d7d6d292488dd48e2187a2b26e72b04b9312b7d3febc9fb0f41a2903de4bffbb

Analysis

max time kernel
7s
max time network
132s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
02/06/2024, 02:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8ca71e29542f70fba4d9721257fc14f5_JaffaCakes118.apk
Size

30.6MB
MD5

8ca71e29542f70fba4d9721257fc14f5
SHA1

6203083ccf792016ef956f282af1cc6c75d300f5
SHA256

d7d6d292488dd48e2187a2b26e72b04b9312b7d3febc9fb0f41a2903de4bffbb
SHA512

65dbcc121d5d58931bf494429c8b60109a28dbc2bdfacd43a2903cd678848a849d9449d0def3584b85c464fc107af7a77021cb215a41d9f8a3fcaa171439b485
SSDEEP

786432:s/iNo7RLzSPccLtmE63iBCKanFCa6U47g9kfU83jXLq8W:sJRvzM8JRnF1utZXe

Score

7^/10

evasion impact

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.etlong.jxbd/app_push_lib/plugin-deploy.jar	4311	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.etlong.jxbd/app_push_lib/plugin-deploy.jar --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.etlong.jxbd/app_push_lib/oat/x86/plugin-deploy.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.etlong.jxbd/app_push_lib/plugin-deploy.jar	4284	com.etlong.jxbd

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.etlong.jxbd

com.etlong.jxbd
1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4284
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.etlong.jxbd/app_push_lib/plugin-deploy.jar --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.etlong.jxbd/app_push_lib/oat/x86/plugin-deploy.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4311

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact