46b783b2bc889b3fbd2cacfdbe0ec6ddd95c8daaa4411b84b9da42f48004e49e

Analysis

max time kernel
155s
max time network
130s
platform
android_x86
resource
android-x86-arm-20240611.1-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
submitted
16-06-2024 03:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b18c459680cdc0e038aa8f4a921c544f_JaffaCakes118.apk
Size

3.0MB
MD5

b18c459680cdc0e038aa8f4a921c544f
SHA1

31a0fa1da72f3a7f0d29ade9b397eae8c27a7e6e
SHA256

46b783b2bc889b3fbd2cacfdbe0ec6ddd95c8daaa4411b84b9da42f48004e49e
SHA512

be735bb36015032e4bbb0aeb3204f841ab0b4a6954e1b41a14087caae5d697a57e3a2cca70e460e194b1bd2fb69099e5a101fc3d809b4dea4a19aa7a167388ca
SSDEEP

98304:b/IXp73lyCxvEyibGb9u9MIzpWR3QTAM+ez:+3ly0ErGboUR3QkM+ez

Score

8^/10

banker collection credential_access discovery evasion persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/bin/su	app.android.ninestore

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	app.android.ninestore

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	app.android.ninestore

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	app.android.ninestore

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	app.android.ninestore

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	app.android.ninestore

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	app.android.ninestore

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	app.android.ninestore

app.android.ninestore
1⤵
- Checks if the Android device is rooted.
- Makes use of the framework's Accessibility service
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks memory information
PID:4314

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/app.android.ninestore/app_SGLib/libsgmainso-6.1.33.so.tmp

Filesize
539KB

MD5
2dc5010fa1ef6c3d6050bfd150ca36e0

SHA1
7958d89b5b491d1f9c14175b5cb14329322d163b

SHA256
7905cb71cf014fe9b8d220cd134f47ac27c51bcf1e6523355b590d77c1e4f15c

SHA512
7ec2f6c3df0020ff254b3723aad655c12b649ccb98bcfaa97c2e8fb4200856815e87437c2daf89f2b657bb5798f5012a200443b36e198bbd622921a7e5f8a6f3

Download Submit
/data/data/app.android.ninestore/app_wa/wa/sv/11gpsdfe_1718508702241004314.wa

Filesize
1KB

MD5
b68a4505c1574e4ece560c2f51d87fb2

SHA1
26cd56f0a5959ff15bd016d42c0ed0e4c67f982e

SHA256
eb0a368edad62175112b32555dcd4646e6d77ee9c70fd725ac169893a67f4847

SHA512
6381c65e8141a9a28abbdd3d0160fcf4a42dec450d9fe4aa10e2faae4a1df7a05d08e7eb6a86f61ceebe64f22b1863c2c1d7b41c564542a779356f51b87bef4a

Download Submit
/data/data/app.android.ninestore/cache/httpCache/journal.tmp

Filesize
36B

MD5
37e8e716e0e2f4a0b05cd9571d95b84d

SHA1
f8d068f6931707bddb8cd69f706f2224ad1fea3c

SHA256
7080cb592d5149c858b206d3fd0d5e3e7d601f120af00b2616bee928ee1291ca

SHA512
e62b850901835fdb73fa6224618422f721dd765861d42f6bc2dd013413e96bd910ac5313afd9b4f63da74beb12a15fac81b5157456c9caa3031862dab84423f6

Download Submit
/data/data/app.android.ninestore/crashsdk/tags/unique

Filesize
36B

MD5
7a6ebe56ea9bfca54a99db8b70243cfb

SHA1
051c7243fcea7381082589a24151cf4dcf800a65

SHA256
14b72796837982b20b2c60cb0e48bdd72dedf086070eacf4df86f5db62e0dd74

SHA512
5c803ffeab2c41395ab03490e0e9c63e2059c1fc85e66a35110cdf5a3ebf92b37f0e54fc99b814d1456191fb19cad274f362dbb73f1933c1b4f2ae99a9ee3532

Download Submit
/data/data/app.android.ninestore/databases/WaSession.db-journal

Filesize
512B

MD5
51ab961c9483a2d0f2807ae42a3863b7

SHA1
2e6f164861aa16d5abe95eaf29fb60ab12ef2142

SHA256
885116633e991ae32219565da52a4dfba3b8f5400993430bbc02b37164c1d42c

SHA512
32511115a42fa8cce1dd42c5c3e2a9e6ae6241802a3bcf33cb3b967f9a85eeed3d8c5dd730e1ef6e9e164c3ddcacb213d841dcb5dddd8d68ae92a4acfb065da3

Download Submit
/data/data/app.android.ninestore/databases/WaSession.db-wal

Filesize
36KB

MD5
ec4889676aa47564b34a182f3ba167f3

SHA1
1b1fc3ff458fa53584117e7453aee59b104ce021

SHA256
03c649a9c2120c51446daee6f6bc8d737eacc7cb22f704eb9e4a13192abd2e5b

SHA512
87078a7fb65124f2cf5cd49565eaafb07c4e4a0908ffcb626459c995b3bc744851625c7fc5ca437f8382feadad2c8db84120812f24323c5b108bb29f1678d497

Download Submit
/data/data/app.android.ninestore/databases/WaValue.db-journal

Filesize
512B

MD5
880617824aa9dda210fbba3495abf5a7

SHA1
5c7b3b3359ff09a43bea232fa2e2096194b7ec52

SHA256
6e33b0a66f3fc284ebbb366b86c8a085bb473448f87717b6fba76e03535b04f0

SHA512
886e6377b0bf99948d1a52d4fbcd46ad4c01f571c451c9bea27b0c4466b7423ff3ee452c4cf78f9a2817dcbf87adeaf83d96458c6332a7f91910ad9e7f0c58c8

Download Submit
/data/data/app.android.ninestore/databases/WaValue.db-wal

Filesize
72KB

MD5
1d30db0994e148225d75cfc175bad8d3

SHA1
afdda80b6ff065a0da5f49a3c54dd84d93901352

SHA256
58007d7a6039ff914d181fe36e1ff8100dcd5bc403c17fbedbf6f53ede4bed58

SHA512
33793af9110ccb0558aaa485bfac709c97e44f3ecb96bd1702feecf78281df4b0b9b0d83b8126b630279490714340fa8d070996f50fbf86d2ce4957ed402791c

Download Submit
/data/data/app.android.ninestore/databases/downloader-journal

Filesize
512B

MD5
b94a977d1dc3bc57d5d85eff6d3b2cba

SHA1
9a00c2bd641afceb48a3a2a32d2564ff81db7ff8

SHA256
79358413736b7148c173c11c0282fdf176dea28ec3eaabbcba4bee3ee02832ae

SHA512
bb9fc005cc4ca1d8f7a43b78a72e026805753c4397721dffc9dd7a427d4132f9ff9cdbcf76225f0c8817b1254261720b4dd5460eca424a94569e235ab67c94c3

Download Submit
/data/data/app.android.ninestore/databases/downloader-wal

Filesize
36KB

MD5
44e8fad92dedd96920b37b01d6c1ded0

SHA1
0a08c2a63e39b85b058149454eaae2a2746372d8

SHA256
6fa20a569ebb31abbdbe26f0a6aa6b1c7f99772ba89308b534eed70a4fb26b08

SHA512
253b380a25581ca4d8b80e35c8bb096dde5c0295f7fc970ab8eb36ddb9b1248c7a84e8581b9274b099c38ec11c8881bb5ac378bc7d9a8ba3bda4fcb7a29bcfbf

Download Submit
/data/data/app.android.ninestore/databases/pushmessage

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/app.android.ninestore/databases/pushmessage-journal

Filesize
512B

MD5
36ad9767e0a61c8d67017ef83452b7f8

SHA1
b5f25ee6e56295681052d9674d592383c4a50da8

SHA256
9d47f5a5bef3c7ebc55d52fdbe3e2296d5a0d61ccfd943193a952fe8eaf074a7

SHA512
2dacad1fdc4fdc20101936fc0c790615629b5b882770734f094e9851a4676f1884680c2a09fd7cfc2a222a067e17e932ca128e9885cc8c05dc8c00600acee9f9

Download Submit
/data/data/app.android.ninestore/databases/pushmessage-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/app.android.ninestore/databases/pushmessage-wal

Filesize
28KB

MD5
c818aaf08dda20ac8fb99be96e44aa54

SHA1
51b93f4eb8a7d5b39107d7b7f9736d79a53e8738

SHA256
009f743f119e713d9dcdfda1000fd5025f52c355a6c90d1f02fdaf2c27466e32

SHA512
507e26bdf56e626b0e6384f92223df59cad4003f483cfd8c620c948ff3d523f614aac6e31969eda73b926a95bcfd152a7d349dace84b4ccc80f5550e3ae2437e

Download Submit
/data/data/app.android.ninestore/files/daemon

Filesize
13KB

MD5
e415dc9f7ae531ca1da4d00d5a072607

SHA1
2d08971ae91cad6fafae2e91d2701b97a5fe9415

SHA256
8fa4c27529ddd36b19323cb156d8f186974e8b85e02ea6ee6167808508198d13

SHA512
ad1e166987dd3c4894e95ec13bde4bdb4dab62fae88327f82af235a80d5e22f201fdb66b2171257b4d4dd003794ba682f7aa064de57867d5afeb8cca672b18e4

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads