Analysis
-
max time kernel
179s -
max time network
131s -
platform
android_x64 -
resource
android-x64-arm64-20240514-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system -
submitted
03-06-2024 12:18
Static task
static1
Behavioral task
behavioral1
Sample
91c22c89a4696a03cf747b1b8640a912_JaffaCakes118.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral2
Sample
91c22c89a4696a03cf747b1b8640a912_JaffaCakes118.apk
Resource
android-x64-20240514-en
General
-
Target
91c22c89a4696a03cf747b1b8640a912_JaffaCakes118.apk
-
Size
315KB
-
MD5
91c22c89a4696a03cf747b1b8640a912
-
SHA1
1741c063d1ce7ef880658b632631920c9eccb4ac
-
SHA256
5e22b0f84b9d6e30dabd72ad98a8f63117ccea76090e43003db62e2bbf739076
-
SHA512
f001e298ac32c1d7de9e252d2fa8c4bf4e922cd0d4521b010a75ff82900c7032bb44fd604557dfcd78124aa2e282abc823d2b423efc0a8cd2244368ee9ac0dca
-
SSDEEP
6144:iyocgmGIeveXLT9joHDrXdmYGw71KbQfmWAMPMSMepZMawi:iyfII9X9EHDztGlbQflUvepqVi
Malware Config
Signatures
-
Requests changing the default SMS application. 2 TTPs 1 IoCs
-
Checks Android system properties for emulator presence. 1 TTPs 6 IoCs
Processes:
com.plmbvzuvco.elnsyndescription ioc process Accessed system property key: ro.hardware com.plmbvzuvco.elnsyn Accessed system property key: ro.product.device com.plmbvzuvco.elnsyn Accessed system property key: ro.product.model com.plmbvzuvco.elnsyn Accessed system property key: ro.product.name com.plmbvzuvco.elnsyn Accessed system property key: ro.bootloader com.plmbvzuvco.elnsyn Accessed system property key: ro.bootmode com.plmbvzuvco.elnsyn -
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
-
Checks known Qemu pipes. 1 TTPs 2 IoCs
Checks for known pipes used by the Android emulator to communicate with the host.
Processes:
com.plmbvzuvco.elnsynioc process /dev/socket/qemud com.plmbvzuvco.elnsyn /dev/qemu_pipe com.plmbvzuvco.elnsyn -
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.plmbvzuvco.elnsynioc pid process /data/user/0/com.plmbvzuvco.elnsyn/app_xmqoembomsv/cdfkgoexhc.jar 4642 com.plmbvzuvco.elnsyn -
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
Processes:
com.plmbvzuvco.elnsyndescription ioc process Framework service call android.app.IActivityManager.getRunningAppProcesses com.plmbvzuvco.elnsyn -
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
Processes:
com.plmbvzuvco.elnsyndescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock com.plmbvzuvco.elnsyn -
Checks if the internet connection is available 1 TTPs 1 IoCs
Processes:
com.plmbvzuvco.elnsyndescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.plmbvzuvco.elnsyn -
Reads information about phone network operator. 1 TTPs
Processes
-
com.plmbvzuvco.elnsyn1⤵
- Removes its main activity from the application launcher
- Requests changing the default SMS application.
- Checks Android system properties for emulator presence.
- Checks CPU information
- Checks known Qemu pipes.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Acquires the wake lock
- Checks if the internet connection is available
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/user/0/com.plmbvzuvco.elnsyn/app_xmqoembomsv/cdfkgoexhc.jarFilesize
121KB
MD560a8dd0c3cb31ca0858bec1ebe6af441
SHA1ec42790843820a3df940533bfb7f4b42e102c57d
SHA2562437b2b15f9e9f5c4c8eacbb1b0a0f86bf9ef8dde76f6436536f900e0e80f088
SHA51223bf26198da382292af17acdcfc0db13f198a9a6e39153248c26f904aba539b55ba952a1b622416d128f50c77085371fe03e1225ebcd536f269a6bfb5dca3cea
-
/data/user/0/com.plmbvzuvco.elnsyn/app_xmqoembomsv/cdfkgoexhc.jarFilesize
286KB
MD5643cf358af2c310fa041c73fb0f4e0b2
SHA17b85a3cee4752705f7b854b1278a915c83703812
SHA2566cae3df46a3cc220e9cec9d0fecd2956a9a5c040e1c9cdac94a3bcbd7b8047f7
SHA512590eab2509a35dcec3b5413eb0166e5e6b80b2b06a0c2cdc502cc26781f1c538d499b53cbd1e6c7550758d7e05ea9b13fb9d560ecff54eace83ffce8b66f5e85