fb242b3c4a9af855f42525e4f

SHA256
a174df995ead589eeb861d2396cc6ffa53c72ce66cc195beb28a5c9c13386591

SHA512
d4b11468f523b9cc688714ddb1be84a06e955b39cc0c3ff3071b8ed98428b6f0ddf909c1ea4bbf15015e6f06086d67b8a9be6dd68f4fe0b11c56c4f5a66f4532

Download Submit
/data/user/0/com.appnoxious.dabmod/files/stares/updates/sta.jar
Filesize
2.0MB

MD5
a3bf89e851771ee64ca8ef40a6e71c3c

SHA1
8bde53a1ce393354e7248ec2e6e011d32c35f487

SHA256
3c81ad327054e8e0517db72ec000f0452202281253d006d2ee00940fabee669e

SHA512
14a7a7f3c2ad26296e87da50b7a73893c1c217c5e43aff76f0680715704a19e8e1c1b16ffa5626baffc6dc37f725a5f3f507746f137cc80ec15c5edeabe38851

Download Submit
/data/user/0/com.appnoxious.dabmod/files/stares/updates/sta.jar
Filesize
2.0MB

MD5
9bc3da5b97a0d0c9548586265628f174

SHA1
d91557719187deed78fe28b192048fe059e2ae55

SHA256
f60e2fd48e9b6d1df160bea491ce67c5e66b9b7a2d42438ac07e9c77d9a9d750

SHA512
aae7491d395472e286b02dca6fa68e5b93cc049a91047b1df468d0a5b0d6e191da5286d71a876a27658df2d49aee10b3a97c21359d67bedcfd6b9e492208b951

Download Submit
/storage/emulated/0/data/.systemid
Filesize
36B

MD5
cb92ae3a7aaca8a4766b99bdc70aea93

SHA1
5b809dd5c29b2f11f9030dcca025c34273e0129f

SHA256
3caa34dc1cd810d596d47ae9606856bc87ffc5196c7b28baaf6209f53dbaa8c0

SHA512
19395af2eed2f5e8b715e3c1608968569d1695b3653e28b2f194f59a95a0c672c0272c82484c14a63ce8aef47ee3b3670644421e52708af6b1928e3d6553dff5

Download Submit
/storage/emulated/0/data/.systemmac
Filesize
17B

MD5
0f607264fc6318a92b9e13c65db7cd3c

SHA1
c1976429369bfe063ed8b3409db7c7e7d87196d9

SHA256
c248c629af1fe0a8c46b95668064c1d2952a9e91d207bc0cc3c5d584c2f7553a

SHA512
9dbd40b135b46c7be31b8c7d11c75b0b179af3a6550fca52ec447583aeb50aaaedb4b1e9373cf8826615149549a2efaee04efdc9a282e3a6b387c73099c13fb1

Download Submit

Analysis

Sharing