Analysis
- max time kernel
167s - max time network
161s - platform
android_x86 - resource
android-x86-arm-20240611.1-en - resource tags
androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system - submitted
16/06/2024, 22:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b597a4842cbd2245eb5793a11b721c04_JaffaCakes118.apk
Resource
android-x86-arm-20240611.1-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
bp.apk
Resource
android-x86-arm-20240611.1-en
2 signatures
150 seconds
General
- Target bp.apk
- Size 503KB
- Sample240616-2sbplssarc
- SHA256 687c013d34e4519d797549b0b34562855e44f645ac1ccca8f74de0fbdd380717
- MD5 cbdc22d39c0a5d6b573bc4c3a0723d62
- SHA1 0277b88cf6223860c62a6ea0936b57fa4d6e3e5d
- SHA512 5ba5d67f170a94afbe9a8544c3a92190ec90fdeeac0313ea735e72022d2669c9f8e7691039e08e0b23f174ed5a0eeef11d7a426725fa25810d67a8342df45abe
- SSDEEP 12288:f2HrgTAxStoLvnA89xX2GV45+a5hL/s8BocGJVp7:f2HrgUxSGv2u+7hocUz7
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Loads dropped Dex/Jar 1 TTPs 6 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/data/com.bmob.app.sport/zwr_bef/m.dex 4259 com.bmob.app.sport /data/data/com.bmob.app.sport/zwr_bef/m.dex 4294 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.bmob.app.sport/zwr_bef/m.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/data/com.bmob.app.sport/zwr_bef/oat/x86/m.odex --compiler-filter=quicken --class-loader-context=& /data/data/com.bmob.app.sport/zwr_bef/m.dex 4259 com.bmob.app.sport /data/user/0/com.bmob.app.sport/app_zwr_dd/m.dex 4259 com.bmob.app.sport /data/user/0/com.bmob.app.sport/app_zwr_dd/m.dex 4355 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.bmob.app.sport/app_zwr_dd/m.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.bmob.app.sport/app_zwr_dd/oat/x86/m.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.bmob.app.sport/app_zwr_dd/m.dex 4259 com.bmob.app.sport - Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.bmob.app.sport
Processes
-
com.bmob.app.sport1⤵
- Loads dropped Dex/Jar
- Uses Crypto APIs (Might try to encrypt user data)
PID:4259 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.bmob.app.sport/zwr_bef/m.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/data/com.bmob.app.sport/zwr_bef/oat/x86/m.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4294
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.bmob.app.sport/app_zwr_dd/m.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.bmob.app.sport/app_zwr_dd/oat/x86/m.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4355
-
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.bmob.app.sport/app_zwr_dd/m.dex
- Size 892KB
- SHA256 3a7e0f4b537ff39d975e6916adeed77238ca54b4c596190b61bd2e28a9a17b26
- MD5 659b7feaac2c468d0d6d4148c2f844c5
- SHA1 38d01ebe4b9cc4764837223bec060f9c40c43ad6
- SHA512 12d5c5af1c6d3437f987e2daf85a20fd4a94a0a303b45821ff146b0d8f99ae22337a411f9f3ddd227750ca87fa6faf69322c6734174323c1c3311c3e382d4d82
- SSDEEP 12288:kn+L23H7XPfudR5yXbKbybNi2yr4vssNVT:kJ3H7/aEGbgiVisKVT
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.bmob.app.sport/app_zwr_ed2/m1718578227161.zde
- Size 267KB
- SHA256 476b8f79a578cdbfe8e5237bd0f00e437edd32adc57569f0eea628f8daa4d631
- MD5 b47f9e5b628685b26492a85e28f433a1
- SHA1 2bc51c02403ad5cba9e0809e7fe81e8c799055a5
- SHA512 5e8acb9f56b65d0dcd8aa6c2ae2e67bc729bc727cc6ee3313d189a3ae499aa54eb3eb5e1d9da1138efb4a3806433b112fc559da3f0863ac498f2c6d2144eff24
- SSDEEP 6144:dXjQu1gH7dVmjTTAx0AcwytStCEdp4CLc80r6hW:d2HrgTAxStoLvnA89W
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.bmob.app.sport/zwr_bef/m.dex
- Size 14KB
- SHA256 5da3b561b0134668961e669c4521c6d5b3b256b3bdb2673c7eea606c9357acec
- MD5 f80bfd984f7a387e47d42f4747f79f6d
- SHA1 645c00494a53faa8ec03de0027e1771777ec3285
- SHA512 fee34865a48af7a744ef391ac8c7eb4c19a7e657d467057f5422e9eb5f21f741b9529b6a7702502314104243bbffc17a890d9601f66b35add4ceff651eac6e4b
- SSDEEP 192:zViKLQa1+Ky/vXk43jANZgWsN2XHvZ4nU16Nd91wEyhv75jwL0u1OZokcQSBcm/7:zk3aYnXkoyXvB6Ndnv87o71OT0pv
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.bmob.app.sport/zwr_bef/m.dex
- Size 14KB
- SHA256 413800090523aa200505b12bfdd0fe1db8c88c8fbeff1b2c4d7819fda3b4bc6c
- MD5 9255322f253fd7f58813f5f844e16deb
- SHA1 5e9e747a3e6e76f3239c96cb5060e20c89906c6e
- SHA512 e85b50b44984af19a59ec9d4a0fcb79b807a5b084aad7ce8fce4068de45e02df8f5dd60c9cc9614ccd59835af1b67db6fee5a33c387a0f26ccf7f42c92c20bad
- SSDEEP 192:zViKLQa1+Ky/vXkBX63lwYoMvsm+7ovlUL1vyhv75jwL0u1OZokcQSBcm/zAsdwG:zk3aYnXkCeRG5qv87o71OT0pv
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/com.bmob.app.sport/app_zwr_dd/m.dex
- Size 892KB
- SHA256 8c5051bb6492ec0dfae4630c82427fb311d373303b858b2699b3037045ea3b61
- MD5 b8cd9331a967b1555cf310413a4fadd5
- SHA1 9f69f54cf171b1d3dff80afc5305c8d27fa6db9f
- SHA512 49d6cb25dcce82ceacdc357aa4d1ae82ac645c7c781210628ec9666913f4672e526e52118ddbe69d5ec32b785b36a837c2ffe29098bfdeb10722dbf7f1edb8eb
- SSDEEP 6144:kn+LJoZY/mxH0z2hFYBgPSEPmPX8414blLq0FR49Qqx6M63FGLy0lq4gE1/sPUNF:kn+L23H7R+P9IR49SM63F2yr4vssNVT
- MD5 SHA1 SHA512 SSDEEP