1a86a85cf278d89cff6b23e6b1756a6750eb704e78361ac1fd0e1ee882790421

General

Target
accad0b127f72249c1dc305d580be25d_JaffaCakes118.apk
Size 23.0MB
Sample240615-ecs8dssarr
SHA256 1a86a85cf278d89cff6b23e6b1756a6750eb704e78361ac1fd0e1ee882790421
MD5 accad0b127f72249c1dc305d580be25d
SHA1 4131e8c11d13492169869ce39f37b5c27eacfc6b
SHA512 ff76e8c6b28f454623f427f43d1605f899d9864c9e7f57995468aeab3f6c8074257c218246e9b5f7688479b4cf79396533fea7efb020fd0ca18af010355387ec
SSDEEP 393216:G1Hkk7cYHxORsYFy9B3Iyt1U0giR/3LMJLcNZzK7cATr4dN+vzuERbxxr70:sET6xOrA9B4QFQeJ8x6+6Oxl0
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery evasion impact persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/data/com.dashan.dashanWater/mix.dex	4266	com.dashan.dashanWater
/data/data/com.dashan.dashanWater/mix.dex	4333	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.dashan.dashanWater/mix.dex --output-vdex-fd=57 --oat-fd=58 --oat-location=/data/data/com.dashan.dashanWater/oat/x86/mix.odex --compiler-filter=quicken --class-loader-context=&
/data/data/com.dashan.dashanWater/mix.dex	4266	com.dashan.dashanWater

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.dashan.dashanWater

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.dashan.dashanWater

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.dashan.dashanWater

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.dashan.dashanWater

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.dashan.dashanWater

com.dashan.dashanWater
1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4266
- sh -c getprop ro.yunos.version
  2⤵
  PID:4306
- getprop ro.yunos.version
  2⤵
  PID:4306
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.dashan.dashanWater/mix.dex --output-vdex-fd=57 --oat-fd=58 --oat-location=/data/data/com.dashan.dashanWater/oat/x86/mix.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4333

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Credential Access

Discovery

Process Discovery

1

T1424

System Network Connections Discovery

2

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

tomb_1718423311439.txt

Path /data/data/com.dashan.dashanWater/app_bugly/tomb_1718423311439.txt
Size 135B
SHA256 d35638d56f49b5fef0947bb9ed0084f1031fc6d6ba5b89d743c91c614c9175b2
MD5 24a1cd267740bbf07fb5cb121b240faf
SHA1 2d6bd78a8594ac6b74a0e1d8839f8f9a50cbda37
SHA512 e8d43f7c3cfab1c4f65d88284375d200221f1ec4db19c4634e2c41004cd0dee459b024c94df7fdac565273583ee71b8d577c248048d5ccf63f5375a034a328bb
MD5 SHA1 SHA512

Submit Download

bugly_db_legu

Path /data/data/com.dashan.dashanWater/databases/bugly_db_legu
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

bugly_db_legu-journal

Path /data/data/com.dashan.dashanWater/databases/bugly_db_legu-journal
Size 512B
SHA256 2819b41a843e46d628a338e7eb60c221d75185fae9da3c818ac6e10a19569b85
MD5 84fa6576290581053110ee4030605fc3
SHA1 82f8958d70708d7946df735b4e564e4620eda0f4
SHA512 4e357f648778cbbf7035605c6cc9e237b4ca295a6d7fa2da47dbdf4ea28095bdf0c777db3071a5590ff80d32b7ec5a7c4044047525e4875f43da6ba7d376a400
MD5 SHA1 SHA512

Submit Download

bugly_db_legu-shm

Path /data/data/com.dashan.dashanWater/databases/bugly_db_legu-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-wal

Path /data/data/com.dashan.dashanWater/databases/bugly_db_legu-wal
Size 92KB
SHA256 dc59351520b40184083552a7ade6b4a707459aefbee9f879fcd4c14aade3ae0c
MD5 7941a0565885e1a08d4e4b70b731e90a
SHA1 5a4e36e453194506b243a0eed93031f70286c64a
SHA512 a240ea8a0feb89a44fc5f264bf78c5abc179f82afef4f2c329b37ad1e6d9f58908575227ba66f8c5ab35a57339d956a6be3b8963df64f53dc6045fc5fe669520
SSDEEP 48:YEzNSP/ZJpfrQiw6uMg6/YBg72meposSP/sRJCoHk/vyDutHorK5pqWT6:H0PBj4m7PkRM4EOu1sK5pqWT6
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcuid.so

Path /data/data/com.dashan.dashanWater/files/libcuid.so
Size 129B
SHA256 c856fd8d6b46bca544f6fae853f602e05d33a11e50dca015d996f326fdfaa17a
MD5 799cb2484e553617ef03ce25ae68d5b2
SHA1 9093a53372f3bc581a3c2009b45b37ae977bd32d
SHA512 eb5d8e5dbed1b9e4fca04be404e92627ee72ce5a0ed06438cd72bbf2ddff5b6fa244eb8d41d76f15682af784d29c7218d6f7e953c36f0d78546e4909d78bb376
MD5 SHA1 SHA512

Submit Download

mix.dex

Path /data/data/com.dashan.dashanWater/mix.dex
Size 292B
SHA256 4c76a3af64cdd2f8713ffe2733dea50dbe714d0ca41c17d1847ee5b62a7ca615
MD5 63f77f99bd2c2b772a479923bde11974
SHA1 c7632e7d301e4463fafce85f84e9c3d7da3fdbbe
SHA512 3aae4a89d1ed51fdd911cb367eb10afe3c2264e4222085891b18a60d5412f85d10bf5c8f3c6642db70abb9aa42732bac5c42c42ee32d587100f53c21b5beb16c
MD5 SHA1 SHA512

Submit Download

.cuid

Path /storage/emulated/0/backups/.SystemConfig/.cuid
Size 89B
SHA256 ffa59ac3b4b3be94ac839902f5052971e853411467a9a6e506fe6014ccf0d19d
MD5 91a66f5932f9a7019307579dbdf77cd9
SHA1 1c07bb189186b1bacb0622b3e67e7dcce4774c41
SHA512 f00f3b2c9a7b3c036c47f54b08a69861283e23fc611e1fbf4c7fe148eff1b38e936b4b2d7667e8137d068792e885e9fe1de480d75642331c54d70448f589f36d
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads