Analysis

  • max time kernel
    179s
  • max time network
    131s
  • platform
    android_x86
  • resource
    android-x86-arm-20240514-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
  • submitted
    03-06-2024 12:18

General

  • Target

    91c22c89a4696a03cf747b1b8640a912_JaffaCakes118.apk

  • Size

    315KB

  • MD5

    91c22c89a4696a03cf747b1b8640a912

  • SHA1

    1741c063d1ce7ef880658b632631920c9eccb4ac

  • SHA256

    5e22b0f84b9d6e30dabd72ad98a8f63117ccea76090e43003db62e2bbf739076

  • SHA512

    f001e298ac32c1d7de9e252d2fa8c4bf4e922cd0d4521b010a75ff82900c7032bb44fd604557dfcd78124aa2e282abc823d2b423efc0a8cd2244368ee9ac0dca

  • SSDEEP

    6144:iyocgmGIeveXLT9joHDrXdmYGw71KbQfmWAMPMSMepZMawi:iyfII9X9EHDztGlbQflUvepqVi

Malware Config

Signatures

  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
  • Requests changing the default SMS application. 2 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

  • Checks known Qemu pipes. 1 TTPs 2 IoCs

    Checks for known pipes used by the Android emulator to communicate with the host.

  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Acquires the wake lock 1 IoCs
  • Checks if the internet connection is available 1 TTPs 1 IoCs

Processes

  • com.plmbvzuvco.elnsyn
    1⤵
    • Removes its main activity from the application launcher
    • Requests changing the default SMS application.
    • Checks CPU information
    • Checks known Qemu pipes.
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Acquires the wake lock
    • Checks if the internet connection is available
    PID:4216
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.plmbvzuvco.elnsyn/app_xmqoembomsv/cdfkgoexhc.jar --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.plmbvzuvco.elnsyn/app_xmqoembomsv/oat/x86/cdfkgoexhc.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4312

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.plmbvzuvco.elnsyn/app_xmqoembomsv/cdfkgoexhc.jar
    Filesize

    121KB

    MD5

    60a8dd0c3cb31ca0858bec1ebe6af441

    SHA1

    ec42790843820a3df940533bfb7f4b42e102c57d

    SHA256

    2437b2b15f9e9f5c4c8eacbb1b0a0f86bf9ef8dde76f6436536f900e0e80f088

    SHA512

    23bf26198da382292af17acdcfc0db13f198a9a6e39153248c26f904aba539b55ba952a1b622416d128f50c77085371fe03e1225ebcd536f269a6bfb5dca3cea

  • /data/data/com.plmbvzuvco.elnsyn/app_xmqoembomsv/oat/cdfkgoexhc.jar.cur.prof
    Filesize

    460B

    MD5

    03de69e7add65e1a09a448a1fcb983ea

    SHA1

    e8447a6a3a52fa5b6e1ce66889a0bc715c7a3ce7

    SHA256

    52f960c15622508193600ef5567f003f0bbb344a9182fdbe41d4c7ab2f29f0ef

    SHA512

    9f4718dd8c1ad57de4aca037a94cfef2092f35b28ab06e019acd22d577867359539f1fa90d237eb686d9d3014c5e3ba9dd50f7ee35cbb4843c86a371f33c4205

  • /data/user/0/com.plmbvzuvco.elnsyn/app_xmqoembomsv/cdfkgoexhc.jar
    Filesize

    286KB

    MD5

    0676ad903b2c15598655fdd86f749979

    SHA1

    8a110c283475d67ba52645756b6efb48b657ced5

    SHA256

    a479966c9d1fdfd47b55e73aad22d46e480222153d397875a6fcfee9a8b6a4b7

    SHA512

    bc49bf9712f4b89b17400545c5114a66462b1979b8f0f8f8145853fcfa0a3c2e77aec7f1fc4a84d71b782230e3e6be44f5267ed52bc35bbf87304a8048fc0ef8

  • /data/user/0/com.plmbvzuvco.elnsyn/app_xmqoembomsv/cdfkgoexhc.jar
    Filesize

    286KB

    MD5

    643cf358af2c310fa041c73fb0f4e0b2

    SHA1

    7b85a3cee4752705f7b854b1278a915c83703812

    SHA256

    6cae3df46a3cc220e9cec9d0fecd2956a9a5c040e1c9cdac94a3bcbd7b8047f7

    SHA512

    590eab2509a35dcec3b5413eb0166e5e6b80b2b06a0c2cdc502cc26781f1c538d499b53cbd1e6c7550758d7e05ea9b13fb9d560ecff54eace83ffce8b66f5e85