Analysis
-
max time kernel
13s -
max time network
131s -
platform
android_x86 -
resource
android-x86-arm-20240514-en -
resource tags
-
submitted
31-05-2024 10:32
General
-
Target
86b19d7e4f8d950fb9e653824a4ce249_JaffaCakes118.apk
-
Size
2.3MB
-
MD5
86b19d7e4f8d950fb9e653824a4ce249
-
SHA1
f3c0d3a704e452e519cdc4c454dab02341a6dba1
-
SHA256
59538c4bc60dea085aec1ebb720059281a117fa5c64747efc16f3ba77b00dde3
-
SHA512
c8d1555348f351a1101e4795e08fbe630ac753a776ad90037fcd11a394fb03fabc885edd3524493bca1228b89f8f1ef724995d907062e726f6db0b75d8dc2062
-
SSDEEP
49152:f4/hJWSDii35rUCzDAfZKAWO3NyzvMtG9KJgbdbp72oeU7Pu0w:f4/hJdlUCfAfLh3NsUgbRwWPY
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Requests enabling of the accessibility settings. 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads information about phone network operator. 1 TTPs
Processes
-
com.zvcwpck.yokdabe1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Requests enabling of the accessibility settings.
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.zvcwpck.yokdabe/app_offline/lodktxu.jar --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.zvcwpck.yokdabe/app_offline/oat/x86/lodktxu.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
252KB
MD5c47bb77ab2c9e12333686698d509965c
SHA1958e11732a0ef8d923331ae6d979d93a97a97aac
SHA2567ba04aa8005e4184eb4895a7fa5e4ccce25a21257b49e4a468378c8d4a52305a
SHA5128947eb566cb476264a204ef022e03ef29e58eca05086635219fcbdab86caa4dd89cc14c3609ffe5a220c9cd26b1c2e138328011bb53093e6dd4acd16f6adb62f
-
Filesize
568KB
MD51c82a1080d7e96155566c6ee49545b54
SHA1dcc3dd98a36b869ff027d893a2f90ac3220d3e61
SHA256ed250df6d7d75cdac855cfbd775c18324c2608f433422232b778fb71a163e88c
SHA5120acfadd86eae9b1dd087e50b0521c33c2f37abd520a9d6842d909e99c5f468451978455b9f9b0bb03dc67969e6996dd10bdd702c1cd35c1603f6b1ffb7d1b1e1
-
Filesize
568KB
MD5a6c6603668326ee21d3d17a7a69a384c
SHA1adab47998421b481b10a8ae86d1956b6b448ecf9
SHA256be5e854dd1af100a2b0c59abbddb83c8dd02c7f53d1a27688e2939d76ec4dd1f
SHA5129f59cbfd850a9f182b5a60cdb8443dd821915d1f194f9c08a4c98956c1b37227694c950ca8a2947d470fa5fd4481d8a5771ec4db3672ed4927599c5babdc3585