429bbe5b2d23f38414d59507522607bd1cb426687a03dfa4aafb60e6327b82a7

General

Target

ab372e536064ff9e16bd3e6b2278284b_JaffaCakes118.apk
Size

788KB
MD5

ab372e536064ff9e16bd3e6b2278284b
SHA1

5a8f0b7417118c99ac5965f01f95cbbc7153348b
SHA256

429bbe5b2d23f38414d59507522607bd1cb426687a03dfa4aafb60e6327b82a7
SHA512

2c4693edd8bcde41aa6acc46863a6b5de62aa8be3edf88ed10eb739eb25635912ec2a629544c869b030c988ddbf7f34ca3f059473e2592b2b02b8599f3b017b9
SSDEEP

24576:moEaFmFN9v46flHtIxoly6rJwvUWiExxq1s9N:moEaFmL9AcXd+vVimGsP

Score

8^/10

banker collection credential_access discovery evasion impact persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

T1628.001

Processes:

com.naphew.sys5

pid process

5008 com.naphew.sys5
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
evasion

T1407

Processes:

com.naphew.sys5

ioc pid process

/data/user/0/com.naphew.sys5/app_ttmp/t.jar 5008 com.naphew.sys5
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
collection credential_access impact

T1414

T1641.001

Processes:

com.naphew.sys5

description ioc process

Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.naphew.sys5
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

T1418.001
Queries information about active data network 1 TTPs 1 IoCs
discovery

T1421

Processes:

com.naphew.sys5

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.naphew.sys5
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

T1422

Processes:

com.naphew.sys5

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.naphew.sys5
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

T1422
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

T1624.001

Processes:

com.naphew.sys5

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.naphew.sys5
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

T1471

Processes:

com.naphew.sys5

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.naphew.sys5
Checks CPU information 2 TTPs 1 IoCs

T1633.001

T1426

Processes:

com.naphew.sys5

description ioc process

File opened for read /proc/cpuinfo com.naphew.sys5
Checks memory information 2 TTPs 1 IoCs

T1633.001

T1426

Processes:

com.naphew.sys5

description ioc process

File opened for read /proc/meminfo com.naphew.sys5

pid	process
5008	com.naphew.sys5

ioc	pid	process
/data/user/0/com.naphew.sys5/app_ttmp/t.jar	5008	com.naphew.sys5

description	ioc	process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.naphew.sys5

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.naphew.sys5

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.naphew.sys5

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.naphew.sys5

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.naphew.sys5

description	ioc	process
File opened for read	/proc/cpuinfo	com.naphew.sys5

description	ioc	process
File opened for read	/proc/meminfo	com.naphew.sys5

com.naphew.sys5
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:5008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.naphew.sys5/app_ttmp/oat/t.jar.cur.prof
Filesize
616B

MD5
1a04580b45a4cc8ce0839db7286ff5c1

SHA1
f699df9c2b47d1083a66d71111a53d93b396ccf2

SHA256
877059c9dd8e74af07ee6c52734e911876ddc922d8c04ef72370641f249f2a90

SHA512
e93ab95a980a8553c76b614e94746a509135b85e68b7d617fa9fb036f82d6c08f1b80f2f79d2ffe32bf8b6f8023ff4b2626d29ecf791d02728b12e6f35842d62

Download Submit
/data/data/com.naphew.sys5/app_ttmp/t.jar
Filesize
276KB

MD5
9aaea567e0c93e51718ba7eade0e83df

SHA1
0005116aad1779361b70093db00fed5ac090ae23

SHA256
b30a95dff6f65f444472971c8aaf895ffc8e66e0117ce242ec4cb8a8a519a5ec

SHA512
2aef1034335d8752f4e25ce6c5823ce03019536cc6e51ee61b5291c77a0f356a2517e0cbe7f2c4cc2d897115dc856449a342cfdc247c9d34d313187d15b2f890

Download Submit
/data/data/com.naphew.sys5/databases/com.naphew.sys5b
Filesize
72KB

MD5
42b81e30d3a6d0eb9a858564873b6fc7

SHA1
8d74be327ca548df7b1ba23289f29655c2ba5c1b

SHA256
e904cf52487853bffdb77daeb8cd6a972c7eef6d6b1a179083d85f40dcc012e1

SHA512
ab2e4e20409ec09995e7cf7595bb113505ae204fe1baa1e83e3e0ede6e89191dbda941fc88d231856c1a78ab31d81aa2d26feb0625be6c4eebdeeacb0b1d5579

Download Submit
/data/data/com.naphew.sys5/databases/com.naphew.sys5b-journal
Filesize
512B

MD5
9cbe05c7c50441c2c80e4a1f030bd8dc

SHA1
27a470ea6b7d1e1cc385577a62a6b1b5fde38491

SHA256
595bcca684e8cb9a8d3dc0f869bbc15f76ecf77676cf36616fba6c9f0d4c8160

SHA512
409e4c3adef2a1ca06718033c12bfc3b7416eddf25c157b8f32a780dfd600c92a6ffc4e3a744632b56c6be978cf024e17f332bf6221697b4162e7ec6a0285dce

Download Submit
/data/data/com.naphew.sys5/databases/com.naphew.sys5b-journal
Filesize
8KB

MD5
ba4255be8f6d7bda953fc1917d666f3a

SHA1
352e8725180c188749e707305674798abc948ae4

SHA256
08158a6dc711b6f1928d2836570e0d35a63bca28b689b214cea0621eeda0c950

SHA512
fc05ddd916452497ec201fa39945492c486f9aafcf37e2327e7ef7453c9efc7897e705df77bffe66882f9430fca0117c5deb13ac6376749544c134db773863fd

Download Submit
/data/data/com.naphew.sys5/databases/com.naphew.sys5b-journal
Filesize
8KB

MD5
36acdfd58c18ffb97862ec121db83caa

SHA1
08fc197f8859b498906ff5aabb0ab7ecd39350d0

SHA256
d461045890d295334989d94d6442a88a775f0dff738a8f78ef24807701b4d1b8

SHA512
29e66264e557b3b118b1aff191220f4180ff716f4df8b79672d322505bd853043904c4e3a60e2317025eab462488b555bfdca6cd42445a098628b586bd272263

Download Submit
/data/data/com.naphew.sys5/databases/com.naphew.sys5b-journal
Filesize
12KB

MD5
9fcc689370d5aff504b40d674c38ebc0

SHA1
cc6917a0384905aebcf3e40ccab48c39f47ce8b0

SHA256
1ca18a9b95bc3443e9a7dfdad1e4ae7a41dc6cc655b52e33a8dff513cae7a2e0

SHA512
176abcc5e7cc3fe82287da14974f4f7ac16470726b35211f8a28046c69ee7e2aba97e97e6531617822f46db6c6568132fd7c2688189388a9ad0560487634a23c

Download Submit
/data/user/0/com.naphew.sys5/app_ttmp/t.jar
Filesize
587KB

MD5
f72c3d07507c3e26d317e9117ba757d1

SHA1
cdede4739e9dd9fd95243aab5e44c24f93f825c3

SHA256
1c65834d9ca018c6496a8b9957589d0e94657911b6635dc21a448d78f9238887

SHA512
3420714252e7503abc13c99274d767b0bc08671d769460dc61823ab9470e145fb75c5dfaadc617d3a05cf251ed5ecf38ea7e8c1d7b343bca4d7e8296f1b805d4

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads