1294e4fc4c4d9478c59a75197c43e6f43c58fe9bd1feb47ce261bf750d1f4ee9

Analysis

max time kernel
12s
max time network
149s
platform
android_x64
resource
android-x64-arm64-20240514-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
submitted
26/05/2024, 14:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
75be0f6154c4907203598b9eede99fe9_JaffaCakes118.apk
Size 3.5MB
Sample240526-rhb8aaha8t
SHA256 1294e4fc4c4d9478c59a75197c43e6f43c58fe9bd1feb47ce261bf750d1f4ee9
MD5 75be0f6154c4907203598b9eede99fe9
SHA1 79c9d60ac7ade689fffefe43df1007b7acab5745
SHA512 a8d32bf8c89c55076e9d4725906ffd40c8efe77b9e4bd2a9119bc348e9e0b58eb6aa327389758ca3c8daaa246dbfb3ca9fa63534e867b7a7b322974c26c58115
SSDEEP 98304:ReaLV/n3qbcX4C1G8g0QlvB/tFi5XnfuTwKaWucEfS8ET+JGYvvx:MA1zf3cEjE0Hx
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection discovery evasion impact persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Requests cell location 1 TTPs 2 IoCs

Uses Android APIs to to get current cell information.

collection discovery

Location Tracking

T1430

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getAllCellInfo	com.hb.qx
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.hb.qx

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.hb.qx

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.hb.qx/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar	4655	com.hb.qx

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.hb.qx

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.hb.qx

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.hb.qx

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.hb.qx

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.hb.qx

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.hb.qx

com.hb.qx
1⤵
- Requests cell location
- Checks memory information
- Loads dropped Dex/Jar
- Makes use of the framework's foreground persistence service
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries information about the current nearby Wi-Fi networks
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4655

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

__xadsdk__remote__final__builtin__.jar

Path /data/user/0/com.hb.qx/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar
Size 40KB
SHA256 d9acce94df9b850372a321c685b6a6fc3939467009874be6dd87d208e314e7b4
MD5 0e9e1dc278d1bb2d2b7d36ebd70f2c9e
SHA1 e14d0ad51db670c14208cb98dacc61f4bec72451
SHA512 07ca7276c76b3a2d495cfd8e536485069351c405113864b5c340aa3546237e104fe67dfa29781aa199c877cfa18dc23fd1820bcb0a4c41344cd327fc7c36a0f1
SSDEEP 768:j0cAv9dXXGw+VCwUnAg/OaISIkhuPcmrIrCDlIB6NKuA7UmSseGmc:MGNVsntOa6kQc0Irmo6+YMeU
MD5 SHA1 SHA512 SSDEEP

Submit Download

__xadsdk__remote__final__builtin__.jar

Path /data/user/0/com.hb.qx/app_baidu_ad_sdk/__xadsdk__remote__final__builtin__.jar
Size 86KB
SHA256 3f3e11647b70a210bf75cbad2566adb74cc2cdbd573c06fc090c3b13e7c2fc6b
MD5 3ebed84b0b0c209dbccc55335358adc5
SHA1 6054c79170a624f2bc8cf845444fa0082e80e0fa
SHA512 096e85b8497074e4d72914f3d227446ad41a164304627488ca4b7406cb71c507cf81c6cfe5ad5521b7eae7762e8ae0bd80a4474e010c641d3836fd9f5395ca2c
SSDEEP 1536:D8wj3kd+Wndcva+BiyzLug1M1IJAHuPpO0HuG6exWuOe:hkd+WndCEy/uuJrPpO0HT6mWu5
MD5 SHA1 SHA512 SSDEEP

Download

libcuid.so

Path /data/user/0/com.hb.qx/files/libcuid.so
Size 109B
SHA256 906ea492463165354a733d224c28cc9c5bc16e3f0abc3c07a86ad86be30dccd1
MD5 df4d2bf0c78fd788f0664e33a78cf432
SHA1 e1f317d48c2a543d9348ec5af4ea694792f86f51
SHA512 0775f6b727db2765d3fd942ad024f817d9c56eea323019055a2b786de3b5e4f328b41382f50f12f0e0254e74067e751001a5a8c5728fdc8fcf50436aec7e0f21
MD5 SHA1 SHA512

Submit Download

.confd

Path /storage/emulated/0/backups/system/.confd
Size 24KB
SHA256 fbedaff5560147bf6f8f7878aa0815bc9391ea664358e203fb02a4ab5f2e81d7
MD5 ebda2b6bc6b24fafad551bbe6e760b30
SHA1 771668ca3ad71ff5302daa82435ceefa929b17b5
SHA512 a3c96cfee776007799bc05ab69056a5a08762f57115ec189653d709a4959f2e47bb3ac48f968ae87fde3d7bc670da1e9e1984d33297259c41f35434391fb1bb6
SSDEEP 12:TLWemLrzfKfVca89YurNTSFbyRxw59YERmBEyPbD+:TLuf296YuBSrY/GSK
MD5 SHA1 SHA512 SSDEEP

Submit Download

.confd

Path /storage/emulated/0/backups/system/.confd
Size 28KB
SHA256 8ebff4e0cc61d205a9db9deff7d86169694b48bdce08caf2672ba3b4f2c23bc7
MD5 438d45d207c7100b863a6552c2aeb4ce
SHA1 d461f34b2c5bb0259c501947e49e84532b4e7212
SHA512 7c1f20f8a04e64cf436655fe91de821beeed5c1954ee9d821d7594cdc754e04531ad4c76c7a87a5bb7ed38da3ea14b973812405a755f4bb07f43c47b25018ad9
SSDEEP 12:TLTareoUy359YUNfKfVca89YurNTSFbyRxw59YERmBEyPbGA:TLUprYUM96YuBSrY/GSd
MD5 SHA1 SHA512 SSDEEP

Submit Download

.confd

Path /storage/emulated/0/backups/system/.confd
Size 28KB
SHA256 fc2a663a26f95712318d70257cbfbdb643020e626e9fc4d19406179533d00e4b
MD5 51ab2ab76d816e4feedccc799cffe6cb
SHA1 4161b00299736e6bfc0239c5782d15fd364af461
SHA512 c110255a9efab94c0c8626a7c94c7527affd7211662a9256c606e6a704c11c79e55dbdd5cbfd9dbe42d1203aaac98ed2830d1aecc5882dea0050801f13566717
SSDEEP 24:TLkprYUM96YuBSrY/GSP/ToK2xgNzSUBilZiT7ah1DR8TM:TAprlMsXBSrpSP/kK2xgNSLZiT7abSTM
MD5 SHA1 SHA512 SSDEEP

Submit Download

.confd

Path /storage/emulated/0/backups/system/.confd
Size 32KB
SHA256 31aec37e55d678dad883c1cf35cb6590ed9bfbe32691746c1f320257901b948d
MD5 9e850a99cceadcc458b0e12a794b3b29
SHA1 bb83d06f828f0219d8dba19d88ba260d4fc3e122
SHA512 2cd61574582985140a9b329246910bc421f676e07a8d33bc560adc26f0016ae31fc161d4104e061d3bc605882bbccb39a0fc7d1eade48d76d2495b7e78a96b82
SSDEEP 12:TLqNrDvqi9YumoUy359YUNfKfVca89YurNTSFbyRxw59YERmBEyPbVG:TLYnYuxrYUM96YuBSrY/GSg
MD5 SHA1 SHA512 SSDEEP

Submit Download

.confd

Path /storage/emulated/0/backups/system/.confd
Size 20KB
SHA256 f28f2c419c15e644f68dfbd92fc222caa883e64c32ab6e0db7ae650098c84d4c
MD5 9d73df871bac42a97c9c7fa5fce9dd46
SHA1 6c8cbbeb4e548aa27c2414025b80d4bb4d1b3882
SHA512 600dbd8d41585116f1998df8cbf08ed66cdc25c9c590b55f6fa4065708bcfaf79bf631f67c74f40e5b17c98257304cf56956b1e14441abe9252e6982dbc0aaea
SSDEEP 12:TLyKPd/UyNTSFbyRxw59YERmBEyPbAVOwG:TLy2lBSrY/GSEG
MD5 SHA1 SHA512 SSDEEP

Submit Download

.confd-journal

Path /storage/emulated/0/backups/system/.confd-journal
Size 8KB
SHA256 a2937ce8556f97bfea3f77e2dcd49d26048ea602491cde4da5421b8e6e276f17
MD5 0f7ec45e947e36248d2bf1e07abe5b86
SHA1 227b1778d4953cb7db11e457c0ae57dcaa807fb9
SHA512 69707b4f858e4330b46b23c3195691fad617649bef57c84d8859a425eb164e6b0a19d03c3a4e2c35e19f05a5fc6d9e3e6699e4e385eb2acaa0242bce25c4902f
SSDEEP 6:7+/l9GGPg9bNFlqhO1r/kPlOERX4PBX4ogLugMBX4suuKvC/+:7+tTqLmqKRmBEyPbIS+
MD5 SHA1 SHA512 SSDEEP

Submit Download

.confd-journal

Path /storage/emulated/0/backups/system/.confd-journal
Size 8KB
SHA256 c3ad31c8fc12e6b5c9b15a2a72ac0900aa2f9a81873e24e0775423961dc64f39
MD5 3ec39e44b3e7dc1f8b27c7bd2a80248f
SHA1 df1b701477a6057b6359605006fc795c7c4574ee
SHA512 90708b3641df270c0edb03b816f41cdfa62b4b1fe8717d2017392f2577be40027d012560b1b918426eb2b20485a8d49e4162dbade48dac4e0fa5c2ef538c4e6e
SSDEEP 12:7+txSnqLyKPd/UyNTSFbyRxw59YERmBEyPbNZ:7+tIqLy2lBSrY/GST
MD5 SHA1 SHA512 SSDEEP

Submit Download

.confd-journal

Path /storage/emulated/0/backups/system/.confd-journal
Size 12KB
SHA256 c754c17e0f1eaff61ac13c4812465b49fa6da168f92da3e980a960fa3aa5cb07
MD5 2967f9556f213a76e25678e546972731
SHA1 76a8ff826fa4299142a387d90b1063baf8fbc305
SHA512 62e88d3569293791e2336e0f4c30db68ccc5be364c0f7b43218e675428abd404ac8bff93d28261fe1d6815fea5f4622b00dd11bbb64a00feafd26ecef10e811e
SSDEEP 24:7+tNqLkprYUM96YuBSrY/GSURqLUprYUM96YuBSrY/GS4:7MNqAprlMsXBSrpS0qwprlMsXBSrpS4
MD5 SHA1 SHA512 SSDEEP

Submit Download

.confd-journal

Path /storage/emulated/0/backups/system/.confd-journal
Size 512B
SHA256 b90b4afd42188ff8766265534b9d67a75e2afcf0161c3292aa984e26ab558a99
MD5 e41f6de4155668f0c19977bd5e03bca2
SHA1 c718aeceb4a2b3a4b54f43d6cc54bb5634d3b3af
SHA512 572a8c42ad661ca9f673ab91ec4cccfea267be16d091fabebd6777cbf0a337da9230f6b29f933ad64b04e44f5856b9d73f7d96c39b49f75b7947a7e441b996ba
MD5 SHA1 SHA512

Submit Download

.confd-journal

Path /storage/emulated/0/backups/system/.confd-journal
Size 8KB
SHA256 da91c4c74ded60ac068c58e3a7bc2c79ea881882225a5d17ea6490a86ad6f525
MD5 53ed29f83678dea08527961c53438e25
SHA1 0cfdc1ca64bc7756731e8fcd04de36ff2658bce5
SHA512 9f60dc06a4ed8093f01604b06478018ceffaef82280c95fa7386a976ac69aea1a379ffa60966a11dae0c366a21e3cc532a3fb3b4817d71f61ef43b73fefc13f3
SSDEEP 6:7+/l9an1Vg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKBM:7+toqLiuWdYRmBEyPboM
MD5 SHA1 SHA512 SSDEEP

Submit Download

.confd-journal

Path /storage/emulated/0/backups/system/.confd-journal
Size 4KB
SHA256 f19ef368df1b9c4878196056331bce37292454a9dfded0689c66293daafa741a
MD5 a1f9d6c39a07a2075be047d039a2e5e9
SHA1 c3296a580e607e4cf342a696a73628de6073f5e1
SHA512 9812b93864c81be70255b6657473933244c042a9c28c19762d211fc2f4e1d0851d83fa7aa5df42b227aa518c2a38241c2c45c1f53c5e56b8cc5fe7a01785de4b
SSDEEP 6:7+/lHEmHPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKg:7+tk4qLJdeWRmBEyPbX
MD5 SHA1 SHA512 SSDEEP

Submit Download

.timestamp

Path /storage/emulated/0/backups/system/.timestamp
Size 25B
SHA256 b426bb18bcb61aa927189fd271593307e7579e6bec96637570ca7f93404368b9
MD5 4cf80d03a9d4e5fd6c36c36c76e7fe2c
SHA1 97d5689c749c5a5542aa55e8cb12e989af36207b
SHA512 2cb1203d10b20f110aac5ad267ed8ab1f0f4f4888265c56fea828392ce76f74ac0cf3c8a86ebbd4e30e72cc32a8c3c0a5511c30256dd7575846eae32d69f3e8f
MD5 SHA1 SHA512

Submit Download

.timestamp

Path /storage/emulated/0/backups/system/.timestamp
Size 50B
SHA256 21ed392fbafe60966e0036ec3ab1eddafd7fc39d8f598424c774d0b2f0a9521a
MD5 e5f1410b3a3d35bfdd3cab09fb023126
SHA1 c86bd8fcbaf4e11264257360025af7771062a3e4
SHA512 12225e0bc4a9070f07b0296ee55f8f9ac94bc0b58133c19e86a586cf8f70b34841cc36438cefa4164f6a32a6dfa444925a4454fe2293de53e718bde5fd50650f
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads