Analysis
-
max time kernel
179s -
max time network
131s -
platform
android_x86 -
resource
android-x86-arm-20240514-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system -
submitted
03-06-2024 12:18
Static task
static1
Behavioral task
behavioral1
Sample
91c22c89a4696a03cf747b1b8640a912_JaffaCakes118.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral2
Sample
91c22c89a4696a03cf747b1b8640a912_JaffaCakes118.apk
Resource
android-x64-20240514-en
General
-
Target
91c22c89a4696a03cf747b1b8640a912_JaffaCakes118.apk
-
Size
315KB
-
MD5
91c22c89a4696a03cf747b1b8640a912
-
SHA1
1741c063d1ce7ef880658b632631920c9eccb4ac
-
SHA256
5e22b0f84b9d6e30dabd72ad98a8f63117ccea76090e43003db62e2bbf739076
-
SHA512
f001e298ac32c1d7de9e252d2fa8c4bf4e922cd0d4521b010a75ff82900c7032bb44fd604557dfcd78124aa2e282abc823d2b423efc0a8cd2244368ee9ac0dca
-
SSDEEP
6144:iyocgmGIeveXLT9joHDrXdmYGw71KbQfmWAMPMSMepZMawi:iyfII9X9EHDztGlbQflUvepqVi
Malware Config
Signatures
-
Requests changing the default SMS application. 2 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
-
Checks known Qemu pipes. 1 TTPs 2 IoCs
Checks for known pipes used by the Android emulator to communicate with the host.
Processes:
com.plmbvzuvco.elnsynioc process /dev/socket/qemud com.plmbvzuvco.elnsyn /dev/qemu_pipe com.plmbvzuvco.elnsyn -
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
Processes:
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.plmbvzuvco.elnsyn/app_xmqoembomsv/cdfkgoexhc.jar --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.plmbvzuvco.elnsyn/app_xmqoembomsv/oat/x86/cdfkgoexhc.odex --compiler-filter=quicken --class-loader-context=&com.plmbvzuvco.elnsynioc pid process /data/user/0/com.plmbvzuvco.elnsyn/app_xmqoembomsv/cdfkgoexhc.jar 4312 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.plmbvzuvco.elnsyn/app_xmqoembomsv/cdfkgoexhc.jar --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.plmbvzuvco.elnsyn/app_xmqoembomsv/oat/x86/cdfkgoexhc.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.plmbvzuvco.elnsyn/app_xmqoembomsv/cdfkgoexhc.jar 4216 com.plmbvzuvco.elnsyn -
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
Processes:
com.plmbvzuvco.elnsyndescription ioc process Framework service call android.app.IActivityManager.getRunningAppProcesses com.plmbvzuvco.elnsyn -
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
com.plmbvzuvco.elnsyndescription ioc process Framework service call android.app.IActivityManager.registerReceiver com.plmbvzuvco.elnsyn -
Acquires the wake lock 1 IoCs
Processes:
com.plmbvzuvco.elnsyndescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock com.plmbvzuvco.elnsyn -
Checks if the internet connection is available 1 TTPs 1 IoCs
Processes:
com.plmbvzuvco.elnsyndescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.plmbvzuvco.elnsyn
Processes
-
com.plmbvzuvco.elnsyn1⤵
- Removes its main activity from the application launcher
- Requests changing the default SMS application.
- Checks CPU information
- Checks known Qemu pipes.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.plmbvzuvco.elnsyn/app_xmqoembomsv/cdfkgoexhc.jar --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.plmbvzuvco.elnsyn/app_xmqoembomsv/oat/x86/cdfkgoexhc.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.plmbvzuvco.elnsyn/app_xmqoembomsv/cdfkgoexhc.jarFilesize
121KB
MD560a8dd0c3cb31ca0858bec1ebe6af441
SHA1ec42790843820a3df940533bfb7f4b42e102c57d
SHA2562437b2b15f9e9f5c4c8eacbb1b0a0f86bf9ef8dde76f6436536f900e0e80f088
SHA51223bf26198da382292af17acdcfc0db13f198a9a6e39153248c26f904aba539b55ba952a1b622416d128f50c77085371fe03e1225ebcd536f269a6bfb5dca3cea
-
/data/data/com.plmbvzuvco.elnsyn/app_xmqoembomsv/oat/cdfkgoexhc.jar.cur.profFilesize
460B
MD503de69e7add65e1a09a448a1fcb983ea
SHA1e8447a6a3a52fa5b6e1ce66889a0bc715c7a3ce7
SHA25652f960c15622508193600ef5567f003f0bbb344a9182fdbe41d4c7ab2f29f0ef
SHA5129f4718dd8c1ad57de4aca037a94cfef2092f35b28ab06e019acd22d577867359539f1fa90d237eb686d9d3014c5e3ba9dd50f7ee35cbb4843c86a371f33c4205
-
/data/user/0/com.plmbvzuvco.elnsyn/app_xmqoembomsv/cdfkgoexhc.jarFilesize
286KB
MD50676ad903b2c15598655fdd86f749979
SHA18a110c283475d67ba52645756b6efb48b657ced5
SHA256a479966c9d1fdfd47b55e73aad22d46e480222153d397875a6fcfee9a8b6a4b7
SHA512bc49bf9712f4b89b17400545c5114a66462b1979b8f0f8f8145853fcfa0a3c2e77aec7f1fc4a84d71b782230e3e6be44f5267ed52bc35bbf87304a8048fc0ef8
-
/data/user/0/com.plmbvzuvco.elnsyn/app_xmqoembomsv/cdfkgoexhc.jarFilesize
286KB
MD5643cf358af2c310fa041c73fb0f4e0b2
SHA17b85a3cee4752705f7b854b1278a915c83703812
SHA2566cae3df46a3cc220e9cec9d0fecd2956a9a5c040e1c9cdac94a3bcbd7b8047f7
SHA512590eab2509a35dcec3b5413eb0166e5e6b80b2b06a0c2cdc502cc26781f1c538d499b53cbd1e6c7550758d7e05ea9b13fb9d560ecff54eace83ffce8b66f5e85