cd061bd40725c82c0e8d29810054708e3196fb70cbaf243769d2bb81dc50fc8d

Analysis

max time kernel
9s
max time network
141s
platform
android_x86
resource
android-x86-arm-20240603-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240603-enlocale:en-usos:android-9-x86system
submitted
05/06/2024, 17:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
98bf3efb6858583f5f45194cae67f4f7_JaffaCakes118.apk
Size 1.8MB
Sample240605-vxb3lsch2w
SHA256 cd061bd40725c82c0e8d29810054708e3196fb70cbaf243769d2bb81dc50fc8d
MD5 98bf3efb6858583f5f45194cae67f4f7
SHA1 434087be4e97095420845ee6481b0958e3bb4738
SHA512 2943e5d967612b55623e9c30f91509712c981b3877efc12ed46cb481daffb8e72046a26dc2c2853faa4dc54fd0173706ebc17fe8ccfab840e51b979aa83d2bb6
SSDEEP 49152:Fs1uKDj28WwOnrvYU4YxrngyKKx4Tfyd77voeWJBOefxf4/n:QXf28WwkrvYZmrgpLyd7Yxi
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection discovery evasion impact persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 4 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.urjma.rosnd/app_Wyzf_plg/5.0.9.jar	4241	com.urjma.rosnd
/data/user/0/com.urjma.rosnd/files/new_md.jar	4241	com.urjma.rosnd
/data/user/0/com.urjma.rosnd/app_dex/utopay.jar	4241	com.urjma.rosnd
/data/user/0/com.urjma.rosnd/files/Plugin2.apk	4241	com.urjma.rosnd

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Reads the content of SMS inbox messages. 1 TTPs 1 IoCs

collection

SMS Messages

T1636.004

description	ioc	Process
URI accessed for read	content://sms/inbox	com.urjma.rosnd

Reads the content of the SMS messages. 1 TTPs 1 IoCs

collection

SMS Messages

T1636.004

description	ioc	Process
URI accessed for read	content://sms/	com.urjma.rosnd

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.urjma.rosnd

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.urjma.rosnd

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.urjma.rosnd

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.urjma.rosnd

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests dangerous framework permissions 10 IoCs

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Required to be able to access the camera device.	android.permission.CAMERA

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.urjma.rosnd

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.urjma.rosnd

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.urjma.rosnd

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.urjma.rosnd

com.urjma.rosnd
1⤵
- Loads dropped Dex/Jar
- Reads the content of SMS inbox messages.
- Reads the content of the SMS messages.
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4241

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Execution Guardrails

T1627

Geofencing

T1627.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Protected User Data

T1636

SMS Messages

T1636.004

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

5.0.9.jar

Path /data/data/com.urjma.rosnd/app_Wyzf_plg/5.0.9.jar
Size 50KB
SHA256 611bbbd83419cac7976482fefa632fbb138332fb1cebc494f114787b66ade248
MD5 420af8883b28b70fa5698fc2c9bc1ae2
SHA1 80b2d0868f0c2170f93d2f93c61c8b430936d181
SHA512 f72fd329d7b9ecc7d6c7c7c117ff638456201d3797821fdd9eb8b6d5f862544507fd62985a3ecffdb33349851f6e65920962fa44f24bef20b042bcf0ca9ec645
SSDEEP 1536:cQCX8PNdBpV91XMH8h7K50LdxIakqKcUG6:D/PDBpL1ceWQJBvUG6
MD5 SHA1 SHA512 SSDEEP

Submit Download

utopay.jar

Path /data/data/com.urjma.rosnd/app_dex/utopay.jar
Size 30KB
SHA256 d5c57482245f9caf63cfae312978e8d38d0185cc3161f1f16dc4d3da91b6983b
MD5 835e546b50b1e9d513f5148f7a1c0faa
SHA1 4a072863d236f6ed895647c809359ca1e1d25ed6
SHA512 2cb7076e28464f53bce04efbf1a250294879894423320195af3187aa58e2d6f9fb88b34fec3a347676949dcc1da2ed048bfcb6c4073b0a75db97ce3a00984445
SSDEEP 768:NgCHAfdzCElRN9KAHzSdVVQzO4W97lDH2U1Go+ik:RAfdznlRN9KAHzS7VQqiCGFx
MD5 SHA1 SHA512 SSDEEP

Submit Download

740410100062013

Path /data/data/com.urjma.rosnd/databases/740410100062013
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

740410100062013-journal

Path /data/data/com.urjma.rosnd/databases/740410100062013-journal
Size 512B
SHA256 bb1da8b360e6d84208ded501ce0639e29d3f3321cb16285be668858afb25d272
MD5 65428d008bc873cb42ee9bde6a7ce985
SHA1 b718d3eac7e77a11f825fb14c41eac5c915630dd
SHA512 6a002ee9ee18673fb2f0dbab396206c546857132705305d1f8077e8b075fe44b6db2a761b2e98300817dabfaff7e305b12c3063162abb593d7a9fb51a21b044e
MD5 SHA1 SHA512

Submit Download

740410100062013-wal

Path /data/data/com.urjma.rosnd/databases/740410100062013-wal
Size 136KB
SHA256 20ed7756d69371f19f367244c09f91645794c982a5fab63c701de306ca4960db
MD5 c1703bc382f2d78582da8275b324040d
SHA1 b9c446444c3254bc8d08fa751022087d39d1101b
SHA512 e5226ea612788c3f350f5f65d3a1f0d799efa59f97a63aff7df8ba309cf271d0321ee54bc7d5bf2b530021ebc17482771f04ecd58cec4d240b81e8e2662b5493
SSDEEP 192:9F1BOaDmpEzdjeFgezpK1GxrTTpqyzpytsxrmToqyzpyA2xrTTpqyzpys:GypjMgCbxr/EyMtsxrAzyMbxr/EyMs
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db

Path /data/data/com.urjma.rosnd/databases/cc/cc.db
Size 36KB
SHA256 474c4a54534ed96beacad7cc9a805a3f53ec9c0522fc7bcc59771cf500a6a0da
MD5 5d7ea1a23af19b4340cc8d90f28297d5
SHA1 4cfe95b23a9e98378d69c4290af81b51fbe76aea
SHA512 33071f4c92da0a3df01c4a61dd165df7c7e0f4f37753cafe02d19fc876a5e7fcbb01c069c804e140ab8bfa0644a55f50fd1373646d1c439f817baa5ffbd47f7b
SSDEEP 12:TCFP2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBEyPb8FOwGQn:Tz7sL7yot3BVrHotGGSgGQQQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/com.urjma.rosnd/databases/cc/cc.db-journal
Size 512B
SHA256 b23d10a3c502357663d6fcc4033ee5ca54ff71b09122afb7acb1d35d5d7a59d5
MD5 895d0a47b08d5564359dd0f83aaf3da7
SHA1 81a11d8699a3d53eeb40116ea6afe77fd2897286
SHA512 75fd63029ba3ae22551ab5bff6c9a78907d655dc6724072d99c4bdd181a8758e0f9584afd6aad429b0c15ff0f3fa917d8e5a59136a96edcd709f2faa49cab107
MD5 SHA1 SHA512

Submit Download

cc.db-wal

Path /data/data/com.urjma.rosnd/databases/cc/cc.db-wal
Size 48KB
SHA256 72772604f90e36c519f61a5fa34ac8f7d811852dee4f54cc1fe4c3bfd4d8fb73
MD5 211189519c8ed68c8990cfcdd3bda3c7
SHA1 505e361e2ef225ae516b3b7d750027c1c2edba09
SHA512 88a0412a9f7ee6a6808b14931b2ec86d94332473de228e76a3bfd87b6886917ff0870b4805b1cc6c379f3e19f8df924fc782daae3bb20e8c4d8b7b46529fb37a
SSDEEP 48:+zy6zNSP/Zwb3n0shBWfSP/Z9a98MC7a:A0Peb3nP/G
MD5 SHA1 SHA512 SSDEEP

Submit Download

flyou

Path /data/data/com.urjma.rosnd/databases/flyou
Size 44KB
SHA256 d6e4da9d6ef70d6cf7b550a6446a8bce843ef397c1df2f0c6551881853e0403e
MD5 a072557c13ffe50f617819f08eb8e453
SHA1 67e36dd1b56ef6a2a6eb4efe039b9de612870697
SHA512 f176c3cacbf47811c508084ec1df66ddc16ee7abfdabd5a225e2fca8d3b5da9f41a8adb2c7b9ec3f79d972a70f4f65f1bdc07694a85dc35bad94411c3ef68678
SSDEEP 48:Tt/6nFivnFi8nFiB9aKFaKGIOnJlPILXVS:JMx7aKFaKGIRX8
MD5 SHA1 SHA512 SSDEEP

Submit Download

flyou-journal

Path /data/data/com.urjma.rosnd/databases/flyou-journal
Size 512B
SHA256 76266babe50935986e849655f977ae8da164710ab5cb98ef49e1af589da43c00
MD5 c98ff1e863878ad2faab056d7048289b
SHA1 1f25280e057b753bf495d190d7f15d83c47be305
SHA512 69764b795ef1fc9abde8ebffa690a78098f3ec77c961e2a3d73b7c8f2c0f47b7e5beb19c1e4b111f75c8129348a3a2e8648934c14e8fd918f59dd8a655e3cfda
MD5 SHA1 SHA512

Submit Download

flyou-shm

Path /data/data/com.urjma.rosnd/databases/flyou-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

flyou-wal

Path /data/data/com.urjma.rosnd/databases/flyou-wal
Size 56KB
SHA256 6e6673538bb5c7d469549a3af1e1edcce478ea424926f32d63a6e981c5598f2b
MD5 ff284f9507464202dc8cb51d42c99cd6
SHA1 7e5c3ddc9a14288bec87ba43d05cf788a0f4841d
SHA512 e1d3215600fb7100e3b42bb2eec8665016da037e0e8ab303c0fe21f0ffe5ea91a160d9dfd418daadae9d4ebf6ccabf237cad269bd36b9087d5f965f4d52b86bc
SSDEEP 48:NnUmzNSP/UmiYt/6nFivnFi8nFiB9aKFaKGIOnJlPILXVSP/UTW7dWEP:Z0PvMx7aKFaKGIRX8P
MD5 SHA1 SHA512 SSDEEP

Submit Download

Plugin2.apk

Path /data/data/com.urjma.rosnd/files/Plugin2.apk
Size 96KB
SHA256 77ff63fc4125b3c1bf970feb1722e02cf43c9c4d6abeff4b2cccb6a9e55a51ef
MD5 38e2a484a18765834e721e42df3b89cb
SHA1 21bb2bc4f29e40abdb103b9d64af815956cb504b
SHA512 1ad43dbcfdffe2c21649e043ed3e6a61f81f69ac53bac68a9350624b3613be8c249ff0df5b8b7711cb13e030033d23aa71bc3f730becabede1040417f576a618
SSDEEP 1536:Kh6mBpBM3vDKmJJj0Z/maH2/88Hsv0SBblAi9HQ1oF1YOVUAOgrULB+hsr:UFKbPIZ/me8Mv0s1q25VU3lBwsr
MD5 SHA1 SHA512 SSDEEP

Submit Download

new_md.jar

Path /data/data/com.urjma.rosnd/files/new_md.jar
Size 36KB
SHA256 001c2f29557e000d84b6f586fb54ffc2c501c7d749a89540db796891b3021279
MD5 fc8e74605c4ce010ffe0f51c14bbb9b3
SHA1 38f82b7517fdc0d881a80c64e32244ead819b815
SHA512 f508dde9bfd0d64a5cb6cbcc2fa1ae1caad447502754ad93da0ffcb7603e6b785ad6dace5c65e87ec0b84af82d9b46f93824f0f74289952e25eb412efa17f5ce
SSDEEP 768:8lssiwpQAHAR8h/nZ5hW1aWoW0QmRJ2ZDLOZ6jANpp30sEXWg:8Os0gDhWiQmiZXOcap1mT
MD5 SHA1 SHA512 SSDEEP

Submit Download

5.0.9.jar

Path /data/user/0/com.urjma.rosnd/app_Wyzf_plg/5.0.9.jar
Size 112KB
SHA256 02a5ef69d0967cc0310f315c2340fc8b088ab89d0320227a30cb58229319c034
MD5 b477ed7cd5872f72f6f91bc754738f9a
SHA1 5ce083e7b964b08c39312bbc725f9fa2c279a612
SHA512 d41e1fa806551daecaee5bf632667e6288353532dee6996631bba121e50448bacbed8df4da1c0c63012a9421744b3d2877d28fc65872ea1bf215efd21a8f7597
SSDEEP 3072:BqWITuZrjo5pgTKezDb1kOmcWGQsr4yrgEmKO:BqWIaXfTKerQrhEm
MD5 SHA1 SHA512 SSDEEP

Download

utopay.jar

Path /data/user/0/com.urjma.rosnd/app_dex/utopay.jar
Size 66KB
SHA256 c9dda4e71a7152be8edc8fab7489894d976faab37f63f93490e8adc2062d5d3f
MD5 56f57464bc726c0bb2842fb5bbac916b
SHA1 7c6f45b6110e689208182598abcce6d44576b7f0
SHA512 4f8a4514b38d4224ea88414ecbba673b50587f5a4825be533843d609d10584888aca0b29e1d30dcfce3283482893fd1bc5259b94516d780134b2f2d0e58987a2
SSDEEP 1536:QJZ5MvsTSToGEEVR/AkehkF0nB7u5EPNcwzLx:QJZusTEkEjInB7u5EVcW
MD5 SHA1 SHA512 SSDEEP

Download

Plugin2.apk

Path /data/user/0/com.urjma.rosnd/files/Plugin2.apk
Size 206KB
SHA256 1f60ae0f7ca558ee9b0a6745881b7123925e603afbb4ec0ea1c973c38e659901
MD5 52e90ce3cc1f84fccc81e46706bf338f
SHA1 3f98d84bead1db6dda6b3c773300787b6677f324
SHA512 3dfad621b9df17981eeb9f227176b6b36a144a613d7a07f5b827798fe8b8db1b108ad2404daaa3157261b34ed4435510a0476e4303bb1b52d8e6a1de42524acb
SSDEEP 3072:UN5r36E9/ety2pLuIsDCI4pRc+YM1v5lGRG6V0IeIF+kuJihuPaSQPSEy3bZ7zJx:REIEyI4pRH1QlVNvhiLKyr1b
MD5 SHA1 SHA512 SSDEEP

Download

new_md.jar

Path /data/user/0/com.urjma.rosnd/files/new_md.jar
Size 83KB
SHA256 0afa5f48b018da2ed56bbad69011cfb2187944df5489b916d298bd960f4589e3
MD5 fb585df12147c75e30fb7acc4b1a6aac
SHA1 c00854e3869901c3a93a87d86bfe2560f0c94dff
SHA512 fa653c6a1eda7b61bc33db5fc947d8fbf1bc98697b22201f5010627af6c6b2d0d1c619bee08fbd6043ed9e6a3e64238fd177dde82cc9b753b28d3088e50e4353
SSDEEP 1536:3Qr+qeW4RW3CYG+EJ8HDjdzF91r0xU8A4o4s+WhIMGDBB+CUlHz21mbWCfJ/2xO+:3QvfHXlT212WCcxOwsRuUGdVh
MD5 SHA1 SHA512 SSDEEP

Download

com.urjma.rosnd

Path /storage/emulated/0/com.urjma.rosnd.start.times/com.urjma.rosnd
Size 77B
SHA256 8d8103c88557bcf6dc06f9e44b45ab3412c333fce6e22380a91de610d3eafd05
MD5 81501198c971ae16a99f41982142a055
SHA1 f8487a793c0f13e23510811d3847570a094f9014
SHA512 9065477b5e426562b422a2698297573e718d37b78c7fb1d4461fb0e30276aa9d5a8308e8c29adfb1a0006456f4573f383cd64b8d7345a9b91a8ac68824246d07
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads