50417d60ff040ab006bcf2fa348636d378cf8227d368a27a4a4bbca35d4216f3

General

Target

9f2351cb382520270c1ab5bf495ebc6b_JaffaCakes118.apk
Size

5.3MB
MD5

9f2351cb382520270c1ab5bf495ebc6b
SHA1

4e4f40273dfc96fe7071249069cae1e620acde8f
SHA256

50417d60ff040ab006bcf2fa348636d378cf8227d368a27a4a4bbca35d4216f3
SHA512

99c570d41ecda38cc21e90e7b1663fb58da91317e80f65cd798cb2a9f5980006459af07acb0842c8dd9e18f166f69c419e2d66b2c43399b0e6fcc0ba564db4de
SSDEEP

98304:gv0WnBXfbssPpxHpehyr7gIfoUt2IRab3e+9czMiGtXo1NjaexIg63sZQuwD5:CBXfbssPpPyyozU8IRab3TcBGG1NOkIN

Score

7^/10

banker discovery evasion persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

Processes:

com.linkai.cpu/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.linkai.cpu/mix.dex --output-vdex-fd=56 --oat-fd=58 --oat-location=/data/data/com.linkai.cpu/oat/x86/mix.odex --compiler-filter=quicken --class-loader-context=&

ioc	pid	process
/data/data/com.linkai.cpu/mix.dex	4263	com.linkai.cpu
/data/data/com.linkai.cpu/mix.dex	4263	com.linkai.cpu
/data/data/com.linkai.cpu/mix.dex	4367	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.linkai.cpu/mix.dex --output-vdex-fd=56 --oat-fd=58 --oat-location=/data/data/com.linkai.cpu/oat/x86/mix.odex --compiler-filter=quicken --class-loader-context=&

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

Process Discovery
T1424

Processes:

com.linkai.cpu

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.linkai.cpu
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

com.linkai.cpu

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.linkai.cpu

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.linkai.cpu

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.linkai.cpu

com.linkai.cpu
1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4263

sh -c getprop ro.yunos.version
2⤵
PID:4334

getprop ro.yunos.version
2⤵
PID:4334

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.linkai.cpu/mix.dex --output-vdex-fd=56 --oat-fd=58 --oat-location=/data/data/com.linkai.cpu/oat/x86/mix.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:4367

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Credential Access

Discovery

Process Discovery

1

T1424

Software Discovery

1

T1418

Security Software Discovery

1

T1418.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.linkai.cpu/databases/bugly_db_legu

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.linkai.cpu/databases/bugly_db_legu-journal

Filesize
512B

MD5
26e330f228f67a9db022da702b27a89f

SHA1
1d5aff64d0456f34d84cbabbed0e6874caae3321

SHA256
78cd8ee5b9d08ace22cdb4f0364d6d0d8920759d004e7cfdea4877af02379cc2

SHA512
d456739a5212b5ef2d58a26077c65f30da4869a10766c9c6bc47ab44e9db77f840f18fa09fec63fd0e279f3576985b26a53aeb483d5a0c0a1ffff52300817cbf

Download Submit
/data/data/com.linkai.cpu/databases/bugly_db_legu-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.linkai.cpu/databases/bugly_db_legu-wal

Filesize
92KB

MD5
d2f39982e12027a58dab9871f005298f

SHA1
47b8522231f492bb18bfc45ce49b9c065a63c5c1

SHA256
cd0d9a2d4cfa487f965f7cab7ef92ad3ca771073690077f7852a6af05272b084

SHA512
29d7cf99f0a5c74fd7cbf3cd885b165b1cb1f48e584f84b2e48b02c320f323a0e9bdcf61bdd071d2e14e3d18fde5fdc7330689442d36c4157e60c03f27f59627

Download Submit
/data/data/com.linkai.cpu/mix.dex

Filesize
292B

MD5
63f77f99bd2c2b772a479923bde11974

SHA1
c7632e7d301e4463fafce85f84e9c3d7da3fdbbe

SHA256
4c76a3af64cdd2f8713ffe2733dea50dbe714d0ca41c17d1847ee5b62a7ca615

SHA512
3aae4a89d1ed51fdd911cb367eb10afe3c2264e4222085891b18a60d5412f85d10bf5c8f3c6642db70abb9aa42732bac5c42c42ee32d587100f53c21b5beb16c

Download Submit

Analysis

Sharing