Analysis
-
max time kernel
164s -
max time network
130s -
platform
android_x86 -
resource
android-x86-arm-20240514-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system -
submitted
22-05-2024 09:23
Static task
static1
Behavioral task
behavioral1
Sample
66c88cbc3d4cd5498cc8c338b69cbca3_JaffaCakes118.apk
Resource
android-x86-arm-20240514-en
General
-
Target
66c88cbc3d4cd5498cc8c338b69cbca3_JaffaCakes118.apk
-
Size
10.9MB
-
MD5
66c88cbc3d4cd5498cc8c338b69cbca3
-
SHA1
631b381bcb9ddac5890f9e341b19150e42499d8b
-
SHA256
d93a9f93529bac51147c172872d7f48dcd3c6b9b74f4a59001d035043139bceb
-
SHA512
15841f14870f9383d583f2956d0729d90ed4152940360625be8e1c50fd42de3240affb6a0a75b7e0954775eb61908b38d88f0903c065649d01e9be0ffc5a9fcb
-
SSDEEP
196608:sPS5pq/gzlcloQ8LFkGgFTqrS0xtyywzPfVc+7VwVWrDm7VgJLEmxkEk/CXjAyx:TyoQaXgw0flNDDxRRGfKRx
Malware Config
Signatures
-
Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
Processes:
com.tixa.industry.search2c9480b7517ad8800151a86877d11b3fdescription ioc process Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.tixa.industry.search2c9480b7517ad8800151a86877d11b3f -
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
Processes:
com.tixa.industry.search2c9480b7517ad8800151a86877d11b3fdescription ioc process File opened for read /proc/cpuinfo com.tixa.industry.search2c9480b7517ad8800151a86877d11b3f -
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
Processes:
com.tixa.industry.search2c9480b7517ad8800151a86877d11b3fdescription ioc process File opened for read /proc/meminfo com.tixa.industry.search2c9480b7517ad8800151a86877d11b3f -
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
Processes:
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tixa.industry.search2c9480b7517ad8800151a86877d11b3f/files/__pasys_remote_banner.jar --output-vdex-fd=51 --oat-fd=52 --oat-location=/data/user/0/com.tixa.industry.search2c9480b7517ad8800151a86877d11b3f/files/oat/x86/__pasys_remote_banner.odex --compiler-filter=quicken --class-loader-context=&com.tixa.industry.search2c9480b7517ad8800151a86877d11b3fioc pid process /data/user/0/com.tixa.industry.search2c9480b7517ad8800151a86877d11b3f/files/__pasys_remote_banner.jar 4332 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tixa.industry.search2c9480b7517ad8800151a86877d11b3f/files/__pasys_remote_banner.jar --output-vdex-fd=51 --oat-fd=52 --oat-location=/data/user/0/com.tixa.industry.search2c9480b7517ad8800151a86877d11b3f/files/oat/x86/__pasys_remote_banner.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.tixa.industry.search2c9480b7517ad8800151a86877d11b3f/files/__pasys_remote_banner.jar 4269 com.tixa.industry.search2c9480b7517ad8800151a86877d11b3f -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
Processes:
com.tixa.industry.search2c9480b7517ad8800151a86877d11b3fdescription ioc process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.tixa.industry.search2c9480b7517ad8800151a86877d11b3f -
Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
Processes:
com.tixa.industry.search2c9480b7517ad8800151a86877d11b3fdescription ioc process Framework service call android.net.wifi.IWifiManager.getScanResults com.tixa.industry.search2c9480b7517ad8800151a86877d11b3f -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
Processes:
com.tixa.industry.search2c9480b7517ad8800151a86877d11b3fdescription ioc process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.tixa.industry.search2c9480b7517ad8800151a86877d11b3f -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
com.tixa.industry.search2c9480b7517ad8800151a86877d11b3fdescription ioc process Framework service call android.app.IActivityManager.registerReceiver com.tixa.industry.search2c9480b7517ad8800151a86877d11b3f -
Checks if the internet connection is available 1 TTPs 1 IoCs
Processes:
com.tixa.industry.search2c9480b7517ad8800151a86877d11b3fdescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.tixa.industry.search2c9480b7517ad8800151a86877d11b3f -
Reads information about phone network operator. 1 TTPs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes:
com.tixa.industry.search2c9480b7517ad8800151a86877d11b3fdescription ioc process Framework API call javax.crypto.Cipher.doFinal com.tixa.industry.search2c9480b7517ad8800151a86877d11b3f
Processes
-
com.tixa.industry.search2c9480b7517ad8800151a86877d11b3f1⤵
- Requests cell location
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Queries information about the current Wi-Fi connection
- Queries information about the current nearby Wi-Fi networks
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4269 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tixa.industry.search2c9480b7517ad8800151a86877d11b3f/files/__pasys_remote_banner.jar --output-vdex-fd=51 --oat-fd=52 --oat-location=/data/user/0/com.tixa.industry.search2c9480b7517ad8800151a86877d11b3f/files/oat/x86/__pasys_remote_banner.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4332
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Execution Guardrails
1Geofencing
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.tixa.industry.search2c9480b7517ad8800151a86877d11b3f/databases/IndustrySearch.dbFilesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
/data/data/com.tixa.industry.search2c9480b7517ad8800151a86877d11b3f/databases/IndustrySearch.db-journalFilesize
512B
MD51fbbac57e3718f289b768505864b065a
SHA1be2f8746e9f0c52421416c23beed3d85a4cfd512
SHA2569ba7e180950a815d07c3279dd0fc022211a77d989be14b51e2a8ecc3f8728534
SHA5128bfa944a903fabc1f39c26acf01731dc1eeda658f2e0838d2a693181e982fba599b4f4e3f6b26bc2acec7aea2f8349efe2bc56645a84849140f787b48242373e
-
/data/data/com.tixa.industry.search2c9480b7517ad8800151a86877d11b3f/databases/IndustrySearch.db-shmFilesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
/data/data/com.tixa.industry.search2c9480b7517ad8800151a86877d11b3f/databases/IndustrySearch.db-walFilesize
48KB
MD5f997a33229bf3db3b49f24672ed8ad95
SHA1260c84e0df6d0b9aa6090a0cca3cdf86953f0d9c
SHA25608e39e8ef33ccc1ebc568be701fae70a23dfb6e8de19b46abd8c524d2f67fe79
SHA512b39179f8291532ea1e2662a36c4a0f25d9a3115c451074b460764b7b1788edf920d0c878c36a702a0cc33cdebce2167837a551e15b96383f69e03d0e6963f47f
-
/data/data/com.tixa.industry.search2c9480b7517ad8800151a86877d11b3f/files/__pasys_remote_banner.tmp.jarFilesize
295KB
MD5289aa52188b4a1eb9a3a5904b0638ada
SHA13efe010f8832bc5ee7df88152e01ef1f446663c4
SHA256947be2e29c43127ccaa6ab05b2600405cebd5aef985204a4cf2e17ecf7cfaa91
SHA51234078ccf3fc42c63f338bb9f62eb139d953ad9e0e5fd813465d9f4d37f708fc20d7309897919cdf6be37acbda2669fd6d32ff4a233279e2cd6e2a0ba62cdc47d
-
/data/data/com.tixa.industry.search2c9480b7517ad8800151a86877d11b3f/files/oat/__pasys_remote_banner.jar.cur.profFilesize
156B
MD563852d3031ca8ec7284bd400c36877e0
SHA1099de54af2a84601d7c2dd203311ac2b7b947913
SHA256ab5a6e7385a6787fba9c0d795435b2131d02ba683f65e4b3eefd61427d3b4a84
SHA512d24567ae0913dcd605fdb295e39044856d266bf7a19c41420e110f1c7eb587bf6606d06e27394f1240aa8a388bdef99124a57d18c300792c912e2b95480ca582
-
/data/user/0/com.tixa.industry.search2c9480b7517ad8800151a86877d11b3f/files/__pasys_remote_banner.jarFilesize
417KB
MD5981c6cf9b7df281081e05c808cf0afd5
SHA148aabea85a9693f461f87e1bdb9f8e76a8b45c1b
SHA256639cf990e6246c0418adf545481ca1549a3ac1b443bb3ad3f5a3552400e41f0e
SHA512b6e668c33021b64adaa304a4e085a2c5c88c16c99e811a4c768534fd67cd6cc380e125e960de511c3abc33c7b842be1441a7dd48aff83c2928d62ebaf65f6adc
-
/data/user/0/com.tixa.industry.search2c9480b7517ad8800151a86877d11b3f/files/__pasys_remote_banner.jarFilesize
417KB
MD596d208e818748da0a0510994de5be961
SHA18f093544c3ce04ef1dc323730d2937f889c911c6
SHA2569fab83f42fe2573d80524e4b91caffaee37f2ca37f56f6a97a2c626fb7927215
SHA51255a2b0c3a86ed751f31f96774aadebcf9068a4c3b828f0e1f4e30f0a5acd7a66ef14df7361ad2d9cccfe8f560db8e8cb2c67d9a459a75d24fbf762528f32bbf8