429bbe5b2d23f38414d59507522607bd1cb426687a03dfa4aafb60e6327b82a7

Analysis

max time kernel
178s
max time network
138s
platform
android_x86
resource
android-x86-arm-20240611.1-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
submitted
14-06-2024 19:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab372e536064ff9e16bd3e6b2278284b_JaffaCakes118.apk
Size

788KB
MD5

ab372e536064ff9e16bd3e6b2278284b
SHA1

5a8f0b7417118c99ac5965f01f95cbbc7153348b
SHA256

429bbe5b2d23f38414d59507522607bd1cb426687a03dfa4aafb60e6327b82a7
SHA512

2c4693edd8bcde41aa6acc46863a6b5de62aa8be3edf88ed10eb739eb25635912ec2a629544c869b030c988ddbf7f34ca3f059473e2592b2b02b8599f3b017b9
SSDEEP

24576:moEaFmFN9v46flHtIxoly6rJwvUWiExxq1s9N:moEaFmL9AcXd+vVimGsP

Score

8^/10

banker discovery evasion impact persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

T1628.001

Processes:

com.naphew.sys5

pid process

4175 com.naphew.sys5
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
evasion

T1407

Processes:

com.naphew.sys5

ioc pid process

/data/user/0/com.naphew.sys5/app_ttmp/t.jar 4175 com.naphew.sys5
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

T1418.001
Queries information about active data network 1 TTPs 1 IoCs
discovery

T1421

Processes:

com.naphew.sys5

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.naphew.sys5
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

T1422

Processes:

com.naphew.sys5

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.naphew.sys5
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

T1624.001

Processes:

com.naphew.sys5

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.naphew.sys5
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

T1471

Processes:

com.naphew.sys5

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.naphew.sys5
Checks CPU information 2 TTPs 1 IoCs

T1633.001

T1426

Processes:

com.naphew.sys5

description ioc process

File opened for read /proc/cpuinfo com.naphew.sys5
Checks memory information 2 TTPs 1 IoCs

T1633.001

T1426

Processes:

com.naphew.sys5

description ioc process

File opened for read /proc/meminfo com.naphew.sys5

pid	process
4175	com.naphew.sys5

ioc	pid	process
/data/user/0/com.naphew.sys5/app_ttmp/t.jar	4175	com.naphew.sys5

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.naphew.sys5

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.naphew.sys5

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.naphew.sys5

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.naphew.sys5

description	ioc	process
File opened for read	/proc/cpuinfo	com.naphew.sys5

description	ioc	process
File opened for read	/proc/meminfo	com.naphew.sys5

com.naphew.sys5
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4175

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.naphew.sys5/app_ttmp/oat/t.jar.cur.prof
Filesize
593B

MD5
4a1b21a1919e195723cd19574619046e

SHA1
db55e03f72c0c3e1275f353ae33300aede81f00c

SHA256
90f9ed8913f085e87ef641b3fea784f8fd232231b80c336438614bb6d62cd067

SHA512
23f619d271db0a423dc6ec603360041a394af388cc1976fa3da0eb3b4fa9db40281e102f41da979fd0b6a7c82dd034656f740ee92563565799aad00fa1612452

Download Submit
/data/data/com.naphew.sys5/app_ttmp/t.jar
Filesize
276KB

MD5
9aaea567e0c93e51718ba7eade0e83df

SHA1
0005116aad1779361b70093db00fed5ac090ae23

SHA256
b30a95dff6f65f444472971c8aaf895ffc8e66e0117ce242ec4cb8a8a519a5ec

SHA512
2aef1034335d8752f4e25ce6c5823ce03019536cc6e51ee61b5291c77a0f356a2517e0cbe7f2c4cc2d897115dc856449a342cfdc247c9d34d313187d15b2f890

Download Submit
/data/data/com.naphew.sys5/databases/com.naphew.sys5b
Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.naphew.sys5/databases/com.naphew.sys5b-journal
Filesize
512B

MD5
52cc0b38677d01f6864bd78c83f733a3

SHA1
f6d81fbd767d3a43aa40ffae2e333edf7eec0c6f

SHA256
1936c9d71004a3197fd34f77bce70bc6bad50205630815b36e05024d6be9a176

SHA512
d9542edf620aace80dc4ae9122b623948bce4e64b1466feebe5e323628e6104164f4cdb0697269e8989694a3255fa659bdf3bc4f9de17d2ec872c9cd2758784c

Download Submit
/data/data/com.naphew.sys5/databases/com.naphew.sys5b-shm
Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.naphew.sys5/databases/com.naphew.sys5b-wal
Filesize
92KB

MD5
dd81a273d2144e3d7d3a1b51eb063c18

SHA1
726fc64129805e402e1ad68b56bd1e479739d5d0

SHA256
9b28237f027b2c2998f24b3e3be0d600be5dc1a21415db7e5ed661b4ab41e28f

SHA512
87c3be056a33009e3efa5b308f8db5127bb54d22d2cb96e0d9a62a40d0e6157d38ae5a94d1b04c388c3ae01abae52775f100c3491f9c17122f2e85a856d677a0

Download Submit
/data/user/0/com.naphew.sys5/app_ttmp/t.jar
Filesize
587KB

MD5
f72c3d07507c3e26d317e9117ba757d1

SHA1
cdede4739e9dd9fd95243aab5e44c24f93f825c3

SHA256
1c65834d9ca018c6496a8b9957589d0e94657911b6635dc21a448d78f9238887

SHA512
3420714252e7503abc13c99274d767b0bc08671d769460dc61823ab9470e145fb75c5dfaadc617d3a05cf251ed5ecf38ea7e8c1d7b343bca4d7e8296f1b805d4

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads