52b56ad1c8f1beb1f7d697c1377a408a11a992f35d66cd87212e725878273a83

General

Target
a8d37293242111cec03e08ceac1c5221_JaffaCakes118.apk
Size 10.3MB
Sample240614-ktedfstbnb
SHA256 52b56ad1c8f1beb1f7d697c1377a408a11a992f35d66cd87212e725878273a83
MD5 a8d37293242111cec03e08ceac1c5221
SHA1 313ffbc245560f3882bf2b5992c3a7526b96baf9
SHA512 864eb30bf00747d3cfa2d8f2ce7b56e3d703035051fedaff633ec2e8d203f537557ddec172a4093198493c14ae368849defc11cddb5e6349e80b81f428b7967f
SSDEEP 196608:0NYDmqgCSta8jltir2GfxcEMu/hTmtZnz9q6g2hy/nr7rlOdC:SrsQU/cEMu/hTmtZBpzhyvr7rZ
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

banker collection discovery evasion impact

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	cm.tuofu.a20140927081705

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	cm.tuofu.a20140927081705

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	cm.tuofu.a20140927081705

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	cm.tuofu.a20140927081705

cm.tuofu.a20140927081705
1⤵
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Uses Crypto APIs (Might try to encrypt user data)
PID:4662

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Execution Guardrails

1

T1627

Geofencing

1

T1627.001

Credential Access

Discovery

Location Tracking

1

T1430

Software Discovery

1

T1418

Security Software Discovery

1

T1418.001

System Network Configuration Discovery

2

T1422

System Network Connections Discovery

2

T1421

Lateral Movement

Collection

Location Tracking

1

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

db.db

Path /data/data/cm.tuofu.a20140927081705/databases/db.db
Size 23.7MB
SHA256 da47ffccbc24e87f2b662ce41cf87e1147af87f570e7078a19d1e40c71b03229
MD5 5751e0c6188af3680d79c18686c1a7e1
SHA1 0ddd57511eaece612470f2b3d546c4cfbd3f0f76
SHA512 93878b3a30104582b462ef79a9dbe5d70306dc1451417b295d8b13bce28af7de52713f476d78a10ab9edbafbf96eac25a952bb8bc09087c1ff0c59b596e9a6f2
SSDEEP 196608:rqIWLKEII5PvqknoJKeLqlFX7WpgN1uU4CnOo49UanrRf:m8L
MD5 SHA1 SHA512 SSDEEP

Submit Download

-2054404330

Path /data/user/0/cm.tuofu.a20140927081705/cache/feiwo_dir/storage/emulated/0/feiwomob/cache_2/-2054404330
Size 138B
SHA256 da5b5353778777054c46f194d8f8a0018e0164112657ce2a417e92521b044ef9
MD5 6b6459d52f57e09db2e58cc97c57f8d7
SHA1 cafdb7ebf691076ad5d4ef4d38eab16c66ad1238
SHA512 96cae4b0cfefa6e827aad7f8045736e7f5c3133f0c7d60a520bcc91ad8e31e1cf597b908c99b96540031892918b9a8cb44249b28781fa9d49fa64d2bf71585d6
MD5 SHA1 SHA512

Submit Download

-2054404330

Path /data/user/0/cm.tuofu.a20140927081705/cache/feiwo_dir/storage/emulated/0/feiwomob/cache_3/-2054404330
Size 144B
SHA256 d15489635efbfde00f62f93c54795292d189e702ff75896e74a9476459584fd3
MD5 7570dad48a063a539a65b55460ba7be5
SHA1 dce6c30df13d6b2b403fb7c2ec47bffecf04f0e1
SHA512 0ff08876c9e5cfae170284e1295a302d7e5c2b7370ef13242bbc85e655445f37cada490748676e223d32d7bfab6efec106508bc1445dbd8bca7567d7ff102dbb
MD5 SHA1 SHA512

Submit Download

1807629056

Path /data/user/0/cm.tuofu.a20140927081705/cache/feiwo_dir/storage/emulated/0/feiwomob/global_cache/1807629056
Size 107B
SHA256 d862dc9d32cfefca15ba0ce33d49944815e8069fdb27820e5e4fb1bfd62f8318
MD5 676aa9573d3c381e283dcec0d3f49ce0
SHA1 55466c9c0525c3d80081ce5dabcf6e7e2f9fd776
SHA512 14032bd8c961d54e4aaf994edd4a081ce713bd82c244a289cd5a0cdf217f1226c42c3f3a53ed23a18b333e6ec9228e80a2b1aa8a7f4ed30a34df2b9149e5af0d
MD5 SHA1 SHA512

Submit Download

1807629056

Path /data/user/0/cm.tuofu.a20140927081705/cache/feiwo_dir/storage/emulated/0/feiwomob/global_cache/1807629056
Size 148B
SHA256 575d091e1119d49f30fd750ddcf98ac3f9402ab8b8fd466a4e6f26a9bab5f1af
MD5 b25308a7f2e253083b30a2bdbd8e1549
SHA1 6098ffb31af72eac909371ecab2703e6abee2d39
SHA512 8cb99b151d09901adef0212d08942d0811d4159aa5ec6cf5ba97d03df89bee6393eb3132cfebcb0d1ee72c9c1abaabacdaeabf231a62de5f8c4053a25f178a50
MD5 SHA1 SHA512

Submit Download

db.db

Path /data/user/0/cm.tuofu.a20140927081705/databases/db.db
Size 4.2MB
SHA256 75ecff67d0711df96dcd9e39a170e6777e7fb1c1bfc79cfb12f505e0efbd5c05
MD5 b477871e0b1237f3319b0c8280245bcc
SHA1 004380fd066f52d5902673e5c2fcaaf8d977596b
SHA512 000b29c5ce09d0296fdf2d9d4fea434a12d6279ddda1d19b01ac69b87edb0bd82fbdb7c282572a7a4071c2ca4b1dc6d6896cd1f5ad97d2384e428c842038e643
SSDEEP 48:uhoNkl2hjyKz5izLnQaCtxAVSDDWKa/s6BI:uKNjlz5GQag4SuKa/rI
MD5 SHA1 SHA512 SSDEEP

Submit Download

db.db-journal

Path /data/user/0/cm.tuofu.a20140927081705/databases/db.db-journal
Size 2KB
SHA256 e00d6048268929d93016d7cff5a63c8f4fcb0d0a695a2177aeaf38ff206a1a81
MD5 75dfca6e947fdeb6dbf53cbfb8da1733
SHA1 ad360965941c9d94940af194a79e5968f9f23943
SHA512 496622a5b70fca7bdbfd73e3a9825bd4e1c3fee559b62f692b613172786c539430a467d1f120a6ffab2a7a0d2c2218cce3e096980c5502045f5ad22b989b3a77
MD5 SHA1 SHA512

Submit Download

db.db-journal

Path /data/user/0/cm.tuofu.a20140927081705/databases/db.db-journal
Size 2KB
SHA256 6b7b2b86e3544d76120c53b062401f61b752dda22add77bce9aaa96e468ed10c
MD5 e1eb5ba4340e4d69e6fd03fd7582aeaa
SHA1 dbb04bc50fc96a7ee6feb4c4eba899b561ac7e3c
SHA512 a6edae9d48de9135ff00a3ac937ab484e211b4131f978701f660bc990c3c1a3244c6a5b80694963dd42cfd165b008e3c3203e088f76f82eab36e76b79f4ab339
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads