59cd65b98cbdcb676c4780a0a1a7ed77f0b9ffb7d4704c8add4f0340843e4fda

Analysis

max time kernel
19s
max time network
138s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
23-05-2024 10:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a9b11b2f09c7ff1f1a28873ae6aaad5_JaffaCakes118.apk
Size

5.1MB
MD5

6a9b11b2f09c7ff1f1a28873ae6aaad5
SHA1

820bd209885ca115a7129137d96563d67cbb49a9
SHA256

59cd65b98cbdcb676c4780a0a1a7ed77f0b9ffb7d4704c8add4f0340843e4fda
SHA512

efa31859f9454a71f0b5e3a06f8702fc4eb82aeb1b8f10d7d828178531705b6d2ee7f2c58bfbf441b7055359c6ac29acfe10697143483ab3e13fc71d2d6e2990
SSDEEP

98304:79MGDhFGgklKXqeHOuUML/dETNCz0wHld4JsuidNkow/fxCJoU9Dmu:7iCbBUoZH/UMirWH7knwJoWd

Score

7^/10

discovery evasion impact persistence

Malware Config

Signatures

Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.rarlab.rar

description ioc process

File opened for read /proc/meminfo com.rarlab.rar

description	ioc	process
File opened for read	/proc/meminfo	com.rarlab.rar

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.rarlab.rar/cache/1582435991586.jar --output-vdex-fd=48 --oat-fd=49 --oat-location=/data/user/0/com.rarlab.rar/cache/oat/x86/1582435991586.odex --compiler-filter=quicken --class-loader-context=&com.rarlab.rar

ioc	pid	process
/data/user/0/com.rarlab.rar/cache/1582435991586.jar	4364	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.rarlab.rar/cache/1582435991586.jar --output-vdex-fd=48 --oat-fd=49 --oat-location=/data/user/0/com.rarlab.rar/cache/oat/x86/1582435991586.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.rarlab.rar/cache/1582435991586.jar	4327	com.rarlab.rar

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

com.rarlab.rar

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.rarlab.rar
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

com.rarlab.rar

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.rarlab.rar

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.rarlab.rar

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.rarlab.rar

com.rarlab.rar
1⤵
- Checks memory information
- Loads dropped Dex/Jar
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4327

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.rarlab.rar/cache/1582435991586.jar --output-vdex-fd=48 --oat-fd=49 --oat-location=/data/user/0/com.rarlab.rar/cache/oat/x86/1582435991586.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:4364

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.rarlab.rar/cache/1582435991586.jar
Filesize
9KB

MD5
e8e0527a01aefdb89afd2c508f131da1

SHA1
f1103e6b260c657ceb3d95f1b023af3fda8b133a

SHA256
f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce

SHA512
fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34

Download Submit
/data/user/0/com.rarlab.rar/cache/1582435991586.jar
Filesize
20KB

MD5
2048eb6124a452540ee51dae4145aadf

SHA1
d05005b2cd7fe4cd652b0d7fd1bdac2c19d51451

SHA256
105c54b6fe3f25350e92187467761598e4c21d62b1091b77d091f65f3bd98864

SHA512
bb6cb3853dd2a5d0701e20607d4e153ae201268dd2e5e2d06cc2df208b3b4dc50132a4ab428251b1644d2399fcc717662438d082ff14203387bab8794109d44d

Download Submit
/data/user/0/com.rarlab.rar/cache/1582435991586.jar
Filesize
20KB

MD5
fde2ee00cbd121cfab5290b078aa3ceb

SHA1
e2b77d5320e155e413d040a8c20020962065b2f8

SHA256
2897b0812077c654a9b3fbb0b6303d5cde681eeba7ad9981de65716c7810d685

SHA512
a9326aff8e454a2b4ac09984ef2a65fddd4dc146b4c44d839035549bff8c9fdaae490326d0b018f76c1ca2e4fb25426d74f550ca0950982fba632a023af99a56

Download Submit