976f7fac370a301e0ae0408eef64ae20aabacf4ed48399a7239f84884a87acb9

Analysis

max time kernel
9s
max time network
161s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
01/06/2024, 21:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8bdc7722614c12b7c9548194a38cfed2_JaffaCakes118.apk
Size

18.0MB
MD5

8bdc7722614c12b7c9548194a38cfed2
SHA1

b98fd7710f11c3997564c17bd22d7f36621d2d44
SHA256

976f7fac370a301e0ae0408eef64ae20aabacf4ed48399a7239f84884a87acb9
SHA512

0083c96ddf18e3a659d9ed9c79cc66898250ab6c66883f73266e14615e9c8316b53c8c0850cbb185a1a6254d6f2776cac93fc52bd5708dd2d9cd10422d3f8ab3
SSDEEP

393216:RH5uBgaM2VSGjgrfD2sYtXV8htkqyxcfeCHxQ4Z56xGOaSywTd5oEIoB2vQ:RZuBgagDYtXSht5VwY3UTPIoF

Score

7^/10

discovery evasion

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/jp.pumo.planetofgreen/files/stares/updates/sta.jar	4367	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/jp.pumo.planetofgreen/files/stares/updates/sta.jar --output-vdex-fd=61 --oat-fd=66 --oat-location=/data/user/0/jp.pumo.planetofgreen/files/stares/updates/oat/x86/sta.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/jp.pumo.planetofgreen/files/stares/updates/sta.jar	4291	jp.pumo.planetofgreen

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

jp.pumo.planetofgreen
1⤵
- Loads dropped Dex/Jar
PID:4291
- getprop ro.board.platform
  2⤵
  PID:4324
- getprop ro.mediatek.platform
  2⤵
  PID:4344
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/jp.pumo.planetofgreen/files/stares/updates/sta.jar --output-vdex-fd=61 --oat-fd=66 --oat-location=/data/user/0/jp.pumo.planetofgreen/files/stares/updates/oat/x86/sta.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4367

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/jp.pumo.planetofgreen/files/stares/updates/sta.jar

Filesize
1.8MB

MD5
8ec43e10005ec4bc91c4e45b8e68e304

SHA1
66fb42cb11e77900e55cbd4a8e247841dad1c5ea

SHA256
18d90827352cf0ed3084c4f1f94d98026908f674914889e1e58c2ac5e68be63f

SHA512
6077f32c03361faa552bde6c7cb9676c6393a9b7a30a9622095e6eb93da484b29fd75edd955523c8b51d4e86fe4a19fbce5cc456f7612162dbdec76e43b563d6

Download Submit
/data/user/0/jp.pumo.planetofgreen/files/stares/updates/sta.jar

Filesize
3.5MB

MD5
a76a0eec70efc99ea0ac64c07f6bec32

SHA1
8102d17f7690ba9697f1be3de7cedfb765e70d51

SHA256
aa563dff1eff005677766ff94f60884b3ca72e1b4e0e478dd8ba781269dca37e

SHA512
dff801c2e27bf4e62a1fb04f0a120a8be7f7cabc3640195dd3caacca4c6c3741eaeeb4d9e5afe151d6b8cf38684779acff4f99d37fe784329ca6b9ecfd2cd0c0

Download Submit
/data/user/0/jp.pumo.planetofgreen/files/stares/updates/sta.jar

Filesize
3.5MB

MD5
f4e9864345c65cfda19a2f32209cc1ac

SHA1
a28bd5640006c97399085831a71f444cc9142123

SHA256
a908ee5efebad005c51ab86e6a47b56ea8f11b44129e149db376fa8d5eeb383c

SHA512
9b0f40b2f8eebed0817b5a1ab31ab61af2da9d2e3ae1f5b880b40552986e5bd192ed9d1c31c5fe74cf458a51e809f05300f1fade9e4c28a3517a3a1c6ffc5f7c

Download Submit
/storage/emulated/0/data/.systemid

Filesize
36B

MD5
340cb027d3cee868de4d73bffe55bddc

SHA1
ba820175ee394ca16f29fe3508a82dc94bf60d61

SHA256
10cb906c9f898822c363ac4c6998f46b6fdcd5b65fc32834e244eb790d6ab76f

SHA512
7ef8b56bb6280af68a920c2f4be05a5b7fc22dacadeb165f31a85105fd42c3f241ff2cb6f23531568b96c1d358d30db3df8024c44049d21d552e2353dabdab01

Download Submit