Analysis
-
max time kernel
4s -
max time network
131s -
platform
android_x86 -
resource
android-x86-arm-20240514-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system -
submitted
23-05-2024 04:32
Static task
static1
Behavioral task
behavioral1
Sample
69bb28f1a2167e4583477f82b3f7f428_JaffaCakes118.apk
Resource
android-x86-arm-20240514-en
General
-
Target
69bb28f1a2167e4583477f82b3f7f428_JaffaCakes118.apk
-
Size
14.2MB
-
MD5
69bb28f1a2167e4583477f82b3f7f428
-
SHA1
1bb32155d5c45afdf8102bfcd6ccd3545704cf19
-
SHA256
1c4b4b94bcdfdebdbaa722871243d96a9e5baa37755e60083fc57f7fc36ce02d
-
SHA512
7c6861f2311c5b1b761b323a8fce24e252bf09f774e27188922698457ff8fbbccbebf667dbbc835f566e4713fc48e28a519a69efdd994a6c5e3a4c6ca97dd69d
-
SSDEEP
393216:9+yOxqaHNi3cPwYJr5GYCsbgJ8gecZd/b0ebmYWrYhB7:UHA3cYorIFwebR+Kd
Malware Config
Signatures
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
Processes:
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.redplay.ninja.invincible/cache/ads9052714834174540708.jar --output-vdex-fd=92 --oat-fd=93 --oat-location=/data/user/0/com.redplay.ninja.invincible/cache/oat/x86/ads9052714834174540708.odex --compiler-filter=quicken --class-loader-context=&ioc pid process /data/user/0/com.redplay.ninja.invincible/cache/ads9052714834174540708.jar 4393 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.redplay.ninja.invincible/cache/ads9052714834174540708.jar --output-vdex-fd=92 --oat-fd=93 --oat-location=/data/user/0/com.redplay.ninja.invincible/cache/oat/x86/ads9052714834174540708.odex --compiler-filter=quicken --class-loader-context=& -
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
Processes:
com.redplay.ninja.invincibledescription ioc process Framework service call android.accounts.IAccountManager.getAccounts com.redplay.ninja.invincible -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
Processes:
com.redplay.ninja.invincibledescription ioc process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.redplay.ninja.invincible -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
com.redplay.ninja.invincibledescription ioc process Framework service call android.app.IActivityManager.registerReceiver com.redplay.ninja.invincible -
Checks if the internet connection is available 1 TTPs 1 IoCs
Processes:
com.redplay.ninja.invincibledescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.redplay.ninja.invincible -
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
Processes:
com.redplay.ninja.invincibledescription ioc process Framework API call android.hardware.SensorManager.registerListener com.redplay.ninja.invincible -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes:
com.redplay.ninja.invincibledescription ioc process Framework API call javax.crypto.Cipher.doFinal com.redplay.ninja.invincible
Processes
-
com.redplay.ninja.invincible1⤵
- Checks memory information
- Queries account information for other applications stored on the device
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Listens for changes in the sensor environment (might be used to detect emulation)
- Uses Crypto APIs (Might try to encrypt user data)
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.redplay.ninja.invincible/cache/ads9052714834174540708.jar --output-vdex-fd=92 --oat-fd=93 --oat-location=/data/user/0/com.redplay.ninja.invincible/cache/oat/x86/ads9052714834174540708.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.redplay.ninja.invincible/cache/ads9052714834174540708.jarFilesize
2KB
MD5d80f6d032778b02d10a9c9a2f1a24714
SHA1e34d4ea9618b1b499b65032723ea029ab3998500
SHA256ee2de01a238f9e1834f9f9934dd1f5b267bdf9747965641d2fd636d740041f9b
SHA51234fa52d41831142f86999ac407aafeb2b69bb4cd45ada9f739be84c80deb0414d11d6784f385eec287e4f6b5bdf29ba1c9a6a77c07707d66a73c60eb389136e1
-
/data/user/0/com.redplay.ninja.invincible/cache/ads9052714834174540708.jarFilesize
4KB
MD512670a32ad1380c9021a9e74aa5f2281
SHA17e8caf0c7a4d78452efb90958e8ce1aae5148e44
SHA256f3c142f78cadcb57d7da3d8e4dc5f8c7b05377417c639059910696c844afc1f9
SHA5121277dde373cab02d5df62732834adb79f8dbf1d1a9ac56b5b348e354317fadc24fe20b5ebdd1ecc28f8fc98dcdff807d2839bef75ef7d871e976e68a95851b06