6bb074f5b0c70b418e1cc8fd1cecf9d417a2463388bc26b2ef3d96c374bcf892

Analysis

max time kernel
174s
max time network
168s
platform
android_x64
resource
android-x64-arm64-20240514-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
submitted
02/06/2024, 19:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8f3bc877489a10c7bff9a652590d92e4_JaffaCakes118.apk
Size 13.9MB
Sample240602-ym5hysda8v
SHA256 6bb074f5b0c70b418e1cc8fd1cecf9d417a2463388bc26b2ef3d96c374bcf892
MD5 8f3bc877489a10c7bff9a652590d92e4
SHA1 28734e3053d9e46723091ec3040503a46539806b
SHA512 857e44fc5bafd169ec9fb231d981f44610cd762089fbcb178f57f39667ceb0a96419317e1657b8d5347886250272af0fcbc5b80ce4faf1b98775ab60915bb6ef
SSDEEP 393216:p5XnRy7kWF5PHUmIMLzNJYbhNoR5BHnEUo:plnooohIMdJYE5B4
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection credential_access discovery evasion impact

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	io.dcloud.H59529EFD

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	io.dcloud.H59529EFD

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/io.dcloud.H59529EFD/[email protected]	4623	io.dcloud.H59529EFD

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	io.dcloud.H59529EFD

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	io.dcloud.H59529EFD

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	io.dcloud.H59529EFD

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	io.dcloud.H59529EFD

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	io.dcloud.H59529EFD

io.dcloud.H59529EFD
1⤵
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4623

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

test_app

Path /data/data/io.dcloud.H59529EFD/shared_prefs_ext/test_app
Size 24B
SHA256 35c404a89ff2f0ebdb76cb456bfe78c7f4d49a984218f979b50f262607b00a89
MD5 5a30e992ffb498ed79c34e3e81c25857
SHA1 5e91a95002b067a78b0a11161aa6488d887559b9
SHA512 3f959c734b7f2449080b3010b8848dbcd68ec02d1c8c4f15d5dd507f414e4361cb852054b5b5a0973eaf667de6eb16658b0a314521cd8118b68dd27199424ad4
MD5 SHA1 SHA512

Submit Download

A3AEECD8.dex

Path /data/user/0/io.dcloud.H59529EFD/.00000000000/A3AEECD8.dex
Size 63KB
SHA256 f0ead1ad60e0cc310c1a40685c28fc7a69aa346604552816c51dd3c1718a1e76
MD5 ed73a80eb949bacc52428b8d5a087fa5
SHA1 07e973549a2cee61ffeeb6439abc419cd8a489a9
SHA512 4bc26c18ca3a2edfe38ca1e14ad1e1415268b4a69cdff3c0f8e2b8fa910c67c2e4bc4f32c21274e586e8e139122ea3dbde7ec507c4722b4a9a778ee2598090b8
SSDEEP 768:2UJAegWguWxVIwIkH9nn3ETgu3kltfit3EnJF/+A2BCOjVDDHcLoqrTARuIZkMRy:geuNS+3EU8klt03EndkRDDHEMTQi1Gt
MD5 SHA1 SHA512 SSDEEP

Submit Download

A3AEECD8.dex

Path /data/user/0/io.dcloud.H59529EFD/.00000000000/A3AEECD8.dex
Size 63KB
SHA256 3aa6caecfcd101531539147e01382bc530b4fdc61e98937d63cc4648793c6a45
MD5 5061e4948844f7d366972ac8005e9f13
SHA1 a2b79a1c79afb095ddebf0f16a1f9db64482bcaf
SHA512 223d18ce248912df18cdea3c8e864ea5e6ec058ca42cc5fde738188c54abcd260d7f24ac53d4987d3e32f4ae3e1e40e01354054d035bb100eef51b2d695f5299
SSDEEP 768:X3L4QVlsw4IC4KXosXYm7QjtLtDcHIQncDxfuAQuJ+jVuphag/yJ6Y3cIsPLb5zs:X77VX4gyYvJKbcDAFomW5z6GbS
MD5 SHA1 SHA512 SSDEEP

Submit Download

eje3cnc

Path /data/user/0/io.dcloud.H59529EFD/files/cnc3ejE6/eje3cnc
Size 39B
SHA256 5ba33c69421ad27727832442cb5939d5bc853acecd0d8162d7c10a6b96757dcf
MD5 7769d4507985f59116153463f09235a2
SHA1 b081e84d14300ac7a7947aade9c025fa83bc17fb
SHA512 ce5bb431a31eaba24c0cf467bedb1abee2205b74c4533067058b09ce7e8f9480b8baa01866e3dc89d1800d07da6007f36c1b4fea811e3da164b187903480d29f
MD5 SHA1 SHA512

Submit Download

.imei.txt

Path /storage/emulated/0/.imei.txt
Size 32B
SHA256 9e5002f4123f371edb06b9a1acfac03385343f1c547934a91b4f8cc0591a746e
MD5 da99e0be018ca38b6b8cd1ec9ee27b54
SHA1 8bbd1446550dfb22478813a24a989573ac8dcb53
SHA512 6554488602c6ff90f51ec806521ecf3204c88a3181a4b35498517950976216f8ad5581aed2f3522c3651666ce5a687eea1cd57852a16f4ce390f5f4697f80b56
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads