Overview

overview

8

Static

static

6

840af04291...18.apk

android-9-x86

8

840af04291...18.apk

android-10-x64

8

840af04291...18.apk

android-11-x64

8

Analysis

  • max time kernel
    177s
  • max time network
    131s
  • platform
    android_x86
  • resource
    android-x86-arm-20240514-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
  • submitted
    30-05-2024 11:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    840af04291bf6f8c239c5178e1674772_JaffaCakes118.apk

  • Size

    263KB

  • MD5

    840af04291bf6f8c239c5178e1674772

  • SHA1

    35322bd708e281a3af6f33a7a48cf01f969f123c

  • SHA256

    0516416947f71b9af9dbc95a72b0d4fd0fbff816c97bca163deed795cd75d02d

  • SHA512

    30a41c2a1ff09f2e7a0a479d7cd2b160d498398bc43ab0f338dae1a822e5611e3932ad21c60c836d8956003ad68497a5d9b47834107398305ef46ddf641696f2

  • SSDEEP

    6144:bRIZPNvivXSCeVvnD2IJOsBFaw4IzEsS/ZXBc2Y4MT5fNq:bRI3i6tQIwsBFa/IvcR9Uq

Score
8/10
bankercollectiondiscoveryevasionexecutionimpactpersistencestealthtrojan

Malware Config

Signatures

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Checks memory information 2 TTPs 1 IoCs

    Checks memory information which indicate if the system is an emulator.

    evasiondiscovery
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries account information for other applications stored on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect account information stored on the device.

    collection
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Checks if the internet connection is available 1 TTPs 1 IoCs
    discovery
  • Schedules tasks to execute at a specified time 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact

Processes

  • com.news.geynci.jxvlsxqrljv
    1⤵
    • Removes its main activity from the application launcher
    • Checks memory information
    • Loads dropped Dex/Jar
    • Queries account information for other applications stored on the device
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4259
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.news.geynci.jxvlsxqrljv/app_tfile/fields.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.news.geynci.jxvlsxqrljv/app_tfile/oat/x86/fields.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4325
  • com.news.geynci.jxvlsxqrljv:RemoteProcess
    1⤵
      PID:4346
    • com.news.geynci.jxvlsxqrljv:guard
      1⤵
      • Schedules tasks to execute at a specified time
      PID:4690

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • /data/data/com.news.geynci.jxvlsxqrljv/app_tfile/fields.jar
      Filesize

      138KB

      MD5

      cceb8db3b057d24673d49eda229e9892

      SHA1

      b18f6353b2156410249079a3b7b86ef3a530e8ee

      SHA256

      e900cb4c3fe9d8f45196a7457e9645c65b0f3cde820f4161950252cff67a4d97

      SHA512

      4a42cde3165a706e823caa1362001ed8aa647caf22325a4f2554c64fc4ebcd79afe44fe5eab5474221806f26e7aca9d2901026de6e597ef62fe867f123e4bd57

      Download Submit
    • /data/data/com.news.geynci.jxvlsxqrljv/app_tfile/oat/fields.jar.cur.prof
      Filesize

      329B

      MD5

      ec55c41091d4e5df815c14923bc9a10f

      SHA1

      b21a05f4866a570acddc6447a7543d73848f5f9c

      SHA256

      8f4ed7609aafae6efaef1d5deee46a21abd774b6adfd707a60e94705bad35f77

      SHA512

      c37d98939e7786d38e1968c360b77f5d094ba9c29795c4b1acdedc4ef4d53b1b92ec978034b26903ca1783d1f5fdd475ff3a4ff69d1e02c45935931182a99b5a

      Download Submit
    • /data/data/com.news.geynci.jxvlsxqrljv/databases/tbcom.news.geynci.jxvlsxqrljv
      Filesize

      4KB

      MD5

      f2b4b0190b9f384ca885f0c8c9b14700

      SHA1

      934ff2646757b5b6e7f20f6a0aa76c7f995d9361

      SHA256

      0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

      SHA512

      ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

      Download Submit
    • /data/data/com.news.geynci.jxvlsxqrljv/databases/tbcom.news.geynci.jxvlsxqrljv-journal
      Filesize

      512B

      MD5

      86c97da805f1ba861c6473b1ba65c296

      SHA1

      a978e3c31e60ccd8a111137f3724d893eeeb5747

      SHA256

      d53291fe90c7d742e72d8daaf0a4c6199a51caad3334f6e7806e7def720ee709

      SHA512

      5ced40de8c82458c5d344812e408d343901373607b003bc618f427710cc957de5b8fb3ecd3ea666768d67b47c07be8d6af5f23ce55c977b64c1fc0b8c933a0e8

      Download Submit
    • /data/data/com.news.geynci.jxvlsxqrljv/databases/tbcom.news.geynci.jxvlsxqrljv-shm
      Filesize

      32KB

      MD5

      bb7df04e1b0a2570657527a7e108ae23

      SHA1

      5188431849b4613152fd7bdba6a3ff0a4fd6424b

      SHA256

      c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

      SHA512

      768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

      Download Submit
    • /data/data/com.news.geynci.jxvlsxqrljv/databases/tbcom.news.geynci.jxvlsxqrljv-wal
      Filesize

      48KB

      MD5

      355013d39d7e6529dc4f81e55360b104

      SHA1

      6c39ec44148c4c46209e69c028aff0d563421261

      SHA256

      cf1fb82780e6c575848bf46b4b2b961dfb9ce623d7c1f930faca4798b73b7087

      SHA512

      f2b3802466229830ebdd5186788244e9f724a2b7d2f90e545bbb3e508fe656ac9cbcf867d94dd6ab95272643784aba42c2f73cffd41f63f07eb6039bd78987a5

      Download Submit
    • /data/user/0/com.news.geynci.jxvlsxqrljv/app_tfile/fields.jar
      Filesize

      281KB

      MD5

      4654f352b1b2095d54e0945af0e3948c

      SHA1

      4819b9827e70025c72a74869a85c996d92603931

      SHA256

      71c5cdeeaea45916c993908370cb7b1d60911d8e233dc9d1def0e75915e4548e

      SHA512

      a58ba607dbdb9af50beb9bec719e24c7d4e457e6bd9a6ef71460b0ee629f002788ac8a93d2d18728304c695fca3ac000138f19427c064cd66c628dab8a839ce3

      Download Submit
    • /data/user/0/com.news.geynci.jxvlsxqrljv/app_tfile/fields.jar
      Filesize

      281KB

      MD5

      73b11c4c10150bbd4f29ad012dc11dde

      SHA1

      65c83ad32c29f9811c32eda75d7fcdc92ef42dda

      SHA256

      52132037e9b950a9cb48d6374ee2c6747a6bfe776e13a726395771f1b40ee9da

      SHA512

      3e53b1ee22a00e60896da86d2695195e0965c93d190c4d1c0dba2eb5c611d670ee7693a9f8756858255e2b170cb82a753719dd4d6a827af437309b7a1dcc6f01

      Download Submit
    • /storage/emulated/0/Download/sdsid
      Filesize

      4B

      MD5

      b8c37e33defde51cf91e1e03e51657da

      SHA1

      dd01903921ea24941c26a48f2cec24e0bb0e8cc7

      SHA256

      fe675fe7aaee830b6fed09b64e034f84dcbdaeb429d9cccd4ebb90e15af8dd71

      SHA512

      e3d0e2ef3cab0dab2c12f297e3bc618f6b976aced29b3a301828c6f9f1e1aabbe6dab06e1f899c9c2ae2ca86caa330115218817f4ce36d333733cb2b4c7afde7

      Download Submit