429bbe5b2d23f38414d59507522607bd1cb426687a03dfa4aafb60e6327b82a7

Analysis

max time kernel
177s
max time network
175s
platform
android_x64
resource
android-x64-arm64-20240611.1-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
submitted
14-06-2024 19:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab372e536064ff9e16bd3e6b2278284b_JaffaCakes118.apk
Size

788KB
MD5

ab372e536064ff9e16bd3e6b2278284b
SHA1

5a8f0b7417118c99ac5965f01f95cbbc7153348b
SHA256

429bbe5b2d23f38414d59507522607bd1cb426687a03dfa4aafb60e6327b82a7
SHA512

2c4693edd8bcde41aa6acc46863a6b5de62aa8be3edf88ed10eb739eb25635912ec2a629544c869b030c988ddbf7f34ca3f059473e2592b2b02b8599f3b017b9
SSDEEP

24576:moEaFmFN9v46flHtIxoly6rJwvUWiExxq1s9N:moEaFmL9AcXd+vVimGsP

Score

8^/10

banker collection credential_access discovery evasion impact stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

T1628.001

Processes:

com.naphew.sys5

pid process

4685 com.naphew.sys5
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
evasion

T1407

Processes:

com.naphew.sys5

ioc pid process

/data/user/0/com.naphew.sys5/app_ttmp/t.jar 4685 com.naphew.sys5
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
collection credential_access impact

T1414

T1641.001

Processes:

com.naphew.sys5

description ioc process

Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.naphew.sys5
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

T1418.001
Queries information about active data network 1 TTPs 1 IoCs
discovery

T1421

Processes:

com.naphew.sys5

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.naphew.sys5
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

T1471

Processes:

com.naphew.sys5

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.naphew.sys5
Checks CPU information 2 TTPs 1 IoCs

T1633.001

T1426

Processes:

com.naphew.sys5

description ioc process

File opened for read /proc/cpuinfo com.naphew.sys5
Checks memory information 2 TTPs 1 IoCs

T1633.001

T1426

Processes:

com.naphew.sys5

description ioc process

File opened for read /proc/meminfo com.naphew.sys5

pid	process
4685	com.naphew.sys5

ioc	pid	process
/data/user/0/com.naphew.sys5/app_ttmp/t.jar	4685	com.naphew.sys5

description	ioc	process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.naphew.sys5

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.naphew.sys5

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.naphew.sys5

description	ioc	process
File opened for read	/proc/cpuinfo	com.naphew.sys5

description	ioc	process
File opened for read	/proc/meminfo	com.naphew.sys5

com.naphew.sys5
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4685

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.naphew.sys5/app_ttmp/t.jar
Filesize
276KB

MD5
9aaea567e0c93e51718ba7eade0e83df

SHA1
0005116aad1779361b70093db00fed5ac090ae23

SHA256
b30a95dff6f65f444472971c8aaf895ffc8e66e0117ce242ec4cb8a8a519a5ec

SHA512
2aef1034335d8752f4e25ce6c5823ce03019536cc6e51ee61b5291c77a0f356a2517e0cbe7f2c4cc2d897115dc856449a342cfdc247c9d34d313187d15b2f890

Download Submit
/data/user/0/com.naphew.sys5/app_ttmp/t.jar
Filesize
587KB

MD5
f72c3d07507c3e26d317e9117ba757d1

SHA1
cdede4739e9dd9fd95243aab5e44c24f93f825c3

SHA256
1c65834d9ca018c6496a8b9957589d0e94657911b6635dc21a448d78f9238887

SHA512
3420714252e7503abc13c99274d767b0bc08671d769460dc61823ab9470e145fb75c5dfaadc617d3a05cf251ed5ecf38ea7e8c1d7b343bca4d7e8296f1b805d4

Download Submit
/data/user/0/com.naphew.sys5/databases/com.naphew.sys5b
Filesize
72KB

MD5
565cc4304f6cf26194b0ba402ba1f887

SHA1
85cca5d60470bbd412f7ea9c3a2b6700b7797225

SHA256
0b483a48d4cece845ee53e21bf9c3462a5296a80571efbc7fea25d06e970dc31

SHA512
9ed4a22b41e6176de97ecc66b1c0c8a6ac49a6ed580eb429f98f6fb60b4122c8045cd7d26311659a8d6261e849944d787d5e53b524d09dc927586c6e1fabe578

Download Submit
/data/user/0/com.naphew.sys5/databases/com.naphew.sys5b-journal
Filesize
512B

MD5
c13383c83c51754ad5c1cfd065635e16

SHA1
1e45a852944799f2a56d53eeafe909b28670c980

SHA256
af4c70c6f52534bad857e2aeabc1a6c047bfc449d0adf082cac8fc57e1b13883

SHA512
4593ec2597f04b22e92c1ef02d2d529f79b527bb1c409fdf954e2b37f978a9dd72b103a484b1afd9e67999029b3e34a85d6d3b174b9644c8232f038a52ed3fe9

Download Submit
/data/user/0/com.naphew.sys5/databases/com.naphew.sys5b-journal
Filesize
8KB

MD5
c8d85333dbe618cae580cafedad16a16

SHA1
da106d4dbbb7ecc57b38477803f5f35b22597857

SHA256
23030d8806a5adbdfd3129f48eb77dd8510f426c6d87965c5fb33bd3322bf777

SHA512
ff21d1fb67a91186204058d69e79766f6e68d558e40542360d364dff00bc1105dcbef78db2fa39395327ae0a8072bb9954607a44bf6023775776d2e4d39de618

Download Submit
/data/user/0/com.naphew.sys5/databases/com.naphew.sys5b-journal
Filesize
8KB

MD5
00fc5ac0a1bf422f6f33b1633de2a89f

SHA1
836883a05c4758c59e43ede58f568ecb590ba611

SHA256
7cd2988625327f5fdc57d103871f40fda8c496cffb660c388b0200bafd936b46

SHA512
7fbb6a26d789cd626ab76996e855d484f1df038a20d95195434ff0bab0b6b2da448005a78a87c306b34af52c9874f5d7c1f1f209b799c6ac52b4d860e62d48aa

Download Submit
/data/user/0/com.naphew.sys5/databases/com.naphew.sys5b-journal
Filesize
12KB

MD5
6d2872c103964cb4f65c856bc9615f01

SHA1
0fd5eaaec3d95a0ce7debe38d411b81d9510cb5f

SHA256
4014422ce4650b79f74a8d5cbcc6b45045b086d41eb829aedc92c711b467b5ed

SHA512
ba804f7c7f9fcedec9b88c94c3bee0607187524984f2f0eab17bc29473c9442b8ea84112f315a067b369a2c8cc89643c6aab7c2be2ae9cd876c52aadb649eb66

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads