Malware Analysis Report

2024-07-28 11:34

Sample ID 240616-jj9aeavfja
Target b267bca20bc365a9e7529eb217bd0e9c_JaffaCakes118
SHA256 e10099c6468ad5c05ff606e2a03780ba424696380bbb4c6dacd005fe46f11b99
Tags
ginp mp-4 banker collection credential_access discovery evasion infostealer persistence stealth trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e10099c6468ad5c05ff606e2a03780ba424696380bbb4c6dacd005fe46f11b99

Threat Level: Known bad

The file b267bca20bc365a9e7529eb217bd0e9c_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

ginp mp-4 banker collection credential_access discovery evasion infostealer persistence stealth trojan

Ginp

Removes its main activity from the application launcher

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Loads dropped Dex/Jar

Makes use of the framework's Accessibility service

Acquires the wake lock

Requests dangerous framework permissions

Queries information about active data network

Declares services with permission to bind to the system

Makes use of the framework's foreground persistence service

Requests accessing notifications (often used to intercept notifications before users become aware).

Requests disabling of battery optimizations (often used to enable hiding in the background).

Requests enabling of the accessibility settings.

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-16 07:43

Signatures

Declares services with permission to bind to the system

Description Indicator Process Target
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-16 07:43

Reported

2024-06-16 07:46

Platform

android-x86-arm-20240611.1-en

Max time kernel

179s

Max time network

154s

Command Line

jffgxrlkjcrsqz.igtddgdtxbtarzhxar.nglslmkxojhkmfclysafamyleu

Signatures

Ginp

banker trojan infostealer ginp

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/jffgxrlkjcrsqz.igtddgdtxbtarzhxar.nglslmkxojhkmfclysafamyleu/app_DynamicOptDex/hf.json N/A N/A
N/A /data/user/0/jffgxrlkjcrsqz.igtddgdtxbtarzhxar.nglslmkxojhkmfclysafamyleu/app_DynamicOptDex/hf.json N/A N/A

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Requests accessing notifications (often used to intercept notifications before users become aware).

collection credential_access
Description Indicator Process Target
Intent action android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS N/A N/A

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Requests enabling of the accessibility settings.

Description Indicator Process Target
Intent action android.settings.ACCESSIBILITY_SETTINGS N/A N/A

Processes

jffgxrlkjcrsqz.igtddgdtxbtarzhxar.nglslmkxojhkmfclysafamyleu

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 wingaffordnasty.com udp
GB 142.250.187.206:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.238:443 android.apis.google.com tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
US 1.1.1.1:53 change923.ru udp
GB 142.250.187.234:443 semanticlocation-pa.googleapis.com tcp
GB 142.250.187.234:443 semanticlocation-pa.googleapis.com tcp
GB 172.217.16.234:443 semanticlocation-pa.googleapis.com tcp

Files

/data/data/jffgxrlkjcrsqz.igtddgdtxbtarzhxar.nglslmkxojhkmfclysafamyleu/app_DynamicOptDex/hf.json

MD5 a9885271de91b6664fcb40e3e268139e
SHA1 a9c4fa498a09e17af468b8391af40f5167f95aa3
SHA256 64e625bb0f9c7d18680d8444b48087f3c0a316c35c6fdccb0a264e0850783f60
SHA512 c9be0b53ccb0ce2b80fab0783284fb0dac34fb037db819f5f71e248f04427a3847eadfda890d43f76cfe902619958f3dbde1c5d85846f12a3f792bb37b8dedde

/data/data/jffgxrlkjcrsqz.igtddgdtxbtarzhxar.nglslmkxojhkmfclysafamyleu/app_DynamicOptDex/hf.json

MD5 54de7eab470a4eabc743f3c0bb35ac26
SHA1 94b20038a9a917f7c95674aa18ef8315203c0e6c
SHA256 0741f08f9ea71be64feb1eb6388922a822e60bbeaf2901810d90d89e02a44388
SHA512 35021a8b3aa58a2e7861fbe8ba67ad942d5f5a2019edceef05a88e745e5e735025a7be983f8589892be9037bb65eb8d400bcaac253a8ed5cdfda3e5b86497d0f

/data/data/jffgxrlkjcrsqz.igtddgdtxbtarzhxar.nglslmkxojhkmfclysafamyleu/app_DynamicOptDex/oat/hf.json.cur.prof

MD5 669aa490d6c8db22ca8201621ef19579
SHA1 eabfdfccc974fff4d2cb24db4a2ea173e2a8ed75
SHA256 7bd86931f58e79e160002e2aeb8b47c880690e5a1eeb407c62a5efff4b148667
SHA512 ad66697c6eda7b89f486645db04b55aa0895f223cb934c79a9aab4fe2587e64ab9c0eded15b6d80c319e88fe225ceed1bcb235bf52b7712e85f568fd4356ae2a

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-16 07:43

Reported

2024-06-16 07:46

Platform

android-x64-20240611.1-en

Max time kernel

179s

Max time network

132s

Command Line

jffgxrlkjcrsqz.igtddgdtxbtarzhxar.nglslmkxojhkmfclysafamyleu

Signatures

Ginp

banker trojan infostealer ginp

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/jffgxrlkjcrsqz.igtddgdtxbtarzhxar.nglslmkxojhkmfclysafamyleu/app_DynamicOptDex/hf.json N/A N/A
N/A /data/user/0/jffgxrlkjcrsqz.igtddgdtxbtarzhxar.nglslmkxojhkmfclysafamyleu/app_DynamicOptDex/hf.json N/A N/A

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Processes

jffgxrlkjcrsqz.igtddgdtxbtarzhxar.nglslmkxojhkmfclysafamyleu

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 172.217.169.10:443 tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.178.8:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 wingaffordnasty.com udp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.206:443 android.apis.google.com tcp
US 1.1.1.1:53 change923.ru udp
GB 172.217.169.78:443 tcp
GB 142.250.179.226:443 tcp
GB 142.250.187.196:443 tcp
GB 142.250.187.196:443 tcp
GB 172.217.169.14:443 tcp

Files

/data/data/jffgxrlkjcrsqz.igtddgdtxbtarzhxar.nglslmkxojhkmfclysafamyleu/app_DynamicOptDex/hf.json

MD5 a9885271de91b6664fcb40e3e268139e
SHA1 a9c4fa498a09e17af468b8391af40f5167f95aa3
SHA256 64e625bb0f9c7d18680d8444b48087f3c0a316c35c6fdccb0a264e0850783f60
SHA512 c9be0b53ccb0ce2b80fab0783284fb0dac34fb037db819f5f71e248f04427a3847eadfda890d43f76cfe902619958f3dbde1c5d85846f12a3f792bb37b8dedde

/data/data/jffgxrlkjcrsqz.igtddgdtxbtarzhxar.nglslmkxojhkmfclysafamyleu/app_DynamicOptDex/hf.json

MD5 54de7eab470a4eabc743f3c0bb35ac26
SHA1 94b20038a9a917f7c95674aa18ef8315203c0e6c
SHA256 0741f08f9ea71be64feb1eb6388922a822e60bbeaf2901810d90d89e02a44388
SHA512 35021a8b3aa58a2e7861fbe8ba67ad942d5f5a2019edceef05a88e745e5e735025a7be983f8589892be9037bb65eb8d400bcaac253a8ed5cdfda3e5b86497d0f

/data/data/jffgxrlkjcrsqz.igtddgdtxbtarzhxar.nglslmkxojhkmfclysafamyleu/app_DynamicOptDex/oat/hf.json.cur.prof

MD5 39fc06f9ac06a570afd7eb9d9b635a4c
SHA1 9c4fb29cd0cdaed3e7475695d61a3bb24332a501
SHA256 9ca21ef097db46dcbfe604eb5cae26ffde839df0f05e05fc2e8b367c12db24e4
SHA512 76d813a9ff84836d2ad7a7e48233ce89cd63540b02e1f2b0a6a1c4abf69f24119d3e1a89dd82904f23a69a802a711433ae289a641f9686093cc82f4c1a0010ad

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-16 07:43

Reported

2024-06-16 07:46

Platform

android-x64-arm64-20240611.1-en

Max time kernel

179s

Max time network

134s

Command Line

jffgxrlkjcrsqz.igtddgdtxbtarzhxar.nglslmkxojhkmfclysafamyleu

Signatures

Ginp

banker trojan infostealer ginp

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/jffgxrlkjcrsqz.igtddgdtxbtarzhxar.nglslmkxojhkmfclysafamyleu/app_DynamicOptDex/hf.json N/A N/A
N/A /data/user/0/jffgxrlkjcrsqz.igtddgdtxbtarzhxar.nglslmkxojhkmfclysafamyleu/app_DynamicOptDex/hf.json N/A N/A

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Queries information about active data network

discovery
Description Indicator Process Target
Framework service call android.net.IConnectivityManager.getActiveNetworkInfo N/A N/A

Requests accessing notifications (often used to intercept notifications before users become aware).

collection credential_access
Description Indicator Process Target
Intent action android.settings.ACTION_NOTIFICATION_LISTENER_SETTINGS N/A N/A

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Requests enabling of the accessibility settings.

Description Indicator Process Target
Intent action android.settings.ACCESSIBILITY_SETTINGS N/A N/A

Processes

jffgxrlkjcrsqz.igtddgdtxbtarzhxar.nglslmkxojhkmfclysafamyleu

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.200.10:443 tcp
GB 142.250.200.10:443 tcp
US 1.1.1.1:53 wingaffordnasty.com udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.187.200:443 ssl.google-analytics.com tcp
GB 142.250.187.238:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.187.238:443 android.apis.google.com tcp
US 1.1.1.1:53 change923.ru udp
GB 142.250.179.228:443 tcp
GB 142.250.179.228:443 tcp

Files

/data/user/0/jffgxrlkjcrsqz.igtddgdtxbtarzhxar.nglslmkxojhkmfclysafamyleu/app_DynamicOptDex/hf.json

MD5 a9885271de91b6664fcb40e3e268139e
SHA1 a9c4fa498a09e17af468b8391af40f5167f95aa3
SHA256 64e625bb0f9c7d18680d8444b48087f3c0a316c35c6fdccb0a264e0850783f60
SHA512 c9be0b53ccb0ce2b80fab0783284fb0dac34fb037db819f5f71e248f04427a3847eadfda890d43f76cfe902619958f3dbde1c5d85846f12a3f792bb37b8dedde

/data/user/0/jffgxrlkjcrsqz.igtddgdtxbtarzhxar.nglslmkxojhkmfclysafamyleu/app_DynamicOptDex/hf.json

MD5 54de7eab470a4eabc743f3c0bb35ac26
SHA1 94b20038a9a917f7c95674aa18ef8315203c0e6c
SHA256 0741f08f9ea71be64feb1eb6388922a822e60bbeaf2901810d90d89e02a44388
SHA512 35021a8b3aa58a2e7861fbe8ba67ad942d5f5a2019edceef05a88e745e5e735025a7be983f8589892be9037bb65eb8d400bcaac253a8ed5cdfda3e5b86497d0f

/data/user/0/jffgxrlkjcrsqz.igtddgdtxbtarzhxar.nglslmkxojhkmfclysafamyleu/app_DynamicOptDex/oat/hf.json.cur.prof

MD5 d241c7aa2d42a0d3ef88e330bf2deac2
SHA1 397b3f5cbb3140dd1d71ceb14d0c193c6f723ec8
SHA256 24072bcb483c2a020cdfb33aeb76a43f5bd5c57ec18fab14f8712980357e0dd7
SHA512 e79c14862fec1649343f4491cb40528071f0d20e90c096fba37f018b3045eac6bad014920d0a7f86a1036595ac8715416288cd09ead5e0c64a544ded66ceabbe