180651eb20478bc35465a031729598ef62eb2f824e0aadfc85154e666ae6e85a

Analysis

max time kernel
13s
max time network
150s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
22-05-2024 21:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68ac957cc56811dce9de88807d68c21c_JaffaCakes118.apk
Size

26.1MB
MD5

68ac957cc56811dce9de88807d68c21c
SHA1

4f068a094396cd596cdc5aa6ada3fb06cbe7fed0
SHA256

180651eb20478bc35465a031729598ef62eb2f824e0aadfc85154e666ae6e85a
SHA512

13e2d1435564cc8f433d5feab434ee8fcba20b361fc7b2b5fe28a9cbdcc3a5024d20ba902fb889ad6de4e8977969f0b611d5920c47c17d41d6cad85123f899fa
SSDEEP

786432:KCyXQMBtfnrrHMFcML9YC37XggDYtXSht5VwwE:KpQonHH5MV37XDWihtXG

Score

7^/10

discovery evasion

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.futuregames.bombersfight/files/stares/updates/sta.jar --output-vdex-fd=61 --oat-fd=66 --oat-location=/data/user/0/com.futuregames.bombersfight/files/stares/updates/oat/x86/sta.odex --compiler-filter=quicken --class-loader-context=&com.futuregames.bombersfight

ioc	pid	process
/data/user/0/com.futuregames.bombersfight/files/stares/updates/sta.jar	4347	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.futuregames.bombersfight/files/stares/updates/sta.jar --output-vdex-fd=61 --oat-fd=66 --oat-location=/data/user/0/com.futuregames.bombersfight/files/stares/updates/oat/x86/sta.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.futuregames.bombersfight/files/stares/updates/sta.jar	4267	com.futuregames.bombersfight

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.futuregames.bombersfight
1⤵
- Loads dropped Dex/Jar
PID:4267
- getprop ro.board.platform
  2⤵
  PID:4304
- getprop ro.mediatek.platform
  2⤵
  PID:4324
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.futuregames.bombersfight/files/stares/updates/sta.jar --output-vdex-fd=61 --oat-fd=66 --oat-location=/data/user/0/com.futuregames.bombersfight/files/stares/updates/oat/x86/sta.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4347

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.futuregames.bombersfight/files/stares/updates/sta.jar

Filesize
1.8MB

MD5
8ec43e10005ec4bc91c4e45b8e68e304

SHA1
66fb42cb11e77900e55cbd4a8e247841dad1c5ea

SHA256
18d90827352cf0ed3084c4f1f94d98026908f674914889e1e58c2ac5e68be63f

SHA512
6077f32c03361faa552bde6c7cb9676c6393a9b7a30a9622095e6eb93da484b29fd75edd955523c8b51d4e86fe4a19fbce5cc456f7612162dbdec76e43b563d6

Download Submit
/data/user/0/com.futuregames.bombersfight/files/stares/updates/sta.jar

Filesize
3.5MB

MD5
a76a0eec70efc99ea0ac64c07f6bec32

SHA1
8102d17f7690ba9697f1be3de7cedfb765e70d51

SHA256
aa563dff1eff005677766ff94f60884b3ca72e1b4e0e478dd8ba781269dca37e

SHA512
dff801c2e27bf4e62a1fb04f0a120a8be7f7cabc3640195dd3caacca4c6c3741eaeeb4d9e5afe151d6b8cf38684779acff4f99d37fe784329ca6b9ecfd2cd0c0

Download Submit
/data/user/0/com.futuregames.bombersfight/files/stares/updates/sta.jar

Filesize
3.5MB

MD5
f4e9864345c65cfda19a2f32209cc1ac

SHA1
a28bd5640006c97399085831a71f444cc9142123

SHA256
a908ee5efebad005c51ab86e6a47b56ea8f11b44129e149db376fa8d5eeb383c

SHA512
9b0f40b2f8eebed0817b5a1ab31ab61af2da9d2e3ae1f5b880b40552986e5bd192ed9d1c31c5fe74cf458a51e809f05300f1fade9e4c28a3517a3a1c6ffc5f7c

Download Submit
/storage/emulated/0/data/.systemid

Filesize
36B

MD5
7f46d616710dc88c259bb6eba9621488

SHA1
4344e466e3332949ccb79e5160c031e9d7441eb5

SHA256
99b239ee9a4ee9968ea8f244cd456ba3be82945a36db59a1db965d16352bb03e

SHA512
390bb42987cf9e1ba4e35cd370a140ab8e9904f0798616fcead6dd100c29b3d775958d49cf155b0e8b49cb3bf870d82a3f60df2e967e399ffae9a700211d456e

Download Submit