a49331e419c70643364f3f6419ca171b91dbd2b7a8d4023fae620ff8d09fa2fd

Analysis

max time kernel
9s
max time network
164s
platform
android_x86
resource
android-x86-arm-20240611.1-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
submitted
14-06-2024 07:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a8814ccd9838fff24511a67db3285f6f_JaffaCakes118.apk
Size

31.0MB
MD5

a8814ccd9838fff24511a67db3285f6f
SHA1

48bebf46fd6b9710d9bae807dc7643464a7db248
SHA256

a49331e419c70643364f3f6419ca171b91dbd2b7a8d4023fae620ff8d09fa2fd
SHA512

f001fab9550f3b863a794141f9b08287cb5e0ba97ba46bb2999c318eca8c3373eb140d2ed191ab9071445c4e169f53b3007ff99b3fe54cd958031cce80b15a4a
SSDEEP

786432:J5CoWANgJycKalzfCfR67SF/ClJLCOgL6hMK4u:J5/GJJKdoWF/kLWAgu

Score

7^/10

discovery evasion

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

T1407

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.code.stumpy.loco/files/stares/updates/sta.jar --output-vdex-fd=62 --oat-fd=66 --oat-location=/data/user/0/com.code.stumpy.loco/files/stares/updates/oat/x86/sta.odex --compiler-filter=quicken --class-loader-context=&com.code.stumpy.loco

ioc	pid	process
/data/user/0/com.code.stumpy.loco/files/stares/updates/sta.jar	4353	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.code.stumpy.loco/files/stares/updates/sta.jar --output-vdex-fd=62 --oat-fd=66 --oat-location=/data/user/0/com.code.stumpy.loco/files/stares/updates/oat/x86/sta.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.code.stumpy.loco/files/stares/updates/sta.jar	4269	com.code.stumpy.loco

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

T1422

com.code.stumpy.loco
1⤵
- Loads dropped Dex/Jar
PID:4269

getprop ro.board.platform
2⤵
PID:4313

getprop ro.mediatek.platform
2⤵
PID:4332

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.code.stumpy.loco/files/stares/updates/sta.jar --output-vdex-fd=62 --oat-fd=66 --oat-location=/data/user/0/com.code.stumpy.loco/files/stares/updates/oat/x86/sta.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:4353

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.code.stumpy.loco/app_plugin_lib/libabcdefgh.so
Filesize
61KB

MD5
042246eb7c48a8cda97de99465e6a177

SHA1
f71816c4a80fbb7b63bfd6425d98db513aecb00a

SHA256
9a712cb778e9d43f8f4ea9fa2b9f4b8cc29daf74984d04f0c938dff21c118342

SHA512
2d201619998113c5d2990c92c28c973d557872bc4bbde153b5fca39bfe0b799ef0e9bf8c29d1304847f8e6691d55649d04c6a82fe8f03e621c9e8da50c50faa8

Download Submit
/data/data/com.code.stumpy.loco/files/stares/updates/sta.jar
Filesize
2.1MB

MD5
7219500f857b0c418b074759ba44301e

SHA1
07f557bc3d839260caf921852618ac762fef262d

SHA256
d8c32e40ba04065dd62cae8495eb47d1c251a6bc830778f80eb06ae07f04563f

SHA512
6086cfbeb32e3ded98d89c0f0bc01fac10e6036874e1c8e0ecb41864e62b00df5a32f9a3aa7bf126f6b8f1393db48abaf94ce528cf0686a3946b139bc50c8a68

Download Submit
/data/user/0/com.code.stumpy.loco/files/stares/updates/sta.jar
Filesize
3.4MB

MD5
1895ebc4a529cfdff88439d2140f1c41

SHA1
3db0c02c9734c4e212e1c491a92006281e904034

SHA256
c2d2e925a001babc6f5d2a274e1f88664be2a888e8fb689bec2e635f8022cbc8

SHA512
61412d92c5077933c63f50adaa0059343ea4d4056598847a69d8d815e9828a7ecb964856c7d3972f2baa813b0b2f979129adf3b2402901c50e55e43811ac0df3

Download Submit
/data/user/0/com.code.stumpy.loco/files/stares/updates/sta.jar
Filesize
3.4MB

MD5
63425c66f0f75213b749622795186076

SHA1
0246e8104a8e5f97ecc2a30ca48b60cb8c10abff

SHA256
12279787d7df147ab2112cfa402f93edcb205334f8d08b0ebcf49c19f7ee1507

SHA512
28530981b932cef52175db72fa68aeb0d44d852e7aebc13d9b848d6313109d7ece366369eddda264a4ca08b46814b3f966271367ad0205a91d7d67a29862756f

Download Submit
/storage/emulated/0/data/.systemid
Filesize
36B

MD5
8207959afb63601968e5d75452d3bb0f

SHA1
e97df2a533bfd388e372ae08a5f023bfb248a29d

SHA256
204f8f5589aa70ec11d13d14568b510e017159e21311f10eb3ef67a34fb01c40

SHA512
d454fb86e9ca8fbd5639065d70d38df9f63b51886ac85c77f3d6fcb7d44090f9c20c28bad74242996cc9eb8334df2b7ad04206662e8cf3f8e93f892a2d6cdb96

Download Submit