b152a6b442b4551b85a132eefe204c323d9e0d1a55808b4cf3f1bd757948e744

Analysis

max time kernel
179s
max time network
153s
platform
android_x64
resource
android-x64-20240603-en
resource tags

androidarch:x64arch:x86image:android-x64-20240603-enlocale:en-usos:android-10-x64system
submitted
05/06/2024, 17:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
98b6ebbf3c5a77ac4ec01134f7f28d57_JaffaCakes118.apk
Size 209KB
Sample240605-vmxxbsde38
SHA256 b152a6b442b4551b85a132eefe204c323d9e0d1a55808b4cf3f1bd757948e744
MD5 98b6ebbf3c5a77ac4ec01134f7f28d57
SHA1 ba4f2c1ebdc64ae238f04f6ceac67bdf2f5e6dd2
SHA512 a63b8f68859d4e7dd8b9847afe5757f6e676d72f9cc63ef109e754453619ce2d1850b2cdfe85872009bfa15dcac9347ca477f828e9a948fbfad1e6b61a9a5c64
SSDEEP 6144:8F7tuHt51hKzjc/vBu6BLxLgufI/6NEJMz2Cdt:guZhKOukLBguf0ZJMjt
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion impact persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4997	com.beacon.drill

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.beacon.drill

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.beacon.drill

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.beacon.drill

com.beacon.drill
1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
PID:4997

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

aa8fd1cf-a6b2-4c5d-9885-da4f1f19e7cb.dat

Path /data/data/com.beacon.drill/files/aa8fd1cf-a6b2-4c5d-9885-da4f1f19e7cb.dat
Size 404B
SHA256 876924452bfd65c8c78fe6136b2516631ceacaaf74422cd0b17abf58be34d27a
MD5 64a5dc0aeea9044c84f8650ab51d1a5c
SHA1 1b9eea5daf46c15cb5b9d4123d0ade4a43d7cca7
SHA512 64f4a012a7fed1e0ecd62f5f087d3227132136560ca5e77a1aee43f70326393613c70a80f4c51f018fa4a58fb327b2fd4088cafb9f1d7269d79e34a4c6f89c19
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads