7fd6b1fa1eef7be554903634b0dd839357df3655332da5fc8d349c81329e16b4

Analysis

max time kernel
10s
max time network
132s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
23-05-2024 08:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a4c032ed7130c8666ae0d85a4e2ec4b_JaffaCakes118.apk
Size

10.5MB
MD5

6a4c032ed7130c8666ae0d85a4e2ec4b
SHA1

eb6708ad1ab72a72d5b56fee44e1881800cb0189
SHA256

7fd6b1fa1eef7be554903634b0dd839357df3655332da5fc8d349c81329e16b4
SHA512

1b79e3c203c61f1bf89c703b7ccee2816dc6977ac4b90281bcb62725a429a30f3730cde577b0db86f1d929bdec668006eed2b22c1dbef33f54be21080a77cc5a
SSDEEP

196608:9wAy12lsHI+pRqUgjCMlWDnQR+u0xCdi887VSSCdT4Hz+ienyBP:vyGsRMYMlKQR+u0xC87QSCdTwyieoP

Score

8^/10

banker discovery evasion persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

T1418.001

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

T1424

Processes:

cn.buding.martincn.buding.martin:pushservice

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	cn.buding.martin
Framework service call	android.app.IActivityManager.getRunningAppProcesses	cn.buding.martin:pushservice

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

T1421

Processes:

cn.buding.martin

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo cn.buding.martin
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

T1624.001

Processes:

cn.buding.martin

description ioc process

Framework service call android.app.IActivityManager.registerReceiver cn.buding.martin

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	cn.buding.martin

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	cn.buding.martin

Checks if the internet connection is available 1 TTPs 2 IoCs

discovery

T1421

Processes:

cn.buding.martincn.buding.martin:pushservice

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	cn.buding.martin
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	cn.buding.martin:pushservice

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
evasion

T1628.002

Processes:

cn.buding.martin

description ioc process

Framework API call android.hardware.SensorManager.registerListener cn.buding.martin

description	ioc	process
Framework API call	android.hardware.SensorManager.registerListener	cn.buding.martin

cn.buding.martin
1⤵
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:4266

cn.buding.martin:pushservice
1⤵
- Queries information about running processes on the device
- Checks if the internet connection is available
PID:4313

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/cn.buding.martin/databases/martin
Filesize
144KB

MD5
5846b06cf8407973f02331ffcdf14b7b

SHA1
c52c66c748fa94974e7fa86b69f8e0fabb19b15a

SHA256
91bc7529b1f3a54aabf3dfad4f497a0c610f276df5f39846401274b610ae153a

SHA512
63751959c15bc343c7ee5f41b6f9fae3a76a54a015cac8e8c247eb4f5b978d1cf752bf4aa2726e6a3dce383a82af202f7c18175deee289717bd4eaf2e2a55223

Download Submit
/data/data/cn.buding.martin/databases/martin-journal
Filesize
512B

MD5
7ce0d609d35802f3b21ba8355703488e

SHA1
a67ce4898e0e9613af00c95b84bcd3b3770dd1ad

SHA256
ad0748e4fb245799dc00e39ed9f2aa26d89ab6e9bc8811ef02c2ee3f1a38c015

SHA512
b12ef015e15c3e31f47959cd766a80fc1093c84e8eb8498d9639d6bf57a4ac19165dcdc049a8532dfb37980b3165a80cd3570b5314dc451176fce7ec984dcb87

Download Submit
/data/data/cn.buding.martin/databases/martin-shm
Filesize
28KB

MD5
cf845a781c107ec1346e849c9dd1b7e8

SHA1
b44ccc7f7d519352422e59ee8b0bdbac881768a7

SHA256
18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

SHA512
4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

Download Submit
/data/data/cn.buding.martin/databases/martin-wal
Filesize
156KB

MD5
6dab879add29e9a71b3a130a26c2704a

SHA1
72dbe3548dfad90a075b0d89855020e05367c2b1

SHA256
0081d02f88b41150235d9ce72d605487558116994c81483547a1773218e43153

SHA512
1568cdb5de6098ca96f6a45d34f815e1342a0c5ded4fbd6c96f6009a485932b94cb4133d8d66db199f11e1599d39d873bb7ce56068bbdd91c51a1355d1b137ba

Download Submit
/storage/emulated/0/cn.buding.martin/temp/logo.jpg
Filesize
15KB

MD5
5194cc9e7a4993fd31cd99087bbd7b62

SHA1
850e329688f2fde0dc975f1763fc99ba3c0140a8

SHA256
2f9073391c979d05194c9d7251f8bc3058dc35e58b69c1ed3a71a633152b13b6

SHA512
f37cbf4c18e6194b305e5bbd00097c34c14cd29cd383c664856c9597caf5dfbc9d26d58cc831cfeb397e9fbe7935972259125d3bc0ada4d79f45b25604cb6b05

Download Submit