b30b41d71137a23f0a7c29c7954b781998db9f2b2440b6ba8cca5debc2127a92

General

Target
957ee94b33acf6a8a482574dadf4a5d3_JaffaCakes118.apk
Size 699KB
Sample240604-tsxcbacf21
SHA256 b30b41d71137a23f0a7c29c7954b781998db9f2b2440b6ba8cca5debc2127a92
MD5 957ee94b33acf6a8a482574dadf4a5d3
SHA1 61f82866aaf3144660d5c46ed527206514c8b21f
SHA512 1606b5ecc2441545604827439ed12bd8272c130f971d629871f811f957ae1ccfd1f20bad15cf75486113bc7ca4ccdd7719cf5dc224f4c4658b97f6be579a654f
SSDEEP 12288:GsGhcUBzjcKDtU9Cq2TbD6+iBshVBhJ0BxZyiUH7mycKqDFTIKn1MQWnA+RhffmP:GsG3rt2CVK+iGhVBEB+H7KFTJ+REP
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection credential_access discovery evasion impact stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4615	com.gladder.videoyy

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.gladder.videoyy/app_ttmp/t.jar	4615	com.gladder.videoyy

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.gladder.videoyy

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.gladder.videoyy

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.gladder.videoyy

com.gladder.videoyy
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:4615

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Hide Artifacts

1

T1628

Suppress Application Icon

1

T1628.001

Virtualization/Sandbox Evasion

1

T1633

System Checks

1

T1633.001

Credential Access

Clipboard Data

1

T1414

Discovery

Software Discovery

1

T1418

Security Software Discovery

1

T1418.001

System Information Discovery

1

T1426

Lateral Movement

Collection

Clipboard Data

1

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1

T1471

Data Manipulation

1

T1641

Transmitted Data Manipulation

1

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

t.jar

Path /data/user/0/com.gladder.videoyy/app_ttmp/t.jar
Size 220KB
SHA256 8eabaa1e5b64a753f5aeeee5e02ce584ab8e65c5edfc5e3bdf38f25462024dc9
MD5 e3447d5435bc33cb03183a57f3474f1e
SHA1 13b41650892f79bff94f3edf8689c3218ba962d0
SHA512 e4e7906b57056c413942ea3f5fa91cf3bc5f508a2e9c8273524c0cf84d7189f26b770f0130f57218ecba8982ac337f46a6d11d10dd8f8dc4f5f0c0fa02447ab6
SSDEEP 6144:+rVo2wYP4syGjMgNqjD5DNIiLAltpa2zRsfgRA8s0Z+:Ko2p4syZNIi4tp5SyA8s0Z+
MD5 SHA1 SHA512 SSDEEP

Submit Download

t.jar

Path /data/user/0/com.gladder.videoyy/app_ttmp/t.jar
Size 469KB
SHA256 58665fea32655b49869f9f7e6812f36906cd75dbe4af3f1d497e9bdeaf33fc53
MD5 4e1e6aa783bb8974b1436f0100156de6
SHA1 8d2d20dbf86960783c889dd9834e281bac850642
SHA512 0a45ddb1269a3cd8a789ce3b9edef67e69c2968480938aac76e9e975c4cce049a42ebbcf0cf4058eef117e1041a1e7a8f15d504c5a9ca95b1b3d014ca91aadbf
SSDEEP 6144:gdEwFRtrzPqGX8H9OBsOcx9X1+PvDem+ChRItqa5A7BBHvL8OC1:gbFRxyGMNrcPvDh+C0z5AzPoOC1
MD5 SHA1 SHA512 SSDEEP

Download

com.gladder.videoyyb

Path /data/user/0/com.gladder.videoyy/databases/com.gladder.videoyyb
Size 72KB
SHA256 bf38737929883e895d35a4ad53209d610dd5c4051bd40be2c5387cafa0a4e29b
MD5 5b0e1b9be5b683c8c15763c02891e03b
SHA1 07e857f5e4936421db76a20f2866cb2bd9e89885
SHA512 71eb25691d94e765bed305cf32fa143ac390de43b271c1be1eec65421f8ea71d5a51683ac938c75c446bbfcd13ec7ed01589a322fc6d6a8d3f4d6d8368926673
SSDEEP 48:Td22dti3Hi6MbmX9MJbUKZb9pMJbc6sNd7UMJbEyAsInlnIH2bmX9MJb8O18OHEV:fti3H4mtqb9brqborIqb5cQsmtqbx
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.gladder.videoyyb-journal

Path /data/user/0/com.gladder.videoyy/databases/com.gladder.videoyyb-journal
Size 512B
SHA256 a91ff000e456b69e4604c6c648033fc31dd28f7d68ad8843ed2d03ae176a3696
MD5 b1181c14c0edc45644233387938a4994
SHA1 b581a1aa1124f7e19d46c902a50d6bfc86f1640e
SHA512 ef028fb77e1deb8c746ddb664f9d93e82b76cdd5356915829467d7a0b85725df98048b29f645e08f8ec7d5b66b0074f0bd1f3aa1f87f58a45c4d12b7b3fbcef8
MD5 SHA1 SHA512

Submit Download

com.gladder.videoyyb-journal

Path /data/user/0/com.gladder.videoyy/databases/com.gladder.videoyyb-journal
Size 8KB
SHA256 eddb66db30f642c548c3a0e66a54dc38f5321d887e5790edf6277e6713435a7c
MD5 2d22197c8a8b3f2573bbe943c7dab2f9
SHA1 cb87a5f93cc6bbd18d1a0ba385ea9f524b93dd8e
SHA512 edee2130e5fbd94d961fb94fb751e244627eab8ac3eb9abcb25d227c135524f0034afa685741261b2bb4824d799fb0aedea12e532459ec824f2f650ce7590adc
SSDEEP 6:7+/l94im/gn1Ahtng9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKTn:7+tdYbqLiuWdYRmBEyPbo
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.gladder.videoyyb-journal

Path /data/user/0/com.gladder.videoyy/databases/com.gladder.videoyyb-journal
Size 8KB
SHA256 ada1e43afde1658578d2950a92a1465d22fa7760135e716879f38066e638fe5f
MD5 330be2a7bfdcf14a2b5496c4e7f1af73
SHA1 18fb7d58c1d2e2201ec17a4d0f0c030aaf759696
SHA512 c8bf18615033acce392039543057524c42a9ebaa54a7bc706a0dec30ae7e3fce259d565890941d42df586b6ed7cf65f2138fc4044226d218bb6bb4f8c05ac23c
SSDEEP 6:7+/l97tgPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKits//Tn:7+tP4qLJdeWRmBEyPb3sXT
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.gladder.videoyyb-journal

Path /data/user/0/com.gladder.videoyy/databases/com.gladder.videoyyb-journal
Size 12KB
SHA256 cc50d7415262dda92a8d247c4b3e8f7fce4d3e42e337fdad279d28b79647b96e
MD5 866bb55e1c4aacf2ef7536e2be88be30
SHA1 4b3b74ccfa7a8c1cb175945c8e4026b772a4ad22
SHA512 b3ff45ab9fc24a756cea9396520d60a75b899433f8d3800a7e2b6a5883bd1ca54588cf87026c9d981badd9830ec934bde68a1be6a870f3af3a4c744d06deb310
SSDEEP 96:7Bqti3H4mtqb9brqborIqb5cQsmtqbxDo:7Bqaokdo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads