ab502b175e52657c1c18ffc778657b80f4a57d05f50ffd4bfe23aa8d6593af60

Analysis

max time kernel
179s
max time network
145s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
22-05-2024 20:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

688ef7cf954d56e3995681f7d4e3a0bf_JaffaCakes118.apk
Size

7.0MB
MD5

688ef7cf954d56e3995681f7d4e3a0bf
SHA1

5fcb85d659e0086732d7918c90e8783a4bb3b488
SHA256

ab502b175e52657c1c18ffc778657b80f4a57d05f50ffd4bfe23aa8d6593af60
SHA512

4f35086b6b7f8c683e066e51ded183b9411f6b5ba010753380ffd4046610c62222a445c81b8c2383a2c27aad8eb82e58a373b838bb2abc973b1c0210540c1a67
SSDEEP

196608:NT8rJbzS2KCY1YU+rtc9DY3EGLAaRiUWDSFSLxY:w5zS2s+U+rtcBBaRivOsLxY

Score

8^/10

banker discovery evasion impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs
evasion

System Information Discovery
T1426

Processes:

com.mobileann.MobileAnn

ioc process

/system/bin/su com.mobileann.MobileAnn
/system/xbin/su com.mobileann.MobileAnn
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.mobileann.MobileAnn

description ioc process

File opened for read /proc/cpuinfo com.mobileann.MobileAnn
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

Foreground Persistence
T1541

Processes:

com.mobileann.MobileAnn

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground com.mobileann.MobileAnn
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

System Network Connections Discovery
T1421

Processes:

com.mobileann.MobileAnn

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.mobileann.MobileAnn
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

com.mobileann.MobileAnn

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.mobileann.MobileAnn
Acquires the wake lock 1 IoCs

Processes:

com.mobileann.MobileAnn

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.mobileann.MobileAnn
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

com.mobileann.MobileAnn

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.mobileann.MobileAnn
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

com.mobileann.MobileAnn

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.mobileann.MobileAnn

ioc	process
/system/bin/su	com.mobileann.MobileAnn
/system/xbin/su	com.mobileann.MobileAnn

description	ioc	process
File opened for read	/proc/cpuinfo	com.mobileann.MobileAnn

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	com.mobileann.MobileAnn

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.mobileann.MobileAnn

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.mobileann.MobileAnn

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.mobileann.MobileAnn

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.mobileann.MobileAnn

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.mobileann.MobileAnn

com.mobileann.MobileAnn
1⤵
- Checks if the Android device is rooted.
- Checks CPU information
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4300

su
2⤵
PID:4328

su
2⤵
PID:4348

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.mobileann.MobileAnn/databases/ms_tr_gprs_db
Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.mobileann.MobileAnn/databases/ms_tr_gprs_db-journal
Filesize
512B

MD5
0f6afeef1d8768be780116029a0ebc6b

SHA1
90cb7b66c5149bfee18840e2c8c7c7b292e6fbe8

SHA256
dd9708f00573abb5a307ce5ccd84664c6b2e26bdf929f763425eebaad0472fdc

SHA512
d90632ed295e882487179d8edc4c08566d75165fc03e055f69cb9bd681c15db4cd90afc9e2baa31e9bf8995c4d6e55753351b0d6cbff385918e90d22f9ba8d2f

Download Submit
/data/data/com.mobileann.MobileAnn/databases/ms_tr_gprs_db-shm
Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.mobileann.MobileAnn/databases/ms_tr_gprs_db-wal
Filesize
193KB

MD5
f4cf6a21bda3de759c078b058dfa3329

SHA1
b8b6f1e6e7c8126720c56e8b68969327acb5da81

SHA256
12b2afea55643e0a5e72a730fe5f71fa11196fb674b092387f3aa1790755b4c1

SHA512
54d0bab3172034089985acc9b00b34016c05b519a49e067a168fd68f017a815d6f8395542cdb173ad7231352ac39d7f26da24d0087f76a277d00e532333f33b2

Download Submit
/data/data/com.mobileann.MobileAnn/files/libndkutils.so
Filesize
17KB

MD5
c047c371516e2c67ae77e0a366593044

SHA1
793aab3b0440ba50b1321acba3c9d5de55cf703f

SHA256
07275e4338624a6ef2718fd62c2fcb53a334a9747e068f60817cd382fcf282b3

SHA512
4638f5f65fd20d8e9bff04064fcdc18e287e4d784706e31f5573b6587414a04173e1d28c22303e5876c6cda66f52ffd6d71291d6fecbb2929ffba2329b42ca67

Download Submit
/data/data/com.mobileann.MobileAnn/files/mobclick_agent_cached_com.mobileann.MobileAnn
Filesize
122B

MD5
404cff0fb03034821dce316ac01f7e07

SHA1
ef6567c2242235708706ee4e1f976c6ef5226c49

SHA256
aa0003eb13d40202380d73cbefa427219e40537e0f0654821ed136427579ae44

SHA512
af27521c60f3d8db5d6180405bb2914570ec7eae8b07f9d9a5e109375c16ec9572722f8f9350ce6ff935eab4455345ddf5c39409e3675017861cf3045d53ec8b

Download Submit
/storage/emulated/0/.AgooSystemConfig/AgooCommon.xml
Filesize
111B

MD5
bb6e324607a1e51289d3fc5bfe18ad46

SHA1
93075aa99361730e0337a652fa215004d075f12a

SHA256
9a75b495f3147ff21865dd86cc2daba80e9811e0d0f00a1a358921d86868e238

SHA512
6476a279086d7367bd782c3da2873dbb1fcd0ed6f5b8731dc9ef888f0a558b63c67e5c3a39c405136ccf9248557222cff430d30c4fba9d72e022306faa6efd28

Download Submit
/storage/emulated/0/.AgooSystemConfig/AgooPackage.xml
Filesize
111B

MD5
cdeb342d406abf111d9d5beb2ed8e2d3

SHA1
78a024dfb3c348b4a5a45922804a7fbd20afeb75

SHA256
4f43409a8c919a4b2ce101fa7d704cc4d4ab00bb634843bd874bef9764628ae4

SHA512
48a74f9ffbfaa4750361c7644aa000a5cedc5939acb525b9fa1fe07f64c338333f27cb122c70243dd89a1cba83073d25d7bbaf1e1e7558c7222b7d19cdfcc4e1

Download Submit
/storage/emulated/0/.AgooSystemConfig/AgooPackage.xml
Filesize
626B

MD5
d7aac6f7558f944b56585635ccf9ff2f

SHA1
60a5f88882961333f68ea9fd855436dd4fb4263f

SHA256
ad5b666f76a88f5c448a33375654197ea6caeaa39eb16f479cba188ab0a5e3d5

SHA512
8a8cec994ce3c2cd9b79cbb98a82686df1da13f39b4a1f19c4336a00ba765175d0d1822092c28032f60c2380a1bd32ac5028563936e33fb52d604611c3dd5b84

Download Submit
/storage/emulated/0/.DataStorage/ContextData.xml
Filesize
111B

MD5
156bbea3203d8ed0178b61962b45e760

SHA1
942326e9993bd544644a996a5111a5d46a8401f1

SHA256
78708c2d397083dbc18ec1701cb7cfede312b6f3ab3027ec33e2eb79f909b62c

SHA512
b17554748d493dd9cc21fb7f38e7f30d745152844d7f3f1f22b71315fe2a43019bf0d16270b6d1c4ff525570553c5dda89411b58ddd5f9f94492718fc18f6f4e

Download Submit
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Filesize
381B

MD5
003ff1c0b29ab5846835d547a43c8fad

SHA1
661268f92c8f346e3c89df0b62eac4ec480ad53c

SHA256
3821f9f1c4f146ab984e562325cf6406d0b7224468a8ee711abe784b4b8c2f8d

SHA512
7ff23c4211b102450bd0461250c55198baec1ef5dc961ed1f6078348557ddb5a4ac53f234caafceb7b3f74f68a5df8d493fc4d37c975f0ba2c0cd633b95abe62

Download Submit
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Filesize
65B

MD5
9781ca003f10f8d0c9c1945b63fdca7f

SHA1
4156cf5dc8d71dbab734d25e5e1598b37a5456f4

SHA256
3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793

SHA512
25a9877e274e0e9df29811825bd4f680fa0bf0ae6219527e4f1dcd17d0995d28b2926192d961a06ee5bef2eed73b3f38ec4ffdd0a1cda7ff2a10dc5711ffdf03

Download Submit
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Filesize
111B

MD5
30f9b54f39ef36c5578317179310d0b8

SHA1
4d5aa0aa973de67003ee8a698b6f3f85c6e2a021

SHA256
ec34310aea9f01fc0fb2babb90e5faa627108bc341ff6070f49d62ca6d90b837

SHA512
2a79d671860c94ff7d9b53463c626fd728254d014399fda5ac0d63248669ec367e4dab795778fe1d66d5a2024bdb8a5dfbd9bb29ff2b9b5f786f67fb90c82a3b

Download Submit