Analysis
-
max time kernel
10s -
max time network
179s -
platform
android_x86 -
resource
android-x86-arm-20240611.1-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system -
submitted
12-06-2024 23:36
Static task
static1
Behavioral task
behavioral1
Sample
a2f524af69359f35417a54f75affc8bb_JaffaCakes118.apk
Resource
android-x86-arm-20240611.1-en
Behavioral task
behavioral2
Sample
BDTX140.apk
Resource
android-x86-arm-20240611.1-en
Behavioral task
behavioral3
Sample
BDTX140.apk
Resource
android-x64-20240611.1-en
Behavioral task
behavioral4
Sample
BDTX140.apk
Resource
android-x64-arm64-20240611.1-en
General
-
Target
a2f524af69359f35417a54f75affc8bb_JaffaCakes118.apk
-
Size
1.7MB
-
MD5
a2f524af69359f35417a54f75affc8bb
-
SHA1
0d96914fb3ff27b82386805ec0573c8a8c4ca970
-
SHA256
3a6a0e2fdc3c83308c92ddb440150d0752c742aa7b82250dd6d3f0d652e02e13
-
SHA512
642a296b0422d8e2e3cc92179fce072a343bf6257c0487b6063865f2e510192c3eb298795fb0a44aac365a00fd13470dcc1befdaaf9e02fb1f13ec6b8f6edd67
-
SSDEEP
24576:Cm4AEK+WyhLvCM8w+GaF/SN4AT5cJTDnMiibkJqeoYDjAO02OZGpUgWN1r4/t:6GyhYwDaIN10TrMwqDYDEHZXgWNG/t
Malware Config
Signatures
-
Loads dropped Dex/Jar 1 TTPs 6 IoCs
Runs executable file dropped to the device during analysis.
Processes:
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.cif.zfjafp/files/sen/dBFUdElYi.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.cif.zfjafp/files/sen/oat/x86/dBFUdElYi.odex --compiler-filter=quicken --class-loader-context=&com.cif.zfjafp/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.cif.zfjafp/files/Plugin2.apk --output-vdex-fd=59 --oat-fd=60 --oat-location=/data/user/0/com.cif.zfjafp/files/oat/x86/Plugin2.odex --compiler-filter=quicken --class-loader-context=&/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.cif.zfjafp/app_dex/utopay.jar --output-vdex-fd=116 --oat-fd=117 --oat-location=/data/user/0/com.cif.zfjafp/app_dex/oat/x86/utopay.odex --compiler-filter=quicken --class-loader-context=&ioc pid process /data/user/0/com.cif.zfjafp/files/sen/dBFUdElYi.jar 4293 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.cif.zfjafp/files/sen/dBFUdElYi.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.cif.zfjafp/files/sen/oat/x86/dBFUdElYi.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.cif.zfjafp/files/sen/dBFUdElYi.jar 4229 com.cif.zfjafp /data/user/0/com.cif.zfjafp/files/Plugin2.apk 4323 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.cif.zfjafp/files/Plugin2.apk --output-vdex-fd=59 --oat-fd=60 --oat-location=/data/user/0/com.cif.zfjafp/files/oat/x86/Plugin2.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.cif.zfjafp/files/Plugin2.apk 4229 com.cif.zfjafp /data/user/0/com.cif.zfjafp/app_dex/utopay.jar 4454 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.cif.zfjafp/app_dex/utopay.jar --output-vdex-fd=116 --oat-fd=117 --oat-location=/data/user/0/com.cif.zfjafp/app_dex/oat/x86/utopay.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.cif.zfjafp/app_dex/utopay.jar 4229 com.cif.zfjafp -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
Processes:
com.cif.zfjafpdescription ioc process Framework service call android.app.IActivityManager.getRunningAppProcesses com.cif.zfjafp -
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Reads the content of SMS inbox messages. 1 TTPs 1 IoCs
Processes:
com.cif.zfjafpdescription ioc process URI accessed for read content://sms/inbox com.cif.zfjafp -
Reads the content of the SMS messages. 1 TTPs 1 IoCs
Processes:
com.cif.zfjafpdescription ioc process URI accessed for read content://sms/ com.cif.zfjafp -
Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
-
Queries information about active data network 1 TTPs 1 IoCs
Processes:
com.cif.zfjafpdescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.cif.zfjafp -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
Processes:
com.cif.zfjafpdescription ioc process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.cif.zfjafp -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
Processes:
com.cif.zfjafpdescription ioc process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.cif.zfjafp -
Requests dangerous framework permissions 17 IoCs
Processes:
description ioc Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE Allows an application to read SMS messages. android.permission.READ_SMS Allows an application to receive SMS messages. android.permission.RECEIVE_SMS Allows an application to send SMS messages. android.permission.SEND_SMS Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE Required to be able to access the camera device. android.permission.CAMERA Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE Allows an application to read SMS messages. android.permission.READ_SMS Allows an application to send SMS messages. android.permission.SEND_SMS Allows an application to receive SMS messages. android.permission.RECEIVE_SMS Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
com.cif.zfjafpdescription ioc process Framework service call android.app.IActivityManager.registerReceiver com.cif.zfjafp -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes:
com.cif.zfjafpdescription ioc process Framework API call javax.crypto.Cipher.doFinal com.cif.zfjafp -
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.cif.zfjafp1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Reads the content of SMS inbox messages.
- Reads the content of the SMS messages.
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.cif.zfjafp/files/sen/dBFUdElYi.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.cif.zfjafp/files/sen/oat/x86/dBFUdElYi.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.cif.zfjafp/files/Plugin2.apk --output-vdex-fd=59 --oat-fd=60 --oat-location=/data/user/0/com.cif.zfjafp/files/oat/x86/Plugin2.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.cif.zfjafp/app_dex/utopay.jar --output-vdex-fd=116 --oat-fd=117 --oat-location=/data/user/0/com.cif.zfjafp/app_dex/oat/x86/utopay.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.cif.zfjafp/app_dex/utopay.jarFilesize
30KB
MD5eb6089c1acfa9f12535e533aebee845e
SHA1165e39ee07dcd9ed00fc2dc1ff466bc1d6b813c9
SHA256b825cde84e3dddfc147c71265d2259c422d51a7e56d1dcdba1321e3119b1df07
SHA5125b1bc26bcbcf05fc331865fb4dd572b673a52650d68ab4d9b028ea15219e0d93c1ec17996953436801913388d78e25c67ea33aa93544d65e96a799eb06cc70f5
-
/data/data/com.cif.zfjafp/databases/740410100062013Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
/data/data/com.cif.zfjafp/databases/740410100062013-journalFilesize
512B
MD5cd974cca295e7e61a9a472b34de22149
SHA1b7744d0ba67d0217b026f6705dc0f99a10689ffe
SHA256dacc6ed1850295c78fdb72a1aa2c02c1dc7e45cecd9aa69eb52e3b57a9590386
SHA512d50b3e9bf403575fc1c7c6fc72992c034942abd21da1e282045ff079829eae197c593462ac48ef2c7f7d6e4f1738fcec60a02afde148816c9cb4e8c44b3f062c
-
/data/data/com.cif.zfjafp/databases/740410100062013-shmFilesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
/data/data/com.cif.zfjafp/databases/740410100062013-walFilesize
148KB
MD5233f907802753ebfbc196bd128eb9cbc
SHA1c08151cd4d50bcb730883bd46da3b75b14d1ae1c
SHA2566986a0c459736a5ba4737e913dcfa43636b8e076207d00e8411e98183e9a4d94
SHA51204eae4f1e58b4a54200968f711b24c90c4290bc0c214a911e206474a977d6cf60903539edb06fdddca2f54cb5c39b0d34f709af7a873b81536821129047018ab
-
/data/data/com.cif.zfjafp/databases/wochi_v4.db-journalFilesize
512B
MD58f0c700ab48d2557a2da85d35954318a
SHA16359adf51b3725f60dd1178dcfa03c72d1507389
SHA2564d0072b6ea819c598da1f39c1166f28a7afa391cd37ebf32109d01b615235655
SHA5128b9e72517ed02d6651a3c21e4d992f5b40709af06f2ef988db663c854dd4f293db0afda612ce9f90adc08e32a38704dc27e6b974750007f3faaa327a7f5fb44e
-
/data/data/com.cif.zfjafp/databases/wochi_v4.db-shmFilesize
28KB
MD5cf845a781c107ec1346e849c9dd1b7e8
SHA1b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA25618619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
SHA5124802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
-
/data/data/com.cif.zfjafp/databases/wochi_v4.db-walFilesize
20KB
MD5bbf628d8c3e7ed3123a3a964e5bc9b90
SHA1ea85b64391e3045552495a45db8890b82ec3b93a
SHA256362d7e804587d915487818d238976b04b6a0daadf996b2ba53dba24c3972749d
SHA5121f002c21acdcce2373b981263305d593c404c934fd858056e2e153e8652a839a3efa250a5520943c0221921c46d2817b24d6be362a49f7725423ef49ab50c5a0
-
/data/data/com.cif.zfjafp/files/Plugin2.apkFilesize
99KB
MD53d216f8fddb9705a6720a285475837f1
SHA1f053d23b284bfe2faf6e76d353ff052471e2de2c
SHA256de7bf40574754a5144fa5cf3bc5e97f7adc7f5abebb18c41e8f0631917db4c0c
SHA51238be39da8f96abc87109cfd57b2d63ddfa72971f023024a5b4ce1f97cd905a96a94e19eea19ae9b745f28d02c6689a4473627ce57ec85dce2018a77e699620cb
-
/data/data/com.cif.zfjafp/files/sen/dBFUdElYi.jarFilesize
790KB
MD548eb97659d95ad70c97c1dda17a2dbff
SHA1d83c0535d811aefb3f78de427094f32c2bd3b54b
SHA2562b6602111a8df1babb0eff0ede0624a94e0e73aef1ab51a85288b47d3274829b
SHA5125feb6e2bac21ebb8791ef62e5f67db22bf499b248fcc8b58a4f2ad1356bf4d1e53452f8bf4e90239d33c48daeee6e49fa8fdf94c16f3977a94368d6796ac1550
-
/data/data/com.cif.zfjafp/files/yl_plugin.apkFilesize
58KB
MD55a4c666b43ee7f2b6995aaf3527e4a4d
SHA1b205bcb022797f3b16635db139c7524c0c388adc
SHA25605eb3e1ca331b8c6a1f60f92abb2bddbac54a7b2c229ac07bf26c756297fe72a
SHA512c84fceddbf9928110fc3b85e0989b9cedd06383007ff99dea5a25096d8f892ab52d30ed9b52b72211449041f1274ead85bb42929ec269b58b6b0e616a8545e17
-
/data/user/0/com.cif.zfjafp/app_dex/utopay.jarFilesize
67KB
MD53b8bb9a8679ac8c24e8d179fc5bae999
SHA1e6ea7a1095524087f481ba04321c4cb6fd2426f3
SHA25683c996c0d067b5f516897480f427dfffdcfb49ab7654dac9b805376bbd49e1db
SHA512abf1cbed7a8cf4a29d7a32a83f15aa0a6c9e2be8484c2dd8d9bf16a76e337b17b9c05efa0773598806b3d3da4fe3a9217b583abb9aaf5e3dc054dc77b10cae63
-
/data/user/0/com.cif.zfjafp/app_dex/utopay.jarFilesize
67KB
MD55220524411d0bacd600da60814d1ee9f
SHA1fef7210ff44e757328bc0ff7aae7bb2191cbf634
SHA2566286a800597b845785eb664710253ebd20771737dddd5b80067e0e9d37c804b2
SHA512b2d8af5019c176d682634747d83320e609fb6122ef850f4069a0c78c2415d242087099cf60ecb03039a9ab71902a4e3b22e9cf144de89e506991fb93280f6a5f
-
/data/user/0/com.cif.zfjafp/files/Plugin2.apkFilesize
201KB
MD5ef019d14367b7346b1ae2419e9d445c8
SHA123d81fcf81f3a9f2a991ba4d0d135fe2a28aa188
SHA2561d83642ede6b16a071676e895f547d056543b5b4622bbc9b9b4ab45e47bf9ba0
SHA512ea582f21c6054c37c679c798e93116c9c18c9544c0feb78fb949bed7b2cd3122c8d7bb8ecef329829c2531764abeb6200f0af49ede97c3b0b7448bdb65a34a60
-
/data/user/0/com.cif.zfjafp/files/Plugin2.apkFilesize
201KB
MD52a425e0fae74f20a2c475da937a619a2
SHA14d701c7e6d828aa96ba8a493720e7282c49ec741
SHA2562c61a25f1ad5783bf82eea9faa2536cac4788ed3147bc1864d9ef17ea01be6a7
SHA51244c8d2a837b606de99055badbd4b5e708424ca9809b1583d13aefadc4d4af974658dc3a3f179fc3047eef7167151c638ff66dd6c8d38121b6ecdfb464d2a5a60
-
/data/user/0/com.cif.zfjafp/files/sen/dBFUdElYi.jarFilesize
1.9MB
MD5ea28720c1e80a2b0a1ec95b71e302c0f
SHA1071b1bdad99e5f64f630fdebbfe6d17407315680
SHA2565a0fe54f7647fec9c02bbbe5762ab600e647648c3d09fed6dc0038cc0049bc57
SHA51282f5bd1b63a6fe6e78b9b4384761e9e746479c58a3996a949f70bb681437a7b4d70b081c72607db21b7e660db23e433b69e94fe1834e1c5ded753f1d236c1bcf
-
/data/user/0/com.cif.zfjafp/files/sen/dBFUdElYi.jarFilesize
1.9MB
MD5a1ce081e8ab37db14a25a1c910756873
SHA139bda70d25a104d9f93236d6f8f20cffcf074d54
SHA2566573d7b61a0e34fa30312efe86462538032f8dfdd9d0bbbd3c3c1d2f8f7d5523
SHA51258b87d596326a83289070f994a31366113060ac1692a7ecc36c8db3dfe7a62fa60e4cfc3819d51d7b1a6288a89f291ffe96329e294c9f9c45da0bf45ec302fce
-
/storage/emulated/0/Android/data/com.tongyu.pay/plugin1/tongyu-pay-lib.apkFilesize
107KB
MD55286d64aa08d6b874a081e272487e073
SHA1223ceb3c031d5671523bd6e5a3fd781686d64905
SHA256a86462621910a408278a23363571f528be4275ed72e718ab386253fb3f47e2b6
SHA5129798ac011926024068db16621ea160eda051d67f4a4f6c6ca1616dac77be0cbfc6650b70107f9c2c26ce9b93677df891cbd29deb1120aa783c5afcc4ca83ec1e