6dc315f4084c21a72978629e0af70f0836c2ade0cf28d87d66794e7a713386cc

General

Target
9ce2406e05e20cd153ff5e9e7e0f5e13_JaffaCakes118.apk
Size 602KB
Sample240611-eap3ysshme
SHA256 6dc315f4084c21a72978629e0af70f0836c2ade0cf28d87d66794e7a713386cc
MD5 9ce2406e05e20cd153ff5e9e7e0f5e13
SHA1 9dc2a818e695b06af636812ec699ec3ea615dbe5
SHA512 237bf42aff370120d97624f64dad67eef943d3914bfbe462e1f98b64d81c6a66f5738bcf782b4c28165170a6645d785730756946f4972f1a311ac66d7df8fdbb
SSDEEP 12288:AEaFZvkGGNUuWW1NVwCKn6GAx1d9H1BxyMGl9fDHxUNYL0JpX79Y1y:AEaFmFN9v46flH7xyVfNGFL93
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection credential_access discovery evasion impact persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
5120	feifei.tnd11.meta.face

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/feifei.tnd11.meta.face/app_ttmp/t.jar	5120	feifei.tnd11.meta.face

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	feifei.tnd11.meta.face

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	feifei.tnd11.meta.face

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	feifei.tnd11.meta.face

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	feifei.tnd11.meta.face

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	feifei.tnd11.meta.face

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	feifei.tnd11.meta.face

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	feifei.tnd11.meta.face

feifei.tnd11.meta.face
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:5120

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Hide Artifacts

1

T1628

Suppress Application Icon

1

T1628.001

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Clipboard Data

1

T1414

Discovery

Software Discovery

1

T1418

Security Software Discovery

1

T1418.001

System Information Discovery

2

T1426

System Network Configuration Discovery

2

T1422

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Clipboard Data

1

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1

T1471

Data Manipulation

1

T1641

Transmitted Data Manipulation

1

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

t.jar.cur.prof

Path /data/data/feifei.tnd11.meta.face/app_ttmp/oat/t.jar.cur.prof
Size 640B
SHA256 f70d906deb09d31c86b4cbda2f7b3af16ea462132c153815ca178ff91fdcb25e
MD5 25eb9151f5a7a88f9ccde2dd006c11be
SHA1 275932d31fbab636f105f9d53a74d77f51f5516d
SHA512 c7d7156e3633af42a17f7a56ed01a31b2afc882e28a76877f53ebc0ca0df8f81334b89e04ab0877b362c14cef8b94f54ecfb2a9a7b51bcc419f0b8191215470f
MD5 SHA1 SHA512

Submit Download

t.jar

Path /data/data/feifei.tnd11.meta.face/app_ttmp/t.jar
Size 276KB
SHA256 b30a95dff6f65f444472971c8aaf895ffc8e66e0117ce242ec4cb8a8a519a5ec
MD5 9aaea567e0c93e51718ba7eade0e83df
SHA1 0005116aad1779361b70093db00fed5ac090ae23
SHA512 2aef1034335d8752f4e25ce6c5823ce03019536cc6e51ee61b5291c77a0f356a2517e0cbe7f2c4cc2d897115dc856449a342cfdc247c9d34d313187d15b2f890
SSDEEP 6144:nSDZFxMVdn+sn8G3YAOG6/srJRPRt76NudrCAzmhaZisqOl3h:nKiVfnxo4Msr3RtlWhyqOlR
MD5 SHA1 SHA512 SSDEEP

Submit Download

feifei.tnd11.meta.faceb

Path /data/data/feifei.tnd11.meta.face/databases/feifei.tnd11.meta.faceb
Size 72KB
SHA256 4be929f8137debfe744596c40b37c24f163627f25286c799a8fe2542866ca5ca
MD5 8b3474d123b7bbe60bb073d84318c0ad
SHA1 8109aa8c2ffaf9abca0a3310fbf67978d305537d
SHA512 de51e809fa03423372fb8be417464fd8a86bc346fb3df0de1af36c757abdc31f5bddeb21793db74d891939f5046773b6c76152d3786a7f926209bd837d66d86a
SSDEEP 48:T6i22dti3Hi6MbmX9MJbUKZb9pMJbc6sNd7UMJbEyAsInlnIH2bmX9MJb8O18OHO:Goti3H4mtqb9brqborIqb5cQsmtqbx
MD5 SHA1 SHA512 SSDEEP

Submit Download

feifei.tnd11.meta.faceb-journal

Path /data/data/feifei.tnd11.meta.face/databases/feifei.tnd11.meta.faceb-journal
Size 512B
SHA256 cfe3762091ab64c4006376759bab9cbe3a320c3c3c4a67d449a65deb5e757997
MD5 a2d677996d1e5b167028f6e2b103c2c8
SHA1 e1c320a0b1f1cfe709b7ebb04acbfaa8e3aa0e98
SHA512 70d3613307afd5a181c501d8dffe02c1e5d0c9199c3d1518a3ceeb0864d14ecc8ae79fcf7ce06e41132d656f6d61bea5fe12bfe2aa258060541b5a62a303cab7
MD5 SHA1 SHA512

Submit Download

feifei.tnd11.meta.faceb-journal

Path /data/data/feifei.tnd11.meta.face/databases/feifei.tnd11.meta.faceb-journal
Size 8KB
SHA256 77ff75fd980b76c78ea97844e7c553a902874fb74fc08c83700ce127b97d7124
MD5 9be4157486b23381f779b17ea1bcd216
SHA1 9786d2649e0f1e69b622405824a81e55ddf6ee1d
SHA512 805d46c6b011517e26367678a3fb03db57cc576cbe0fad7f5ccf2c910d179e8c5458b7ed5b8c54aae5c62bef0c38fb6567bcdfd366cbf61ae08c672e3c57d9fe
SSDEEP 6:7+/l9bllgn1iYng9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKs1n:7+tll0qLiuWdwRmBEyPbvn
MD5 SHA1 SHA512 SSDEEP

Submit Download

feifei.tnd11.meta.faceb-journal

Path /data/data/feifei.tnd11.meta.face/databases/feifei.tnd11.meta.faceb-journal
Size 8KB
SHA256 b98175916be61608c798a960c2fd0a9da2f9ed364ba63f8cec589043d3c8e1f3
MD5 ccad961b9d98d7d3af3249ffe0f71c93
SHA1 cd40e281b40cae57f0861bf2d4084d958419af28
SHA512 1fc713dd8d4ddca41b426e3af1bf6f64d85f4113f7ff18fb1bc0c520f95d76f184d41307c0e3b21d97a709fefb584439349c68b9dca3a56a9fd17604589725de
SSDEEP 6:7+/l9BgPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKeM/r:7+tgqLJdTRmBEyPbsr
MD5 SHA1 SHA512 SSDEEP

Submit Download

feifei.tnd11.meta.faceb-journal

Path /data/data/feifei.tnd11.meta.face/databases/feifei.tnd11.meta.faceb-journal
Size 12KB
SHA256 167c471ace9d899f97602051b9fe452d7b9751db641ff1bd8a9a6033b99099e6
MD5 d52b5bb51ca54e7c5cebcc3980def954
SHA1 76c262b082fa7344ab886eb53fbd66dd7804f32b
SHA512 dd4b3bdb94d9c47271e7c4798faed6f86a63bbb266de4e61445cbae6f3d189a1725807716098e69e350b8e4fab95fcd32eab11ada1794c202644266512c8c5a2
SSDEEP 48:7MeYqr22dti3Hi6MbmX9MJbUKZb9pMJbc6sNd7UMJbEyAsInlnIH2bmX9MJb8O1H:70Yti3H4mtqb9brqborIqb5cQsmtqbxt
MD5 SHA1 SHA512 SSDEEP

Submit Download

t.jar

Path /data/user/0/feifei.tnd11.meta.face/app_ttmp/t.jar
Size 587KB
SHA256 1c65834d9ca018c6496a8b9957589d0e94657911b6635dc21a448d78f9238887
MD5 f72c3d07507c3e26d317e9117ba757d1
SHA1 cdede4739e9dd9fd95243aab5e44c24f93f825c3
SHA512 3420714252e7503abc13c99274d767b0bc08671d769460dc61823ab9470e145fb75c5dfaadc617d3a05cf251ed5ecf38ea7e8c1d7b343bca4d7e8296f1b805d4
SSDEEP 12288:PlCfVfqatnro0WFGEDsm8UFXvgUy7ayzAQBW7un0x83qFAbOZE/yNoj2hsna1wLs:wfNZEDFNQs7un0x83qFAbOZE/yNoj2hF
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads