Analysis

  • max time kernel
    10s
  • max time network
    179s
  • platform
    android_x86
  • resource
    android-x86-arm-20240611.1-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
  • submitted
    12-06-2024 23:36

General

  • Target

    a2f524af69359f35417a54f75affc8bb_JaffaCakes118.apk

  • Size

    1.7MB

  • MD5

    a2f524af69359f35417a54f75affc8bb

  • SHA1

    0d96914fb3ff27b82386805ec0573c8a8c4ca970

  • SHA256

    3a6a0e2fdc3c83308c92ddb440150d0752c742aa7b82250dd6d3f0d652e02e13

  • SHA512

    642a296b0422d8e2e3cc92179fce072a343bf6257c0487b6063865f2e510192c3eb298795fb0a44aac365a00fd13470dcc1befdaaf9e02fb1f13ec6b8f6edd67

  • SSDEEP

    24576:Cm4AEK+WyhLvCM8w+GaF/SN4AT5cJTDnMiibkJqeoYDjAO02OZGpUgWN1r4/t:6GyhYwDaIN10TrMwqDYDEHZXgWNG/t

Malware Config

Signatures

  • Loads dropped Dex/Jar 1 TTPs 6 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Reads the content of SMS inbox messages. 1 TTPs 1 IoCs
  • Reads the content of the SMS messages. 1 TTPs 1 IoCs
  • Requests cell location 2 TTPs 1 IoCs

    Uses Android APIs to to get current cell location.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Requests dangerous framework permissions 17 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.cif.zfjafp
    1⤵
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Reads the content of SMS inbox messages.
    • Reads the content of the SMS messages.
    • Requests cell location
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks memory information
    PID:4229
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.cif.zfjafp/files/sen/dBFUdElYi.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.cif.zfjafp/files/sen/oat/x86/dBFUdElYi.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4293
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.cif.zfjafp/files/Plugin2.apk --output-vdex-fd=59 --oat-fd=60 --oat-location=/data/user/0/com.cif.zfjafp/files/oat/x86/Plugin2.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4323
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.cif.zfjafp/app_dex/utopay.jar --output-vdex-fd=116 --oat-fd=117 --oat-location=/data/user/0/com.cif.zfjafp/app_dex/oat/x86/utopay.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4454

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.cif.zfjafp/app_dex/utopay.jar
    Filesize

    30KB

    MD5

    eb6089c1acfa9f12535e533aebee845e

    SHA1

    165e39ee07dcd9ed00fc2dc1ff466bc1d6b813c9

    SHA256

    b825cde84e3dddfc147c71265d2259c422d51a7e56d1dcdba1321e3119b1df07

    SHA512

    5b1bc26bcbcf05fc331865fb4dd572b673a52650d68ab4d9b028ea15219e0d93c1ec17996953436801913388d78e25c67ea33aa93544d65e96a799eb06cc70f5

  • /data/data/com.cif.zfjafp/databases/740410100062013
    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

  • /data/data/com.cif.zfjafp/databases/740410100062013-journal
    Filesize

    512B

    MD5

    cd974cca295e7e61a9a472b34de22149

    SHA1

    b7744d0ba67d0217b026f6705dc0f99a10689ffe

    SHA256

    dacc6ed1850295c78fdb72a1aa2c02c1dc7e45cecd9aa69eb52e3b57a9590386

    SHA512

    d50b3e9bf403575fc1c7c6fc72992c034942abd21da1e282045ff079829eae197c593462ac48ef2c7f7d6e4f1738fcec60a02afde148816c9cb4e8c44b3f062c

  • /data/data/com.cif.zfjafp/databases/740410100062013-shm
    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/com.cif.zfjafp/databases/740410100062013-wal
    Filesize

    148KB

    MD5

    233f907802753ebfbc196bd128eb9cbc

    SHA1

    c08151cd4d50bcb730883bd46da3b75b14d1ae1c

    SHA256

    6986a0c459736a5ba4737e913dcfa43636b8e076207d00e8411e98183e9a4d94

    SHA512

    04eae4f1e58b4a54200968f711b24c90c4290bc0c214a911e206474a977d6cf60903539edb06fdddca2f54cb5c39b0d34f709af7a873b81536821129047018ab

  • /data/data/com.cif.zfjafp/databases/wochi_v4.db-journal
    Filesize

    512B

    MD5

    8f0c700ab48d2557a2da85d35954318a

    SHA1

    6359adf51b3725f60dd1178dcfa03c72d1507389

    SHA256

    4d0072b6ea819c598da1f39c1166f28a7afa391cd37ebf32109d01b615235655

    SHA512

    8b9e72517ed02d6651a3c21e4d992f5b40709af06f2ef988db663c854dd4f293db0afda612ce9f90adc08e32a38704dc27e6b974750007f3faaa327a7f5fb44e

  • /data/data/com.cif.zfjafp/databases/wochi_v4.db-shm
    Filesize

    28KB

    MD5

    cf845a781c107ec1346e849c9dd1b7e8

    SHA1

    b44ccc7f7d519352422e59ee8b0bdbac881768a7

    SHA256

    18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

    SHA512

    4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

  • /data/data/com.cif.zfjafp/databases/wochi_v4.db-wal
    Filesize

    20KB

    MD5

    bbf628d8c3e7ed3123a3a964e5bc9b90

    SHA1

    ea85b64391e3045552495a45db8890b82ec3b93a

    SHA256

    362d7e804587d915487818d238976b04b6a0daadf996b2ba53dba24c3972749d

    SHA512

    1f002c21acdcce2373b981263305d593c404c934fd858056e2e153e8652a839a3efa250a5520943c0221921c46d2817b24d6be362a49f7725423ef49ab50c5a0

  • /data/data/com.cif.zfjafp/files/Plugin2.apk
    Filesize

    99KB

    MD5

    3d216f8fddb9705a6720a285475837f1

    SHA1

    f053d23b284bfe2faf6e76d353ff052471e2de2c

    SHA256

    de7bf40574754a5144fa5cf3bc5e97f7adc7f5abebb18c41e8f0631917db4c0c

    SHA512

    38be39da8f96abc87109cfd57b2d63ddfa72971f023024a5b4ce1f97cd905a96a94e19eea19ae9b745f28d02c6689a4473627ce57ec85dce2018a77e699620cb

  • /data/data/com.cif.zfjafp/files/sen/dBFUdElYi.jar
    Filesize

    790KB

    MD5

    48eb97659d95ad70c97c1dda17a2dbff

    SHA1

    d83c0535d811aefb3f78de427094f32c2bd3b54b

    SHA256

    2b6602111a8df1babb0eff0ede0624a94e0e73aef1ab51a85288b47d3274829b

    SHA512

    5feb6e2bac21ebb8791ef62e5f67db22bf499b248fcc8b58a4f2ad1356bf4d1e53452f8bf4e90239d33c48daeee6e49fa8fdf94c16f3977a94368d6796ac1550

  • /data/data/com.cif.zfjafp/files/yl_plugin.apk
    Filesize

    58KB

    MD5

    5a4c666b43ee7f2b6995aaf3527e4a4d

    SHA1

    b205bcb022797f3b16635db139c7524c0c388adc

    SHA256

    05eb3e1ca331b8c6a1f60f92abb2bddbac54a7b2c229ac07bf26c756297fe72a

    SHA512

    c84fceddbf9928110fc3b85e0989b9cedd06383007ff99dea5a25096d8f892ab52d30ed9b52b72211449041f1274ead85bb42929ec269b58b6b0e616a8545e17

  • /data/user/0/com.cif.zfjafp/app_dex/utopay.jar
    Filesize

    67KB

    MD5

    3b8bb9a8679ac8c24e8d179fc5bae999

    SHA1

    e6ea7a1095524087f481ba04321c4cb6fd2426f3

    SHA256

    83c996c0d067b5f516897480f427dfffdcfb49ab7654dac9b805376bbd49e1db

    SHA512

    abf1cbed7a8cf4a29d7a32a83f15aa0a6c9e2be8484c2dd8d9bf16a76e337b17b9c05efa0773598806b3d3da4fe3a9217b583abb9aaf5e3dc054dc77b10cae63

  • /data/user/0/com.cif.zfjafp/app_dex/utopay.jar
    Filesize

    67KB

    MD5

    5220524411d0bacd600da60814d1ee9f

    SHA1

    fef7210ff44e757328bc0ff7aae7bb2191cbf634

    SHA256

    6286a800597b845785eb664710253ebd20771737dddd5b80067e0e9d37c804b2

    SHA512

    b2d8af5019c176d682634747d83320e609fb6122ef850f4069a0c78c2415d242087099cf60ecb03039a9ab71902a4e3b22e9cf144de89e506991fb93280f6a5f

  • /data/user/0/com.cif.zfjafp/files/Plugin2.apk
    Filesize

    201KB

    MD5

    ef019d14367b7346b1ae2419e9d445c8

    SHA1

    23d81fcf81f3a9f2a991ba4d0d135fe2a28aa188

    SHA256

    1d83642ede6b16a071676e895f547d056543b5b4622bbc9b9b4ab45e47bf9ba0

    SHA512

    ea582f21c6054c37c679c798e93116c9c18c9544c0feb78fb949bed7b2cd3122c8d7bb8ecef329829c2531764abeb6200f0af49ede97c3b0b7448bdb65a34a60

  • /data/user/0/com.cif.zfjafp/files/Plugin2.apk
    Filesize

    201KB

    MD5

    2a425e0fae74f20a2c475da937a619a2

    SHA1

    4d701c7e6d828aa96ba8a493720e7282c49ec741

    SHA256

    2c61a25f1ad5783bf82eea9faa2536cac4788ed3147bc1864d9ef17ea01be6a7

    SHA512

    44c8d2a837b606de99055badbd4b5e708424ca9809b1583d13aefadc4d4af974658dc3a3f179fc3047eef7167151c638ff66dd6c8d38121b6ecdfb464d2a5a60

  • /data/user/0/com.cif.zfjafp/files/sen/dBFUdElYi.jar
    Filesize

    1.9MB

    MD5

    ea28720c1e80a2b0a1ec95b71e302c0f

    SHA1

    071b1bdad99e5f64f630fdebbfe6d17407315680

    SHA256

    5a0fe54f7647fec9c02bbbe5762ab600e647648c3d09fed6dc0038cc0049bc57

    SHA512

    82f5bd1b63a6fe6e78b9b4384761e9e746479c58a3996a949f70bb681437a7b4d70b081c72607db21b7e660db23e433b69e94fe1834e1c5ded753f1d236c1bcf

  • /data/user/0/com.cif.zfjafp/files/sen/dBFUdElYi.jar
    Filesize

    1.9MB

    MD5

    a1ce081e8ab37db14a25a1c910756873

    SHA1

    39bda70d25a104d9f93236d6f8f20cffcf074d54

    SHA256

    6573d7b61a0e34fa30312efe86462538032f8dfdd9d0bbbd3c3c1d2f8f7d5523

    SHA512

    58b87d596326a83289070f994a31366113060ac1692a7ecc36c8db3dfe7a62fa60e4cfc3819d51d7b1a6288a89f291ffe96329e294c9f9c45da0bf45ec302fce

  • /storage/emulated/0/Android/data/com.tongyu.pay/plugin1/tongyu-pay-lib.apk
    Filesize

    107KB

    MD5

    5286d64aa08d6b874a081e272487e073

    SHA1

    223ceb3c031d5671523bd6e5a3fd781686d64905

    SHA256

    a86462621910a408278a23363571f528be4275ed72e718ab386253fb3f47e2b6

    SHA512

    9798ac011926024068db16621ea160eda051d67f4a4f6c6ca1616dac77be0cbfc6650b70107f9c2c26ce9b93677df891cbd29deb1120aa783c5afcc4ca83ec1e