10176be06c18377fbaa13aeac71a202dd6c4286b490a253aad170bb76f898553

Analysis

max time kernel
125s
max time network
148s
platform
android_x64
resource
android-x64-arm64-20240514-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
submitted
27/05/2024, 04:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
77faa89ec14bc8dd909bdab987fdfe02_JaffaCakes118.apk
Size 31.5MB
Sample240527-fly1nsha2t
SHA256 10176be06c18377fbaa13aeac71a202dd6c4286b490a253aad170bb76f898553
MD5 77faa89ec14bc8dd909bdab987fdfe02
SHA1 81fb202b37d5966a6ec9a9ce52eab758e14c8ae3
SHA512 df53eb1a68903812194830b34bceb7e422f96196a7c0f7fb17f02ae39c7aded849880181cf0e01ba07e4bb7fc0c3b7483facca5ee4fa505e2f9c6feafd7d55ed
SSDEEP 786432:30Ai2V+9ERPRY5Q1d/coV+dAXGZZd8oxyIpJ9bTZWfsx2BBJz4WM:EAiBaRPe5QlcxeXGZZySy49p6sxIa
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection credential_access discovery evasion impact

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.divmob.ageofdarknessvn

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.divmob.ageofdarknessvn

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.divmob.ageofdarknessvn/cache/ads6972711411214908778.jar	4623	com.divmob.ageofdarknessvn

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.divmob.ageofdarknessvn

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.divmob.ageofdarknessvn

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.divmob.ageofdarknessvn

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.divmob.ageofdarknessvn

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.divmob.ageofdarknessvn

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.divmob.ageofdarknessvn

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.divmob.ageofdarknessvn

com.divmob.ageofdarknessvn
1⤵
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Acquires the wake lock
- Checks if the internet connection is available
- Listens for changes in the sensor environment (might be used to detect emulation)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4623

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

ads6972711411214908778.jar

Path /data/user/0/com.divmob.ageofdarknessvn/cache/ads6972711411214908778.jar
Size 2KB
SHA256 c9015ed1e8436b145f069d37608b035e7ddc981c55a70385aeaf3c7e90c1c2bc
MD5 030f79e160dd93acc424e00ca3b1574f
SHA1 6c67ca0369bd381d6426dc642d731ad3a14df2cd
SHA512 d6f8d6f7cc5943a6e1bf8d2d9504494561658642d36dbab75cb294944f2e5eea20ce2f00425c2100e50af97f687b9e7e4c61d72625e58427df862aa94c6f586b
MD5 SHA1 SHA512

Submit Download

ads6972711411214908778.jar

Path /data/user/0/com.divmob.ageofdarknessvn/cache/ads6972711411214908778.jar
Size 4KB
SHA256 f3c142f78cadcb57d7da3d8e4dc5f8c7b05377417c639059910696c844afc1f9
MD5 12670a32ad1380c9021a9e74aa5f2281
SHA1 7e8caf0c7a4d78452efb90958e8ce1aae5148e44
SHA512 1277dde373cab02d5df62732834adb79f8dbf1d1a9ac56b5b348e354317fadc24fe20b5ebdd1ecc28f8fc98dcdff807d2839bef75ef7d871e976e68a95851b06
SSDEEP 96:8V0+Z8fg8M9CC/mkE2K6Uq7tJ5FVDNqv3jokVbdzfgDmM0/:8VXYglD+kE2K6r36v3dLgKx
MD5 SHA1 SHA512 SSDEEP

Download

.flurryagent.65b94d39

Path /data/user/0/com.divmob.ageofdarknessvn/files/.flurryagent.65b94d39
Size 58B
SHA256 604970ff0d9792f61143d573c74e33f7b5b940ceeb1c907c87140be885aa31c3
MD5 688e9e7dbba64d0d92b54f2646e905f4
SHA1 f5a403eb0e0092128f5915185947e5bdbee29723
SHA512 a7cd9849a8d92a0a8c7fb2d21e0de50fde27e01d3edfa269168e134f3b4bb66b65caaaffd224aea4a5c8c5c2f6e60c0cec5e9a48550d96c38e044d8a3f965b2f
MD5 SHA1 SHA512

Submit Download

-1292118758

Path /storage/emulated/0/.divmob/com.divmob.ageofdarknessvn/-1292118758
Size 110KB
SHA256 af540b2856d2946d82a7ee016aa0ef5e35548284af5c1645c7c1863c48cd1c18
MD5 ea8b52321a3f22a3df2fe0686f7dc496
SHA1 7f756c772e2fa0ae151aedb7d387b8d679cbfd2d
SHA512 5751aa7139152bd4b18fa22654da2e7b20af4a3e214498bd309cd3d4cd08211cd0fd22aa1bc094c59fd40c7af5b862a96661b97905e2d49b409ba6a065997714
SSDEEP 3072:D0qZCFPDax2Uu4YKLFGJVKZvSyeMfaIEyOX:DWWPJYKLMWAMf6X
MD5 SHA1 SHA512 SSDEEP

Submit Download

-1979454812

Path /storage/emulated/0/.divmob/com.divmob.ageofdarknessvn/-1979454812
Size 122KB
SHA256 bdf819fa2328f27bb7f7c94d69d6bb322adbe2b1873ccfb5cbd961c830c036cc
MD5 cbdb462b73edb77c7aeb8c02c388039f
SHA1 4e5be1fe078087fe71481e220e6c59700898e564
SHA512 3cd65f30be6109bc3f00c0189fd1607d191bbc8837b1d4846e497b39bc5e2d6f23f39932c00eac18a97a7a407a42184d014f5f99a048989aecea1c56a8e0a6c1
SSDEEP 3072:kfMF6qHCvN6YhUrL7MFvGsSAJa5pcI3La0znJt:wd9vNDyr3MFes+5FLa0Jt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads