4c9c6ed95a93957a9a8f9adfa39ee10ef5a8da059ead5d764c06a83f81005d66

General

Target

6b0729eed8e10171ee64c1ccdd8288c4_JaffaCakes118.apk
Size

602KB
MD5

6b0729eed8e10171ee64c1ccdd8288c4
SHA1

698dd353df4a1d854fef2a701270249cdfde809b
SHA256

4c9c6ed95a93957a9a8f9adfa39ee10ef5a8da059ead5d764c06a83f81005d66
SHA512

aa3cefcca19f662d44e4cab42ba357972734b472e205d78949e8d015d3f4eed69f604a292a9713f9f35885c52fc537fcb16c219239e791bf15f0af7d741be38f
SSDEEP

12288:EEaFZvkGGNUuWW1NVwCKn6GAx1d9H1BY+0aTBpqSol2KpElpX79Iyb:EEaFmFN9v46flH72wOSoMKA9Iyb

Score

8^/10

banker collection credential_access discovery evasion impact stealth trojan

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

Suppress Application Icon
T1628.001

Processes:

feifei.shasha11.meta.face

pid process

4601 feifei.shasha11.meta.face
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

feifei.shasha11.meta.face

description ioc process

File opened for read /proc/cpuinfo feifei.shasha11.meta.face
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

feifei.shasha11.meta.face

description ioc process

File opened for read /proc/meminfo feifei.shasha11.meta.face
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
evasion

Download New Code at Runtime
T1407

Processes:

feifei.shasha11.meta.face

ioc pid process

/data/user/0/feifei.shasha11.meta.face/app_ttmp/t.jar 4601 feifei.shasha11.meta.face
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
collection credential_access impact

Clipboard Data
T1414

Transmitted Data Manipulation
T1641.001

Processes:

feifei.shasha11.meta.face

description ioc process

Framework service call android.content.IClipboard.addPrimaryClipChangedListener feifei.shasha11.meta.face
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

feifei.shasha11.meta.face

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo feifei.shasha11.meta.face
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

feifei.shasha11.meta.face

description ioc process

Framework API call javax.crypto.Cipher.doFinal feifei.shasha11.meta.face

pid	process
4601	feifei.shasha11.meta.face

description	ioc	process
File opened for read	/proc/cpuinfo	feifei.shasha11.meta.face

description	ioc	process
File opened for read	/proc/meminfo	feifei.shasha11.meta.face

ioc	pid	process
/data/user/0/feifei.shasha11.meta.face/app_ttmp/t.jar	4601	feifei.shasha11.meta.face

description	ioc	process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	feifei.shasha11.meta.face

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	feifei.shasha11.meta.face

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	feifei.shasha11.meta.face

feifei.shasha11.meta.face
1⤵
- Removes its main activity from the application launcher
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4601

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Hide Artifacts

1

T1628

Suppress Application Icon

1

T1628.001

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Clipboard Data

1

T1414

Discovery

Software Discovery

1

T1418

Security Software Discovery

1

T1418.001

System Information Discovery

2

T1426

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Clipboard Data

1

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1

T1471

Data Manipulation

1

T1641

Transmitted Data Manipulation

1

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/feifei.shasha11.meta.face/app_ttmp/oat/t.jar.cur.prof
Filesize
428B

MD5
6f7e7f7fd4bfd9bd66c8cf445df18e5e

SHA1
c0f02bc22ce48cf81ff5158aac02fbf4de75b800

SHA256
6a0ef7718e62cf1ad8899d7b2dc73e33b0d8f19e6d75b8876a586b05c3f70a14

SHA512
dea7bab0f5b92464bb11faa39e81c39160c9961a0444943da05ba46b72ffd651cba7ce5796d230a16ddea415681ee64bafd30c4596ede545a1dcc1553cebb451

Download Submit
/data/user/0/feifei.shasha11.meta.face/app_ttmp/t.jar
Filesize
276KB

MD5
9aaea567e0c93e51718ba7eade0e83df

SHA1
0005116aad1779361b70093db00fed5ac090ae23

SHA256
b30a95dff6f65f444472971c8aaf895ffc8e66e0117ce242ec4cb8a8a519a5ec

SHA512
2aef1034335d8752f4e25ce6c5823ce03019536cc6e51ee61b5291c77a0f356a2517e0cbe7f2c4cc2d897115dc856449a342cfdc247c9d34d313187d15b2f890

Download Submit
/data/user/0/feifei.shasha11.meta.face/app_ttmp/t.jar
Filesize
587KB

MD5
f72c3d07507c3e26d317e9117ba757d1

SHA1
cdede4739e9dd9fd95243aab5e44c24f93f825c3

SHA256
1c65834d9ca018c6496a8b9957589d0e94657911b6635dc21a448d78f9238887

SHA512
3420714252e7503abc13c99274d767b0bc08671d769460dc61823ab9470e145fb75c5dfaadc617d3a05cf251ed5ecf38ea7e8c1d7b343bca4d7e8296f1b805d4

Download Submit
/data/user/0/feifei.shasha11.meta.face/databases/feifei.shasha11.meta.faceb
Filesize
72KB

MD5
f00d6d0791deeaeca6d8e9f150412b35

SHA1
03b315696a22cbb2ca6267c8e2e19a8d313d9767

SHA256
4b6f75525772fe5ca8f671c85dfa812b01b760957accba4a9b32c8e0afed1851

SHA512
83417083786773dac83b10a01234f07f581dbddc77974394f589cea85c4f873a7703f5f8c7a025b9028897756d79db23f3082faf4f59507edbcc3bf172515984

Download Submit
/data/user/0/feifei.shasha11.meta.face/databases/feifei.shasha11.meta.faceb-journal
Filesize
512B

MD5
bfbafed04ade93d1262cb710ddd898b9

SHA1
fb02c9bdf44edd06aedd8675e759b33d9a1786b8

SHA256
a2f7f7e7d61c2e5d98936a3ca906a122034d36150bb946bec9f91a5159cca24e

SHA512
89981fe0bb0efdc2ac4a17170b6b0aa4f79e4c6c0451af50cc2175b0ebf62d0f6760a751044dc504bc5ed852bec2bf693f088bcb799eaff9d5414b0efdffd150

Download Submit
/data/user/0/feifei.shasha11.meta.face/databases/feifei.shasha11.meta.faceb-journal
Filesize
8KB

MD5
0be3cb944ff3747fe66e3c5a80cf476d

SHA1
28a3e6a039e261d36b29d5e2099391f51294c069

SHA256
f54c9ea8a63ba7b5d7ba0e169ff3508a179fff513f3f47dc34fa9d5b5c9d88de

SHA512
5d7049b8d3a957e5ceff51eff4879e33bd88798cd8844680c970339ebdb4889f3e22aa631b02401099dcb28e76bb010ce397ddb39925b3bda7fb71f247b63035

Download Submit
/data/user/0/feifei.shasha11.meta.face/databases/feifei.shasha11.meta.faceb-journal
Filesize
8KB

MD5
1883c392b77e8336ee499228f733c893

SHA1
0b984d17fc6c447a4e724b43ef9f0fdfcd847b66

SHA256
b3c81b4fbddaad35927de17182d649212827d3c3686e59f7dab5a916651ff6c6

SHA512
195addcb4b9a274c85c1596f1e3a8629a31e3ae5d877a2a58e5b8b249e5b89c18160afc280bbc610f9b44cd89b7302f55693886cd984240131ed5373e5a9afa1

Download Submit
/data/user/0/feifei.shasha11.meta.face/databases/feifei.shasha11.meta.faceb-journal
Filesize
12KB

MD5
f1a3a898fb0db1021a49ba5cec2b66a7

SHA1
8c051d29535dbf279978d63bcb45f42897c0d30a

SHA256
c4cd99cc4048c2e29b3cda38caf386345e05b2ebb64f2b4032bf4ca03ba25164

SHA512
58d492dbf4052b25da29e98833b86d4bd728048ac18865a73ab3e70b775c8c609aa250c0330a242fd8134668cc586dcf1d39a58be8fda547309e0d36ac8659fc

Download Submit

Analysis

Sharing