1f72cf0c757ac796bc910f0ebacf060936fbe66f3a593945678094180e1d7edf

Analysis

max time kernel
111s
max time network
184s
platform
android_x64
resource
android-x64-arm64-20240514-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
submitted
24/05/2024, 17:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6f3b42c3b3eefba228151c2726656609_JaffaCakes118.apk
Size 27.5MB
Sample240524-vpjsgsdd23
SHA256 1f72cf0c757ac796bc910f0ebacf060936fbe66f3a593945678094180e1d7edf
MD5 6f3b42c3b3eefba228151c2726656609
SHA1 ef7fa8f4b318fa3cdce84972a0e3c9bcd31b537e
SHA512 38668d28dddeca7c405fd1a9290b5e2c94afb6914a6f3c0baad143c770f5c6841905660aa52bc8d5e25e5877c7b6b0bbea8db89f9a7678c98ecc0f53a9cf0364
SSDEEP 786432:iwNjOhbAlOR2KTOhWcAtksERnU8RjrAvfe8Gtmu:iSOhc+2KTaWc5s0UWQHe8GtF
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection credential_access discovery evasion impact

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 3 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/sbin/su	com.cyberpony.stickman.warriors.archers
/system/bin/su	com.cyberpony.stickman.warriors.archers
/system/app/Superuser.apk	com.cyberpony.stickman.warriors.archers

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.cyberpony.stickman.warriors.archers

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.cyberpony.stickman.warriors.archers

Loads dropped Dex/Jar 1 TTPs 11 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.cyberpony.stickman.warriors.archers/app_working/facebook.dex	4612	com.cyberpony.stickman.warriors.archers
/data/user/0/com.cyberpony.stickman.warriors.archers/app_working/facebook.dex	4612	com.cyberpony.stickman.warriors.archers
/data/user/0/com.cyberpony.stickman.warriors.archers/app_working/flurry.dex	4612	com.cyberpony.stickman.warriors.archers
/data/user/0/com.cyberpony.stickman.warriors.archers/app_working/flurry.dex	4612	com.cyberpony.stickman.warriors.archers
/data/user/0/com.cyberpony.stickman.warriors.archers/app_working/revmob.dex	4612	com.cyberpony.stickman.warriors.archers
/data/user/0/com.cyberpony.stickman.warriors.archers/app_working/revmob.dex	4612	com.cyberpony.stickman.warriors.archers
/data/user/0/com.cyberpony.stickman.warriors.archers/app_working/startapp.dex	4612	com.cyberpony.stickman.warriors.archers
/data/user/0/com.cyberpony.stickman.warriors.archers/app_working/startapp.dex	4612	com.cyberpony.stickman.warriors.archers
/data/user/0/com.cyberpony.stickman.warriors.archers/app_working/yandex.dex	4612	com.cyberpony.stickman.warriors.archers
/data/user/0/com.cyberpony.stickman.warriors.archers/app_working/yandex.dex	4612	com.cyberpony.stickman.warriors.archers
/data/user/0/com.cyberpony.stickman.warriors.archers/cache/1582435991586.jar	4612	com.cyberpony.stickman.warriors.archers

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.cyberpony.stickman.warriors.archers

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.cyberpony.stickman.warriors.archers

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.cyberpony.stickman.warriors.archers

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.cyberpony.stickman.warriors.archers

com.cyberpony.stickman.warriors.archers
1⤵
- Checks if the Android device is rooted.
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4612

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

facebook.dex

Path /data/user/0/com.cyberpony.stickman.warriors.archers/app_working/facebook.dex
Size 252KB
SHA256 ccca0b419dab1b2dc7f617d3d038040ff17323d847df5ea2885ca21ab323da25
MD5 3bc7b2f808b674ad7d0f475e32f76a41
SHA1 0f0d3cf3f3ee266940a2efb766956bf4d6665812
SHA512 51fda7c7b420260a45c6ee3a0fa6561fe190d6fabade54f6939a26eebc0b27ff53acf881989dcd8352971e179879d6474985b172ff74d6e927db0a1ce5a3dcc7
SSDEEP 3072:EO2ENV1p8frWEXCvniX5HibfpKUniiDCF/aUIVqbtb1j3SIQjs4qBh6V8:L2ENV1SVC/iPRItIWG
MD5 SHA1 SHA512 SSDEEP

Submit Download

flurry.dex

Path /data/user/0/com.cyberpony.stickman.warriors.archers/app_working/flurry.dex
Size 623KB
SHA256 643732d42396e874bee6a46b3679fb07c933a38d4154068a2d9284c6cd4e5eff
MD5 0168469cf8197390b5589493dab26900
SHA1 024df60dfaa34f8f36fb374411bce42340fba111
SHA512 1d880f4fc5a52926c0a5c8f0e77e0212d8b441e9ae47eb9ef596d02bbbeaa333bbf99ba8a9918c0145d8203a761116a5bf783f3ea7caaaadaca90ba05157b4bf
SSDEEP 12288:QVPIOCJxGZ/MgjC6DQUDQ61bDARV7vmZxmbk:Q3/Mgj3DQUDQ61bG2ck
MD5 SHA1 SHA512 SSDEEP

Submit Download

revmob.dex

Path /data/user/0/com.cyberpony.stickman.warriors.archers/app_working/revmob.dex
Size 129KB
SHA256 faa407470def95bd2d3133b1bdb126df1adbd69c385a2b3374187910c32573b7
MD5 0cfd33137e611ce57ca829de7193b740
SHA1 8d6602c51b8e59e3158816eedf293c20cab3a29f
SHA512 daec5619d965c2980d86f345b4501044be879ebee7bc024e8d155951ed4e8bc00565c5f8aca5ba9ac82a7cd367ed517d42313f523105108cec2b9f6bc7bc2bb3
SSDEEP 3072:8jL5PmfIHkToO4GUwgrFArrMVrdl05gdUZWsKGuv:+LxAY75Arul0pIlv
MD5 SHA1 SHA512 SSDEEP

Submit Download

startapp.dex

Path /data/user/0/com.cyberpony.stickman.warriors.archers/app_working/startapp.dex
Size 563KB
SHA256 2058edafbf23b3747c862dc335fa1b95a59a636de07766e47ce7f7e0b61636f5
MD5 7e1a5d687bea14d7207120a33f422f93
SHA1 b3280de56f8398747bddaf53b6296c8839205773
SHA512 ed1c38a4fdc2e0cbc164f256082b316188237b9417087289704b2361ede319832e9566da218c25f6b9f57c7b641c586d6754c70a2458feb9f8bd2838b9a75887
SSDEEP 12288:jQto1a1MI3Q5bqJperpRQ3HZ6wG1RASkMDs3Uyp5CrWeu0GTDxSzMUIIaz:kC1iYBg3HZ6wG1RASkMDs3Uyp5CrWeuJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

yandex.dex

Path /data/user/0/com.cyberpony.stickman.warriors.archers/app_working/yandex.dex
Size 343KB
SHA256 bc8a4f3cd6414fe90c18f3228ea687d7016055f2eddf7fb59d94bd204d8ee38b
MD5 f8d1e2b032baaedddd11ff11f845284d
SHA1 b28cb88a2b4b46876bf93f1c3b1dd6d72bc8225f
SHA512 1255ca3fa9160699c3318cc738991a69f70502c4526b9f4ebe7caeffec8b62aed21208294498ae07506327b6522adf2ae176d64c5ad8ff70d74ba3f09a731d3f
SSDEEP 6144:GvvSi6bsNpxHrJ96x9r3BPNg9VTziVdZwvtpnKhVy:Gn1Xo9RPNgnSZiKjy
MD5 SHA1 SHA512 SSDEEP

Submit Download

1582435991586.jar

Path /data/user/0/com.cyberpony.stickman.warriors.archers/cache/1582435991586.jar
Size 9KB
SHA256 f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce
MD5 e8e0527a01aefdb89afd2c508f131da1
SHA1 f1103e6b260c657ceb3d95f1b023af3fda8b133a
SHA512 fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34
SSDEEP 192:uGJqbQwgQYuNUnEV4bAa0s/ombgmdxjX5fGpTVHb3qX:LkMwTTNdlns/ombJB
MD5 SHA1 SHA512 SSDEEP

Submit Download

1582435991586.jar

Path /data/user/0/com.cyberpony.stickman.warriors.archers/cache/1582435991586.jar
Size 20KB
SHA256 2897b0812077c654a9b3fbb0b6303d5cde681eeba7ad9981de65716c7810d685
MD5 fde2ee00cbd121cfab5290b078aa3ceb
SHA1 e2b77d5320e155e413d040a8c20020962065b2f8
SHA512 a9326aff8e454a2b4ac09984ef2a65fddd4dc146b4c44d839035549bff8c9fdaae490326d0b018f76c1ca2e4fb25426d74f550ca0950982fba632a023af99a56
SSDEEP 384:Za0jn+huC5sMvRuvypj6f2ZzJgm+poK+l8m4qxXpj/7wyxBLBiok+9VQ3AKm8:ZU5sMvu/f2/gm+pDAPzj/Dip+9y3AK7
MD5 SHA1 SHA512 SSDEEP

Download

google_analytics_v4.db

Path /data/user/0/com.cyberpony.stickman.warriors.archers/databases/google_analytics_v4.db
Size 28KB
SHA256 68be1e675b68f8a894c80caa952c1205e292c427657bb79a58b9b366934d1d8a
MD5 60ae3555b60853ad5a921e6f0e489e7f
SHA1 707ea120f60037bddac28635b5f3c0d74a69dfc1
SHA512 550cfd40a3a3bc7be604a81c9c9c879078033d12282cf32ca6464851479823febd12ed2162ca6241b01a03ad52cd80cf3fe3c0252591e68cb11a8ceb682f2f39
SSDEEP 12:TLWem+8BFVXns156MBD+EHOGMRW1/YXxyNTSFbyYrrQXxFgjOt97aXJjzjkGyRmi:TLuPLVXixByqQWWEqrUhCafBGBGSiGQ
MD5 SHA1 SHA512 SSDEEP

Submit Download