e866e8573dda8b82e07f43f5d10e81725b1248c6db494659dc5b396221a7e75b

Analysis

max time kernel
170s
max time network
130s
platform
android_x86
resource
android-x86-arm-20240611.1-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
submitted
14/06/2024, 12:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a9a7e3b9f6c2531356bb7acd3a303334_JaffaCakes118.apk
Size

23.8MB
MD5

a9a7e3b9f6c2531356bb7acd3a303334
SHA1

8488619c47d3cad214a8926885ee22cb19371341
SHA256

e866e8573dda8b82e07f43f5d10e81725b1248c6db494659dc5b396221a7e75b
SHA512

6bd77369a2d251e92bf7024ec91bb57c273fbf77b306e68abf3c3cf3a055549a720a8bc3fbc7835bc446567b1bdd0865d805662e9816a43c3426fd3a749adc72
SSDEEP

393216:peED23xn1mWvzokfDoUzYPuUlJMDLYNf127IWUAy3PXjv6ODOcLGFCkLpBrs47zR:EEq3pvzrf8UcDMQh1kNI7C5cCBpBrvzR

Score

7^/10

banker discovery evasion impact persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 5 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.Mammoth.KuiBa/app_skong/kong.jar	4269	com.Mammoth.KuiBa
/data/user/0/com.Mammoth.KuiBa/app_skong/kong.jar	4321	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.Mammoth.KuiBa/app_skong/kong.jar --output-vdex-fd=59 --oat-fd=64 --oat-location=/data/user/0/com.Mammoth.KuiBa/app_skong/oat/x86/kong.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.Mammoth.KuiBa/files/egame_temp.jar	4335	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.Mammoth.KuiBa/files/egame_temp.jar --output-vdex-fd=61 --oat-fd=62 --oat-location=/data/user/0/com.Mammoth.KuiBa/files/oat/x86/egame_temp.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.Mammoth.KuiBa/app_skong/kong.jar	4269	com.Mammoth.KuiBa
/data/user/0/com.Mammoth.KuiBa/files/egame_temp.jar	4269	com.Mammoth.KuiBa

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.Mammoth.KuiBa

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.Mammoth.KuiBa

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.Mammoth.KuiBa

com.Mammoth.KuiBa
1⤵
- Loads dropped Dex/Jar
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
PID:4269
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.Mammoth.KuiBa/app_skong/kong.jar --output-vdex-fd=59 --oat-fd=64 --oat-location=/data/user/0/com.Mammoth.KuiBa/app_skong/oat/x86/kong.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4321
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.Mammoth.KuiBa/files/egame_temp.jar --output-vdex-fd=61 --oat-fd=62 --oat-location=/data/user/0/com.Mammoth.KuiBa/files/oat/x86/egame_temp.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4335

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

Lateral Movement

Collection

Command and Control

Exfiltration

Impact