c86ae6457bc92170c3ae7ba6fef64d4002cfa1281419677833023e070f282120

General

Target
8b0354a1b5a011f8dfe3f2236710f30b_JaffaCakes118.apk
Size 4.6MB
Sample240601-tp7zmsgc9z
SHA256 c86ae6457bc92170c3ae7ba6fef64d4002cfa1281419677833023e070f282120
MD5 8b0354a1b5a011f8dfe3f2236710f30b
SHA1 c8625eca23c31be2fb312b7fdf97e6c510d5dc90
SHA512 7f557ba8870019f4ccef9ef118514ddb884eccc3e7e76c6d9585b150be6f44b08b079cd2c0835d59a9de20771f5e2c90559748d2d7f2df17e6401ff0cf38d1e1
SSDEEP 98304:erO2kHUUhgu5LRBrN0wBAsORq0PnEG21W5VnSk3Q3H2cdq/jf+jO:er4Hg29ddmhvZ2mlS/WXf+K
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery persistence

Malware Config

Signatures

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.mo8.andashi.movaxin

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.mo8.andashi.movaxin

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.mo8.andashi.movaxin

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests dangerous framework permissions 7 IoCs

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE

com.mo8.andashi.movaxin
1⤵
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:4306

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

1

T1424

System Network Configuration Discovery

1

T1422

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.YFlurrySenderIndex.info.AnalyticsData_48RJJP7ZCZZBB6KMMWW5_239

Path /data/data/com.mo8.andashi.movaxin/files/.YFlurrySenderIndex.info.AnalyticsData_48RJJP7ZCZZBB6KMMWW5_239
Size 88B
SHA256 b00810813c58e2708999894e8c3551cb8bb94d33cdc4f356b19d25bcc9a59984
MD5 8eeb28203acdc384b014ffafb47d93e8
SHA1 6c30e7d532128b24fc4fe935c6488ed194d587be
SHA512 9d32a5f58c056666988cb776ec9de0416a2092613439ddf64669b07195e08a576c8fc8b7a009035d98c2617b025392167f6a7c9f71ab38d55da9ec0f8ae17c53
MD5 SHA1 SHA512

Submit Download

.YFlurrySenderIndex.info.AnalyticsMain

Path /data/data/com.mo8.andashi.movaxin/files/.YFlurrySenderIndex.info.AnalyticsMain
Size 72B
SHA256 e768be1bb891877d5ddb4608077b788953bd2a35f830872d6558354bcb345fec
MD5 deae4f12e8444d320ae1db9d7c268231
SHA1 7ad2b7af358cc715992a6336aa0f00f08b3241d6
SHA512 a2f3647270e1ccdb1f1160f19844c304cfa38b935bd4108459f2e307e8cddbb3b605cc13099fe0c33616c61c128b8bbbf8ad75921fbbd10f1f43388acd32870d
MD5 SHA1 SHA512

Submit Download

.yflurrydatasenderblock.ff6b718d-22df-4fed-9a6e-d59becca3cc4

Path /data/data/com.mo8.andashi.movaxin/files/.yflurrydatasenderblock.ff6b718d-22df-4fed-9a6e-d59becca3cc4
Size 282B
SHA256 5a6a1e1733332e9a14fa67d05acac6babf5ce6a5f18babe0b1e934330624d737
MD5 9808a77710b6d2f5dc4e2337e59ca4d2
SHA1 e4a99e4e307ede6928d07c15fc06b06d476f22b9
SHA512 8e970a78a32cf64130c9e3946b64fa1c4e9bf338e5dcd1520168a965786a3c6f71701d3d48d0d5dc45a27092a637e112cc655008c75bed52502dbba5c8a92006
MD5 SHA1 SHA512

Submit Download

1.apk

Path /data/data/com.mo8.andashi.movaxin/files/apks/1.apk
Size 448KB
SHA256 12d861b4b4ccfafd1d8c5d0c39a5119922bf5d14ece78cb2b980568bf81e8e3d
MD5 11cf5196ce1eea19b87cb85e7180bfb6
SHA1 85844ed8977263c5fa8c1e9e49be993037c73b27
SHA512 b168c7c1dfff8a36e76e6f0a1ee319dd6da8017e033b66890d319ef2ef6d66e5db1ba6daf79effb94a5a9b3572abd10edc52793f38cd8e36966e2500f4383551
SSDEEP 12288:rxyKITftT2WVWWhKi8KGwZLyXyPEO9nhW:rJkVamH8KzLyXGEsnhW
MD5 SHA1 SHA512 SSDEEP

Submit Download

1432_1586_113-va.apk

Path /data/data/com.mo8.andashi.movaxin/files/apks/1432_1586_113-va.apk
Size 638KB
SHA256 add3092d624c73bc5e6e65a377836425900f2c696c72199a164791d6df710780
MD5 f7ecf3844203dc155e9fecd6ce557e9e
SHA1 31bb3c355cb823e11efa8230e2e0c07a60a4677a
SHA512 55b7d86cef37c3991c1ceaf30603d91773e42ebd6f3dad42edf167ceb3db59997c3442b0b5f4b24453e725e7f0656def448a7163a00474b96c79319dd25555f7
SSDEEP 3:7qu/UWIIw9y:7d/UWIIw9y
MD5 SHA1 SHA512 SSDEEP

Submit Download

2.apk

Path /data/data/com.mo8.andashi.movaxin/files/apks/2.apk
Size 638KB
SHA256 5c2593a7f1647e975e1fb318fdc8e36959248d461abe877e96e0601b9c683609
MD5 7bec4da4ec9e8593e7e2f4ed3d538685
SHA1 8d8c2be5dd63cfad21ac39e26d301511b98e65ca
SHA512 7e77d18c636c5d347a5078d79e89d58fefaa59d7a3f96f25d9cc25c7a1bca53e263643b5d87a649818ad8ff4d8c853156f2f13b3a93be1c3b280fb35babc7289
SSDEEP 12288:7k+G4249VL+J6/xK+b0hbZnGNhSdHO8RJLhQXSPy+2mGmkek5grr6to9:4Y2YD4o0hbtuKLh+ms5gr3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads