a23f01237da72448b0a0db19668a8c308c4637522d7eaa785afb8ccb1aa33670

Analysis

max time kernel
9s
max time network
130s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
22-05-2024 09:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

66d4fa825bbe70d14290c8848d9a7e66_JaffaCakes118.apk
Size

1.6MB
MD5

66d4fa825bbe70d14290c8848d9a7e66
SHA1

8246c545ae513fa8712ffca4f1951937a03f50d4
SHA256

a23f01237da72448b0a0db19668a8c308c4637522d7eaa785afb8ccb1aa33670
SHA512

0d9277c0c6bbf7f2035bf523f231c79b088ba31277c1f88905f1393d9a5e4f2bd9e738945ee8ad6d028a0ad551c1fe575250bcb8d6380897cc0641586f1079d9
SSDEEP

49152:Bq/aruWmUUqU2rLaUiSYDptOQmT12MtZmYTY:cSC1uLaiYDpgQm7VY

Score

7^/10

discovery evasion impact

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.iwt.tedzml/files/less/rtvPlkKsNm.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.iwt.tedzml/files/less/oat/x86/rtvPlkKsNm.odex --compiler-filter=quicken --class-loader-context=&com.iwt.tedzml

ioc	pid	process
/data/user/0/com.iwt.tedzml/files/less/rtvPlkKsNm.jar	4245	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.iwt.tedzml/files/less/rtvPlkKsNm.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.iwt.tedzml/files/less/oat/x86/rtvPlkKsNm.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.iwt.tedzml/files/less/rtvPlkKsNm.jar	4216	com.iwt.tedzml

Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

com.iwt.tedzml

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.iwt.tedzml
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

com.iwt.tedzml

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.iwt.tedzml

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.iwt.tedzml

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.iwt.tedzml

com.iwt.tedzml
1⤵
- Loads dropped Dex/Jar
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4216

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.iwt.tedzml/files/less/rtvPlkKsNm.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.iwt.tedzml/files/less/oat/x86/rtvPlkKsNm.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:4245

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.iwt.tedzml/files/less/rtvPlkKsNm.jar
Filesize
795KB

MD5
021a14c9a68b4dce1ad2a557853d852b

SHA1
544d29e4f0d72d1acca09be5cb48912bc6b221d9

SHA256
38cd90793db76567331e53dfd81d66fda83f26c7821332f8bdd9c20dadb34de4

SHA512
7566c532ecfd4339cf9835e440ccf308f82c9b23f5b8f6fedf27cfc74e7207976d6d09620d8b648593a15c51eeb1d34e94b43cbf82995204b7beedfd1d31aec5

Download Submit
/data/user/0/com.iwt.tedzml/files/less/rtvPlkKsNm.jar
Filesize
2.9MB

MD5
9dd06fa132f4c31605776e7889df91a3

SHA1
c9a5ac001fb1d553492eae18c9f6c9c85464a143

SHA256
7da8cf9c8d707d20223ea45a304ed9833956592a949b704318932ed9fbcbe665

SHA512
142add63093ce2c40236bf6132e15581d456d79d0903c1213a20a125979fc7f62d0df4dc1de75412c1d8c6419fd8f508a06e9c2e43d915cc8d37e562e3dcff3f

Download Submit
/data/user/0/com.iwt.tedzml/files/less/rtvPlkKsNm.jar
Filesize
2.9MB

MD5
5d9aa2b3757c19de41687e710bf75da9

SHA1
898004702420c5ee65e81360997bfd361ab5682e

SHA256
a99f45c2732a7c907586f35745bf9ab1211b227c1d81b0a17b4ee8b3593426fd

SHA512
44530d5d1fd229566f01ff933871f3ae7fd254d92f81b8df4b9312743df42bd1fa4daa61e6e082f16a0a808d56ee04949c210e8ce10c6dd0e206c05018346e10

Download Submit