4c9c6ed95a93957a9a8f9adfa39ee10ef5a8da059ead5d764c06a83f81005d66

General

Target

6b0729eed8e10171ee64c1ccdd8288c4_JaffaCakes118.apk
Size

602KB
MD5

6b0729eed8e10171ee64c1ccdd8288c4
SHA1

698dd353df4a1d854fef2a701270249cdfde809b
SHA256

4c9c6ed95a93957a9a8f9adfa39ee10ef5a8da059ead5d764c06a83f81005d66
SHA512

aa3cefcca19f662d44e4cab42ba357972734b472e205d78949e8d015d3f4eed69f604a292a9713f9f35885c52fc537fcb16c219239e791bf15f0af7d741be38f
SSDEEP

12288:EEaFZvkGGNUuWW1NVwCKn6GAx1d9H1BY+0aTBpqSol2KpElpX79Iyb:EEaFmFN9v46flH72wOSoMKA9Iyb

Score

8^/10

banker collection credential_access discovery evasion impact persistence stealth trojan

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

Suppress Application Icon
T1628.001

Processes:

feifei.shasha11.meta.face

pid process

5064 feifei.shasha11.meta.face
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

feifei.shasha11.meta.face

description ioc process

File opened for read /proc/cpuinfo feifei.shasha11.meta.face
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

feifei.shasha11.meta.face

description ioc process

File opened for read /proc/meminfo feifei.shasha11.meta.face
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
evasion

Download New Code at Runtime
T1407

Processes:

feifei.shasha11.meta.face

ioc pid process

/data/user/0/feifei.shasha11.meta.face/app_ttmp/t.jar 5064 feifei.shasha11.meta.face
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
collection credential_access impact

Clipboard Data
T1414

Transmitted Data Manipulation
T1641.001

Processes:

feifei.shasha11.meta.face

description ioc process

Framework service call android.content.IClipboard.addPrimaryClipChangedListener feifei.shasha11.meta.face
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

System Network Configuration Discovery
T1422

Processes:

feifei.shasha11.meta.face

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone feifei.shasha11.meta.face
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

feifei.shasha11.meta.face

description ioc process

Framework service call android.app.IActivityManager.registerReceiver feifei.shasha11.meta.face
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

feifei.shasha11.meta.face

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo feifei.shasha11.meta.face
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

feifei.shasha11.meta.face

description ioc process

Framework API call javax.crypto.Cipher.doFinal feifei.shasha11.meta.face

pid	process
5064	feifei.shasha11.meta.face

description	ioc	process
File opened for read	/proc/cpuinfo	feifei.shasha11.meta.face

description	ioc	process
File opened for read	/proc/meminfo	feifei.shasha11.meta.face

ioc	pid	process
/data/user/0/feifei.shasha11.meta.face/app_ttmp/t.jar	5064	feifei.shasha11.meta.face

description	ioc	process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	feifei.shasha11.meta.face

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	feifei.shasha11.meta.face

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	feifei.shasha11.meta.face

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	feifei.shasha11.meta.face

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	feifei.shasha11.meta.face

feifei.shasha11.meta.face
1⤵
- Removes its main activity from the application launcher
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:5064

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Hide Artifacts

1

T1628

Suppress Application Icon

1

T1628.001

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Clipboard Data

1

T1414

Discovery

Software Discovery

1

T1418

Security Software Discovery

1

T1418.001

System Information Discovery

2

T1426

System Network Configuration Discovery

2

T1422

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Clipboard Data

1

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1

T1471

Data Manipulation

1

T1641

Transmitted Data Manipulation

1

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/feifei.shasha11.meta.face/app_ttmp/oat/t.jar.cur.prof
Filesize
389B

MD5
5fcb77b3e534fd0bfe3592fb52efe2d0

SHA1
1eccb275d4037943ec2856bb22897a91119a4ca2

SHA256
fbe9ef457bde9653089769e33ecab4691eabfe69084d3d1fdd9d78ed465ec3a6

SHA512
93ef48f3d2f74eaae37ca20de7318be2126c76867f8416e770bcd23c8669a0bc34656f28edadb957c29aa2302c5293ba8998c1abee2d6e97c55cefd78979d38d

Download Submit
/data/data/feifei.shasha11.meta.face/app_ttmp/t.jar
Filesize
276KB

MD5
9aaea567e0c93e51718ba7eade0e83df

SHA1
0005116aad1779361b70093db00fed5ac090ae23

SHA256
b30a95dff6f65f444472971c8aaf895ffc8e66e0117ce242ec4cb8a8a519a5ec

SHA512
2aef1034335d8752f4e25ce6c5823ce03019536cc6e51ee61b5291c77a0f356a2517e0cbe7f2c4cc2d897115dc856449a342cfdc247c9d34d313187d15b2f890

Download Submit
/data/data/feifei.shasha11.meta.face/databases/feifei.shasha11.meta.faceb
Filesize
72KB

MD5
898fd3bd86b0993251367d00aff5a92b

SHA1
c6187fb7ec76961daf1cbb1ad28d47df816f5c96

SHA256
893988bcdf04c6cdc9b0ec7350411e555d055e01271d1494b8b4cae18ae8033a

SHA512
4c4ae636674e12c5bba4fa43d2cd5daa1c9b6f7a9718cc9ebebe6ca2db85d37fabfe3a470e73c64becac133e15b42883b54f4488bddbdbe85ff5f1c47aa6708f

Download Submit
/data/data/feifei.shasha11.meta.face/databases/feifei.shasha11.meta.faceb-journal
Filesize
512B

MD5
48e89b9478973d281e2c0b23a8e625d1

SHA1
f5ea7ee88286674ee16174610e6461b74bb260fa

SHA256
099e728b9647c488e72d9985a5089432d870da85876405d990c05a5e27f42032

SHA512
ec238438a4443f7cfdd3cd9021917449c28f0c44670958af04af096792462d48bdb62d83c242ce37f611c310ed2051fe860995fb7007331f79083aa01821186d

Download Submit
/data/data/feifei.shasha11.meta.face/databases/feifei.shasha11.meta.faceb-journal
Filesize
8KB

MD5
d69e2b99e2d077c556fa8034f305cb7a

SHA1
d11de269f1570d1b20b04499494cc7c0fb1bba99

SHA256
9447d1848c0ed45160f49bd418a193b06cfd5f47b4ef6f1ddc4ef4d22462d2b6

SHA512
b1fefe0c289357da39c9f489a7ec17062dd0d19f2fa81b18e21a1b7d824595d33e63347d62bbec410ee9ed798e729242afad911ac9fdbae2d705413a252ce70f

Download Submit
/data/data/feifei.shasha11.meta.face/databases/feifei.shasha11.meta.faceb-journal
Filesize
8KB

MD5
642eff279b9db89c1f1803fba189a3c5

SHA1
8a4eae00b5b936c6a04272789fcae185b73e63f9

SHA256
86ce3d5c2747e96b4c94608dd26d5d071617b9d683914c384a271f4ba563b065

SHA512
4f293afcf701ecb87bf84081b9c2823b7a644a0290b7d93142866dbd1649bdc655e335b1a9086920985cade9e6c3097aed030dae31ce77e55df5213d17316b4a

Download Submit
/data/data/feifei.shasha11.meta.face/databases/feifei.shasha11.meta.faceb-journal
Filesize
12KB

MD5
f2d847884677c28ce3cbaf4f426e439f

SHA1
363588d4766ae9eeefd1880c33fd21bdc64fc2a7

SHA256
593e9e3f39ab8264fe8f20afc07d5ef9b99418c4eccb94cb8cb12945401dcb8e

SHA512
0dd4830d645dc744ec154bd8f46b93864d6ead4ce261298f9afeb793cec0dd99a3310f442e5146941655155a3a65896debe2ec9ce5e9e0782bf05209b43aedc8

Download Submit
/data/user/0/feifei.shasha11.meta.face/app_ttmp/t.jar
Filesize
587KB

MD5
f72c3d07507c3e26d317e9117ba757d1

SHA1
cdede4739e9dd9fd95243aab5e44c24f93f825c3

SHA256
1c65834d9ca018c6496a8b9957589d0e94657911b6635dc21a448d78f9238887

SHA512
3420714252e7503abc13c99274d767b0bc08671d769460dc61823ab9470e145fb75c5dfaadc617d3a05cf251ed5ecf38ea7e8c1d7b343bca4d7e8296f1b805d4

Download Submit

Analysis

Sharing