0a5dcd0a623e876873898707d3272d2e06ac6cf0b67182fc6b9f7699cb5780fd

General

Target

66d20f5f22900e72a8f3baf153b9d68b_JaffaCakes118.apk
Size

6.9MB
MD5

66d20f5f22900e72a8f3baf153b9d68b
SHA1

2a8bec892216db5a67b701fb77a5c19f46c7cc6c
SHA256

0a5dcd0a623e876873898707d3272d2e06ac6cf0b67182fc6b9f7699cb5780fd
SHA512

f060576e2c1aa544b0a3776a8e4b07f7c7a2caff54c9e5b00bfe147fa7361870f2db4d56b6a1eeb48192a339c016164e762d3d45736330b1b0507d7c01db3e54
SSDEEP

196608:fb+6Ud1VwgcSN3TmFu8MIF/g3UlSdQAOemxxWSPPGt:8jFN36Fu8MS/0MSGLekWSPPGt

Score

7^/10

discovery evasion

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

Processes:

/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.cybdtjrt.yyw/app_dex/ysdk_hackdex.jar --output-vdex-fd=59 --oat-fd=60 --oat-location=/data/user/0/com.cybdtjrt.yyw/app_dex/oat/x86/ysdk_hackdex.odex --compiler-filter=quicken --class-loader-context=&com.cybdtjrt.yyw

ioc	pid	process
/data/user/0/com.cybdtjrt.yyw/app_dex/ysdk_hackdex.jar	4322	/system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.cybdtjrt.yyw/app_dex/ysdk_hackdex.jar --output-vdex-fd=59 --oat-fd=60 --oat-location=/data/user/0/com.cybdtjrt.yyw/app_dex/oat/x86/ysdk_hackdex.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.cybdtjrt.yyw/app_dex/ysdk_hackdex.jar	4270	com.cybdtjrt.yyw

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

System Network Connections Discovery
T1421

Processes:

com.cybdtjrt.yyw

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.cybdtjrt.yyw
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

System Network Configuration Discovery
T1422

Processes:

com.cybdtjrt.yyw

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.cybdtjrt.yyw
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

com.cybdtjrt.yyw

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.cybdtjrt.yyw
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.cybdtjrt.yyw

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.cybdtjrt.yyw

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.cybdtjrt.yyw

com.cybdtjrt.yyw
1⤵
- Loads dropped Dex/Jar
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Checks if the internet connection is available
PID:4270
- /system/bin/dex2oat --debuggable --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --debuggable --generate-mini-debug-info --dex-file=/data/user/0/com.cybdtjrt.yyw/app_dex/ysdk_hackdex.jar --output-vdex-fd=59 --oat-fd=60 --oat-location=/data/user/0/com.cybdtjrt.yyw/app_dex/oat/x86/ysdk_hackdex.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4322
- getprop ro.build.version.emui
  2⤵
  PID:4349

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Credential Access

Discovery

System Network Configuration Discovery

4

T1422

System Network Connections Discovery

2

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.cybdtjrt.yyw/app_dex/ysdk_hackdex.jar

Filesize
1KB

MD5
d428e23060b3b30cd1926a33a17f96a4

SHA1
37eb661405ebe0cad99e83ed625cf2bc2e1ae612

SHA256
1f88fdf320cae29d1fd7c639b09ce4d4b468e349cd8bc71376d7c928ffa66f6a

SHA512
daac098768844f55ee1528f40b334b50928ad1862b948a5c942338a36c7cfd947356bbe605bd554e9ac85c00f6a39022c30374625311ce17c36734e291daf2db

Download Submit
/data/data/com.cybdtjrt.yyw/databases/ss_app_log.db

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.cybdtjrt.yyw/databases/ss_app_log.db-journal

Filesize
512B

MD5
c20faf2c6f912b2e68dbaf0a18685e2d

SHA1
f96d7033763d552d161a5bc99a67d53fe78455d6

SHA256
1ccdc5a8420f16d613e964e06609cdec1b5fac4f3bbde6ee938330b13234fdfc

SHA512
e61bdccac2dd96ec45da28579b7f7a03124ce0b53dc6a5c918eda520638b568bf6f94858631db9c87dd8f4af7ef983dc1c3563e3d2df121ad013f192ba9cab2f

Download Submit
/data/data/com.cybdtjrt.yyw/databases/ss_app_log.db-shm

Filesize
28KB

MD5
cf845a781c107ec1346e849c9dd1b7e8

SHA1
b44ccc7f7d519352422e59ee8b0bdbac881768a7

SHA256
18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

SHA512
4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

Download Submit
/data/data/com.cybdtjrt.yyw/databases/ss_app_log.db-wal

Filesize
52KB

MD5
cdf4de318c2e665afd150c92c647d838

SHA1
fbf66838a6d923226ab326d51f8ceb481b0d8c28

SHA256
2e03ed2a96e8000b61129b634f3aece489fa10fc3359ebd126536fcfa2355d62

SHA512
52c1b7a13a44cce446669826391295de1c26ca54009a5eb5aa8716ce1cd6ce8c2b8559b165117f6b594a106bb8411bdc18028203d5ae08489d44fa58937295e2

Download Submit
/data/user/0/com.cybdtjrt.yyw/app_dex/ysdk_hackdex.jar

Filesize
436B

MD5
9b20e11634237a1f000b7afb886dadfd

SHA1
004892c488dd2bacf9309dc19497364571804181

SHA256
f77c4b20ed10a4c168f723d502fb277391a2fa8ac9d189a4085928609b551acb

SHA512
3d23490c2dcd16f998d7665208efb7a5dad0ec3c6755f06a5885197cb4d3fd3ec49ba4db16a841057abadc7f25533f1edd5b598a2419e4fea2a57c5fb76cdbd6

Download Submit
/storage/emulated/0/Android/data/com.snssdk.api/cache/clientudid.dat

Filesize
36B

MD5
a93b19468f7a5248fb273a968d5c11ba

SHA1
fa5e2f575eff378ae1dd9265ff4bdf605253f3e8

SHA256
cf85f7409431b1a4c4a809a010e9fe4f2a0bc9270dbf38f3bd0c12f4c8d0d29b

SHA512
c231e8d6e8920cb00aa1fd65031e5458905663c67503bf0875c52647b10803f0af421ac4c31401f5d188421fcdca55cc9b024a7c008d41865d83466d74b41f8d

Download Submit

Analysis

Sharing