106242de5841d95b49f8cf14ba0804ab234d773b557d4681f2009f6869a79495

General

Target
98fdb47121935e5c7b61250dc501c3e3_JaffaCakes118.apk
Size 1.4MB
Sample240605-xs95ysfa2v
SHA256 106242de5841d95b49f8cf14ba0804ab234d773b557d4681f2009f6869a79495
MD5 98fdb47121935e5c7b61250dc501c3e3
SHA1 d054c042b25723579fd0e54775e86e94e7549d77
SHA512 0d30d0df806e067082dee6f3296c6c8bc105cd6ab77c0e44c25b85be8352c5466dc174d55da2d6d0317906279dc595c99ba710a09412ec5c91db4eafcf7ffd73
SSDEEP 24576:QEaFmFN9v46flH2UIbxMeh+CY87waIIj9CqkMnFP0JORSAireJK:QEaFmL9AcMJY873IG90ZcS0JK
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection credential_access discovery evasion impact persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
5128	com.bjin.gamemaster_main

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.bjin.gamemaster_main/app_ttmp/t.jar	5128	com.bjin.gamemaster_main

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.bjin.gamemaster_main

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.bjin.gamemaster_main

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.bjin.gamemaster_main

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.bjin.gamemaster_main

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.bjin.gamemaster_main

com.bjin.gamemaster_main
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:5128

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Hide Artifacts

1

T1628

Suppress Application Icon

1

T1628.001

Virtualization/Sandbox Evasion

1

T1633

System Checks

1

T1633.001

Credential Access

Clipboard Data

1

T1414

Discovery

Software Discovery

1

T1418

Security Software Discovery

1

T1418.001

System Information Discovery

1

T1426

System Network Configuration Discovery

2

T1422

Lateral Movement

Collection

Clipboard Data

1

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1

T1471

Data Manipulation

1

T1641

Transmitted Data Manipulation

1

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

t.jar.cur.prof

Path /data/data/com.bjin.gamemaster_main/app_ttmp/oat/t.jar.cur.prof
Size 602B
SHA256 7d3127411da5b8947f7184a0cf8f558caad05e984d3f9ce80778ca58c3817470
MD5 748e41c1e6c341ce60afe435961e97bf
SHA1 7aa366f5ef1626be7d9512a4b3547e3f4667edbe
SHA512 dafb42b5b9c626815d96ba6ffb962738906dbf7b6eb27165ee98f31ca12ee32241e73a0333b83fe6ec4444c5f0f103bf520b88db724aa4e0629bf194afe8da93
MD5 SHA1 SHA512

Submit Download

t.jar

Path /data/data/com.bjin.gamemaster_main/app_ttmp/t.jar
Size 276KB
SHA256 b30a95dff6f65f444472971c8aaf895ffc8e66e0117ce242ec4cb8a8a519a5ec
MD5 9aaea567e0c93e51718ba7eade0e83df
SHA1 0005116aad1779361b70093db00fed5ac090ae23
SHA512 2aef1034335d8752f4e25ce6c5823ce03019536cc6e51ee61b5291c77a0f356a2517e0cbe7f2c4cc2d897115dc856449a342cfdc247c9d34d313187d15b2f890
SSDEEP 6144:nSDZFxMVdn+sn8G3YAOG6/srJRPRt76NudrCAzmhaZisqOl3h:nKiVfnxo4Msr3RtlWhyqOlR
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.bjin.gamemaster_mainb

Path /data/data/com.bjin.gamemaster_main/databases/com.bjin.gamemaster_mainb
Size 72KB
SHA256 130d08fcfc1cacbb196d3c1e2db1d4bfc850cdf140858ab5de997b9262f26d44
MD5 736b6458d14b79988aaf76dc840d3b1f
SHA1 3814bf7d096a4ffad3ebb437dc51c86b1f08fe0f
SHA512 88f3d6791a20e50d20d919158a4e7597a7bd5d59ba87b01b8996a8d115ee4bac6d2754a6a6387774979455b598e0bace7e541c311abdbab4ff5dd79b579fa9e4
SSDEEP 48:T6i22dti3Hi6MbmX9MJbUKZb9pMJbc6sNd7UMJbEyAsInlnIH2bmX9MJb8O18OHa:Goti3H4mtqb9brqborIqb5cQsmtqbxY
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.bjin.gamemaster_mainb-journal

Path /data/data/com.bjin.gamemaster_main/databases/com.bjin.gamemaster_mainb-journal
Size 512B
SHA256 dec94ab9a0d8476eadf79e755a87491384ecd4de65a4dadafae3360251585432
MD5 7ece75652b328423f6fd27eb4566d524
SHA1 1437d99b3184613bdabd9c024a6bcaa2704691ba
SHA512 75c8b5c2a0c8df453e64379717be49a5c8ac8eecdb02fd48c8322526d125fa96cb28d69212aebc4631beb0f2d371fc9d05b470fa7007d4eeba2d9706546a07d0
MD5 SHA1 SHA512

Submit Download

com.bjin.gamemaster_mainb-journal

Path /data/data/com.bjin.gamemaster_main/databases/com.bjin.gamemaster_mainb-journal
Size 8KB
SHA256 1fe914478beaeea5e3e26cc03affc430317879ceff42aff8712a6743d105123c
MD5 46373125e3c6237d5d8ec0f8120c3ea6
SHA1 8a7397099e69eb79981f6fcb3a6ca87bef2fb401
SHA512 0154f02d1ffd535e6a4a984684d6d7a20ce3148c9b305396d6d294eee03b60e878e516fbd6550873bbd8e4fc48c13fd41fe4df9eb793909b582ca346f176af01
SSDEEP 6:7+/l9ASn1wfg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKmq:7+twqLiuWdwRmBEyPbXq
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.bjin.gamemaster_mainb-journal

Path /data/data/com.bjin.gamemaster_main/databases/com.bjin.gamemaster_mainb-journal
Size 8KB
SHA256 53c591728d59c1863c567b1e896ca8ef3b02c2e6357368413453b159f201167c
MD5 8c6d6bd809b74c53d38a20aabdef8795
SHA1 d3714525c33c3ac72fd33e6b293a063be6869c29
SHA512 f13ccab3d941d9364bdaf0d46681478d2986bc487f47a68a0535823cbb1ff0346ff814e3f03c70f08290fc633be03c05942773bcfe3cd97cc4283361c6b88053
SSDEEP 6:7+/l9KgPg9bNFlLdrlOERX4PBX4ogLugMBX4suuK9nM/G:7+t04qLJdTRmBEyPbMsG
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.bjin.gamemaster_mainb-journal

Path /data/data/com.bjin.gamemaster_main/databases/com.bjin.gamemaster_mainb-journal
Size 12KB
SHA256 63cf6d582df147638e044f91ec3fdab1deef01cdbd95cd1d6ae090f62b95b479
MD5 930712d99bdeda0bc3b19d914b63c74f
SHA1 660284d54ded88f419672cf1ff688aaa359efb3c
SHA512 23a62a75676f2f35ed4e9c617eac2b9496c1f39f2303b8e11cb0c5abae16827c6d6e8cca1005144ae690c4d34b9d8fb579e26d50b5bcf4822850a9bee9c0299c
SSDEEP 96:7EZYti3H4mtqb9brqborIqb5cQsmtqbxH:7EZYaokB
MD5 SHA1 SHA512 SSDEEP

Submit Download

t.jar

Path /data/user/0/com.bjin.gamemaster_main/app_ttmp/t.jar
Size 587KB
SHA256 1c65834d9ca018c6496a8b9957589d0e94657911b6635dc21a448d78f9238887
MD5 f72c3d07507c3e26d317e9117ba757d1
SHA1 cdede4739e9dd9fd95243aab5e44c24f93f825c3
SHA512 3420714252e7503abc13c99274d767b0bc08671d769460dc61823ab9470e145fb75c5dfaadc617d3a05cf251ed5ecf38ea7e8c1d7b343bca4d7e8296f1b805d4
SSDEEP 12288:PlCfVfqatnro0WFGEDsm8UFXvgUy7ayzAQBW7un0x83qFAbOZE/yNoj2hsna1wLs:wfNZEDFNQs7un0x83qFAbOZE/yNoj2hF
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads