Analysis

  • max time kernel
    179s
  • max time network
    167s
  • platform
    android_x64
  • resource
    android-x64-20240514-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
  • submitted
    03-06-2024 12:18

General

  • Target

    91c22c89a4696a03cf747b1b8640a912_JaffaCakes118.apk

  • Size

    315KB

  • MD5

    91c22c89a4696a03cf747b1b8640a912

  • SHA1

    1741c063d1ce7ef880658b632631920c9eccb4ac

  • SHA256

    5e22b0f84b9d6e30dabd72ad98a8f63117ccea76090e43003db62e2bbf739076

  • SHA512

    f001e298ac32c1d7de9e252d2fa8c4bf4e922cd0d4521b010a75ff82900c7032bb44fd604557dfcd78124aa2e282abc823d2b423efc0a8cd2244368ee9ac0dca

  • SSDEEP

    6144:iyocgmGIeveXLT9joHDrXdmYGw71KbQfmWAMPMSMepZMawi:iyfII9X9EHDztGlbQflUvepqVi

Malware Config

Signatures

  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
  • Checks Android system properties for emulator presence. 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

  • Checks known Qemu pipes. 1 TTPs 2 IoCs

    Checks for known pipes used by the Android emulator to communicate with the host.

  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Acquires the wake lock 1 IoCs
  • Checks if the internet connection is available 1 TTPs 1 IoCs
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
  • Reads information about phone network operator. 1 TTPs

Processes

  • com.plmbvzuvco.elnsyn
    1⤵
    • Removes its main activity from the application launcher
    • Checks Android system properties for emulator presence.
    • Checks CPU information
    • Checks known Qemu pipes.
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Acquires the wake lock
    • Checks if the internet connection is available
    PID:5206

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.plmbvzuvco.elnsyn/app_xmqoembomsv/cdfkgoexhc.jar
    Filesize

    121KB

    MD5

    60a8dd0c3cb31ca0858bec1ebe6af441

    SHA1

    ec42790843820a3df940533bfb7f4b42e102c57d

    SHA256

    2437b2b15f9e9f5c4c8eacbb1b0a0f86bf9ef8dde76f6436536f900e0e80f088

    SHA512

    23bf26198da382292af17acdcfc0db13f198a9a6e39153248c26f904aba539b55ba952a1b622416d128f50c77085371fe03e1225ebcd536f269a6bfb5dca3cea

  • /data/data/com.plmbvzuvco.elnsyn/app_xmqoembomsv/oat/cdfkgoexhc.jar.cur.prof
    Filesize

    460B

    MD5

    087a0f0d9094ceb607fb85698de48b97

    SHA1

    cc3c192eba4429019f244ee522349a33cf15225b

    SHA256

    fb5bfdb50a97defbb3df9011e74fe90d0704a2559085e5d003bbccc463591bf0

    SHA512

    3b1ac811804c2f038f08273559cabf5ea6f15ca64c2e84f3f4e98df59d309c2d0d59c5c5f598734bed91da516904b3eeb9ebcb3f5e0f88809aad834d11d9347e

  • /data/user/0/com.plmbvzuvco.elnsyn/app_xmqoembomsv/cdfkgoexhc.jar
    Filesize

    286KB

    MD5

    643cf358af2c310fa041c73fb0f4e0b2

    SHA1

    7b85a3cee4752705f7b854b1278a915c83703812

    SHA256

    6cae3df46a3cc220e9cec9d0fecd2956a9a5c040e1c9cdac94a3bcbd7b8047f7

    SHA512

    590eab2509a35dcec3b5413eb0166e5e6b80b2b06a0c2cdc502cc26781f1c538d499b53cbd1e6c7550758d7e05ea9b13fb9d560ecff54eace83ffce8b66f5e85