bf2cd2abde09c4f20b7b5226eaa5fa4a33fa63aa19cdb761ddf5c7fe367ba40d

Analysis

max time kernel
11s
max time network
155s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
23-05-2024 22:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6c768eacc57dc83698cedf5106918792_JaffaCakes118.apk
Size

1.7MB
MD5

6c768eacc57dc83698cedf5106918792
SHA1

d536d5a5b4c8f35cd28aa7e73bb104dafedd431c
SHA256

bf2cd2abde09c4f20b7b5226eaa5fa4a33fa63aa19cdb761ddf5c7fe367ba40d
SHA512

cba338a85ba195c221908a431b1bc1b62e950e60f8cb18e0df4549382819ecad7bc4d067f8e28dad6784bb18f13504e85c7b3db4f6900b53de4452ad95fa508a
SSDEEP

24576:at4AEaFKhdX3EnsyWGFZn0Wt9PpckoEpFqV6+CaacDjAO02OZGpUgWN1HxnP8I2F:baFUUnFYyrpF66+NDEHZXgWNTnkKC

Score

8^/10

banker collection discovery evasion impact persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

T1418.001
Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
collection discovery evasion

T1430

T1627.001

Processes:

com.rec.ifnuss

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.rec.ifnuss
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
evasion discovery

T1633.001

T1426

Processes:

com.rec.ifnuss

description ioc process

File opened for read /proc/meminfo com.rec.ifnuss

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.rec.ifnuss

description	ioc	process
File opened for read	/proc/meminfo	com.rec.ifnuss

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

T1407

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.rec.ifnuss/files/lauc/WqsmSKDVlY.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.rec.ifnuss/files/lauc/oat/x86/WqsmSKDVlY.odex --compiler-filter=quicken --class-loader-context=&com.rec.ifnuss/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.rec.ifnuss/files/Plugin2.apk --output-vdex-fd=59 --oat-fd=60 --oat-location=/data/user/0/com.rec.ifnuss/files/oat/x86/Plugin2.odex --compiler-filter=quicken --class-loader-context=&

ioc	pid	process
/data/user/0/com.rec.ifnuss/files/lauc/WqsmSKDVlY.jar	4373	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.rec.ifnuss/files/lauc/WqsmSKDVlY.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.rec.ifnuss/files/lauc/oat/x86/WqsmSKDVlY.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.rec.ifnuss/files/lauc/WqsmSKDVlY.jar	4284	com.rec.ifnuss
/data/user/0/com.rec.ifnuss/files/Plugin2.apk	4411	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.rec.ifnuss/files/Plugin2.apk --output-vdex-fd=59 --oat-fd=60 --oat-location=/data/user/0/com.rec.ifnuss/files/oat/x86/Plugin2.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.rec.ifnuss/files/Plugin2.apk	4284	com.rec.ifnuss

Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

T1424

Processes:

com.rec.ifnuss

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.rec.ifnuss
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

T1421

Processes:

com.rec.ifnuss

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.rec.ifnuss
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

T1422

Processes:

com.rec.ifnuss

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.rec.ifnuss
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

T1422
Reads the content of SMS inbox messages. 1 TTPs 1 IoCs
collection

T1636.004

Processes:

com.rec.ifnuss

description ioc process

URI accessed for read content://sms/inbox com.rec.ifnuss
Reads the content of the SMS messages. 1 TTPs 1 IoCs
collection

T1636.004

Processes:

com.rec.ifnuss

description ioc process

URI accessed for read content://sms/ com.rec.ifnuss
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

T1624.001

Processes:

com.rec.ifnuss

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.rec.ifnuss
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

T1421

Processes:

com.rec.ifnuss

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.rec.ifnuss
Reads information about phone network operator. 1 TTPs
discovery

T1422

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.rec.ifnuss

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.rec.ifnuss

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.rec.ifnuss

description	ioc	process
URI accessed for read	content://sms/inbox	com.rec.ifnuss

description	ioc	process
URI accessed for read	content://sms/	com.rec.ifnuss

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.rec.ifnuss

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.rec.ifnuss

Requests dangerous framework permissions 10 IoCs

Processes:

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Required to be able to access the camera device.	android.permission.CAMERA

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

T1471

Processes:

com.rec.ifnuss

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.rec.ifnuss

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.rec.ifnuss

com.rec.ifnuss
1⤵
- Requests cell location
- Checks memory information
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Reads the content of SMS inbox messages.
- Reads the content of the SMS messages.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4284

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.rec.ifnuss/files/lauc/WqsmSKDVlY.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.rec.ifnuss/files/lauc/oat/x86/WqsmSKDVlY.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:4373

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.rec.ifnuss/files/Plugin2.apk --output-vdex-fd=59 --oat-fd=60 --oat-location=/data/user/0/com.rec.ifnuss/files/oat/x86/Plugin2.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:4411

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.rec.ifnuss/app_dex/utopay.jar
Filesize
30KB

MD5
eb6089c1acfa9f12535e533aebee845e

SHA1
165e39ee07dcd9ed00fc2dc1ff466bc1d6b813c9

SHA256
b825cde84e3dddfc147c71265d2259c422d51a7e56d1dcdba1321e3119b1df07

SHA512
5b1bc26bcbcf05fc331865fb4dd572b673a52650d68ab4d9b028ea15219e0d93c1ec17996953436801913388d78e25c67ea33aa93544d65e96a799eb06cc70f5

Download Submit
/data/data/com.rec.ifnuss/databases/740410100062013
Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.rec.ifnuss/databases/740410100062013-journal
Filesize
512B

MD5
e22df7d35c0d5ec9d3d6d10cbeaaac74

SHA1
1b3c66ff87923d76223f6746bd3144ab06a8b223

SHA256
388438dc0d9d75148ba6902343b1273264323e261d6c4e3b1146a7010f014fc6

SHA512
4b92944320e7bd506f1daaed2c665ff6e06168fcf9a173d7a1662536be38d48724d381cf5b39413300ac998d1fc066d98a7147e48fa3319b047d146fd6df58cb

Download Submit
/data/data/com.rec.ifnuss/databases/740410100062013-shm
Filesize
28KB

MD5
cf845a781c107ec1346e849c9dd1b7e8

SHA1
b44ccc7f7d519352422e59ee8b0bdbac881768a7

SHA256
18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

SHA512
4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

Download Submit
/data/data/com.rec.ifnuss/databases/740410100062013-wal
Filesize
140KB

MD5
a6ee0afc5a0f8186ab9191a93e32a2aa

SHA1
6028424c0689454682a2724a04a8a757b1ae5106

SHA256
64e90775a9c1e6b0bc1bd325398d569ad7f28423d7c44728bb4448af8944b5e4

SHA512
9d36ef3cc0a35424c649d346c6faa7fa2ccf21a343ab335a5cdbee57734415a391f7c9d496bf760cd478bcbf13c9949b21e457e0c715c352b05d0d9481f4d060

Download Submit
/data/data/com.rec.ifnuss/databases/wochi_v4.db-journal
Filesize
512B

MD5
fac5b1eb8617464fb72dd5d68cdb3153

SHA1
ce461c86751fe6a2949eac0f91cc92dc258ae866

SHA256
1db29a58fd5b4865b5b94a18ce7a762604b658fe68cce5dff9eed0c180b0fa2c

SHA512
e61a78dcca169d81570644a86124dfe6c699193cec7f78e970e2d49a895f4be8ce330dba469bab5f8ad8ac9e7cc3adbce8e948f08b8815bf1c10e67fbb18c830

Download Submit
/data/data/com.rec.ifnuss/databases/wochi_v4.db-wal
Filesize
20KB

MD5
3f57835a27a3ca07a0492a20a4276fa4

SHA1
e78c2908945d5ff5850a1a1a8d6bb70570a64231

SHA256
8d2e5e8442d9885864a127e6de221c9609e4b381fcd01951e7b59d61dde3f115

SHA512
81e386150950e68d28cfa516f57d4adf881c778e645c2aa8343f3aa3f29b497c4c306d5f07bd19f7cbefb0c844f563a51a889e1930d0a1090ab16d6ecf52f491

Download Submit
/data/data/com.rec.ifnuss/files/Plugin2.apk
Filesize
99KB

MD5
3d216f8fddb9705a6720a285475837f1

SHA1
f053d23b284bfe2faf6e76d353ff052471e2de2c

SHA256
de7bf40574754a5144fa5cf3bc5e97f7adc7f5abebb18c41e8f0631917db4c0c

SHA512
38be39da8f96abc87109cfd57b2d63ddfa72971f023024a5b4ce1f97cd905a96a94e19eea19ae9b745f28d02c6689a4473627ce57ec85dce2018a77e699620cb

Download Submit
/data/data/com.rec.ifnuss/files/lauc/WqsmSKDVlY.jar
Filesize
788KB

MD5
dc09e948ed01454658945c16478d7685

SHA1
83932f889e374eed98a198336cc5c43b6528e5fa

SHA256
cf5bc530cfa03e2d17ab8c9007e76ed6ae160ddb21fbcdd2e28811a6f21e1811

SHA512
9bc9acb81ded6662e87a91b46805af96c8e8b72f971184d75e462b5d7c2f4aebe625ee54fa14e48ba0b7ff0dc950b28b95ee79ec22585868e4331e3aa142091b

Download Submit
/data/data/com.rec.ifnuss/files/log.dat
Filesize
221B

MD5
ff9229f8e7c92d44d48e25206d43b021

SHA1
be3d75050c16c5b7484652ba292fdd6510f205d3

SHA256
77fc3599be409f7e73e643de843c0ebcfa20662964c498fc59e245c7f5e003a2

SHA512
be7b3aa8d670a2873c6b7bfd4ca93121fd2450723cbbc36d9d06d152fafa3ce90451f0a60ab56bc96bccb81cf5aae0167b404073db14dc17b9513ac73d455c58

Download Submit
/data/user/0/com.rec.ifnuss/files/Plugin2.apk
Filesize
201KB

MD5
ef019d14367b7346b1ae2419e9d445c8

SHA1
23d81fcf81f3a9f2a991ba4d0d135fe2a28aa188

SHA256
1d83642ede6b16a071676e895f547d056543b5b4622bbc9b9b4ab45e47bf9ba0

SHA512
ea582f21c6054c37c679c798e93116c9c18c9544c0feb78fb949bed7b2cd3122c8d7bb8ecef329829c2531764abeb6200f0af49ede97c3b0b7448bdb65a34a60

Download Submit
/data/user/0/com.rec.ifnuss/files/Plugin2.apk
Filesize
201KB

MD5
2a425e0fae74f20a2c475da937a619a2

SHA1
4d701c7e6d828aa96ba8a493720e7282c49ec741

SHA256
2c61a25f1ad5783bf82eea9faa2536cac4788ed3147bc1864d9ef17ea01be6a7

SHA512
44c8d2a837b606de99055badbd4b5e708424ca9809b1583d13aefadc4d4af974658dc3a3f179fc3047eef7167151c638ff66dd6c8d38121b6ecdfb464d2a5a60

Download Submit
/data/user/0/com.rec.ifnuss/files/lauc/WqsmSKDVlY.jar
Filesize
2.3MB

MD5
da5e47fdc327c117deac4a1c79c4e256

SHA1
67a0f34fe6874b9fdbdb155b6b86e8a6348b179b

SHA256
8d73ff7ac677f61d7a878f9f2a07a7f253339a2823f3d7e035f4bfe7642dee13

SHA512
8a951b672b98a91cfbb428e5280af5592975e6f847667a85931c48628342dc464901aec2e2542173deb56f5d59e5529737fe551d94cd143c9f74be3250dc4ff3

Download Submit
/data/user/0/com.rec.ifnuss/files/lauc/WqsmSKDVlY.jar
Filesize
2.3MB

MD5
ff68967e1fdef9f8d9fdf476d9758759

SHA1
3ffd45294f6456495c41a57117cfbd9fdfb7b09a

SHA256
9b52efb66379b55c3944c56094d32254a0b60aa3a6c117496b1382bbe3afe5d8

SHA512
d34f99b9dcacf7362c1b469b7371aee9c6b859da577788249318b5e11adc9685cac81c622db264fbea62cd99414e5414a590774496657b4a389afc21f365b8bf

Download Submit