19e20c9809cc61b1d4231cb0c3156b1a12b7ec14f9825e9fa2f8fd1eac359c08

Analysis

max time kernel
179s
max time network
130s
platform
android_x86
resource
android-x86-arm-20240611.1-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
submitted
16-06-2024 10:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b30c2dc0a49ee95cc1440c2dde85dbe9_JaffaCakes118.apk
Size

2.8MB
MD5

b30c2dc0a49ee95cc1440c2dde85dbe9
SHA1

caf3fe5f599070af1100e98c101ebc67535fec10
SHA256

19e20c9809cc61b1d4231cb0c3156b1a12b7ec14f9825e9fa2f8fd1eac359c08
SHA512

0131587e0808934f97f4ff5f6b4a91ceb29cff12a5d834e6fbed47ccb5f54aaa352772f96bbf040023d395d3d87671abf221e0c79c2d054ff3396de1778a8760
SSDEEP

49152:X3GSCUq7pRJANwwnp/k36IyKYM6qcC6DXMBJBRtpImYuBDgw:XTCPPKBp/C6ktt6DXCJBRtpILogw

Score

8^/10

banker discovery evasion impact persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

T1628.001

Processes:

com.cn.zzmain

pid process

4300 com.cn.zzmain
Checks Android system properties for emulator presence. 1 TTPs 1 IoCs
evasion

T1633.001

Processes:

com.cn.zzmain

description ioc process

Accessed system property key: ro.product.model com.cn.zzmain

pid	process
4300	com.cn.zzmain

description	ioc	process
Accessed system property	key: ro.product.model	com.cn.zzmain

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

T1407

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.cn.zzmain/app_ttmp/t.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.cn.zzmain/app_ttmp/oat/x86/t.odex --compiler-filter=quicken --class-loader-context=&com.cn.zzmain

ioc	pid	process
/data/user/0/com.cn.zzmain/app_ttmp/t.jar	4336	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.cn.zzmain/app_ttmp/t.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.cn.zzmain/app_ttmp/oat/x86/t.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.cn.zzmain/app_ttmp/t.jar	4300	com.cn.zzmain

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

T1418.001
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

T1424

Processes:

com.cn.zzmain

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.cn.zzmain
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

T1422

Processes:

com.cn.zzmain

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.cn.zzmain
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

T1624.001

Processes:

com.cn.zzmain

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.cn.zzmain
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

T1471

Processes:

com.cn.zzmain

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.cn.zzmain
Checks memory information 2 TTPs 1 IoCs

T1633.001

T1426

Processes:

com.cn.zzmain

description ioc process

File opened for read /proc/meminfo com.cn.zzmain

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.cn.zzmain

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.cn.zzmain

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.cn.zzmain

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.cn.zzmain

description	ioc	process
File opened for read	/proc/meminfo	com.cn.zzmain

com.cn.zzmain
1⤵
- Removes its main activity from the application launcher
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:4300

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.cn.zzmain/app_ttmp/t.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.cn.zzmain/app_ttmp/oat/x86/t.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:4336

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.cn.zzmain/app_ttmp/oat/t.jar.cur.prof
Filesize
357B

MD5
4e058e27061dd17c14f95b43466500d9

SHA1
943f297f3d9ba7b3d788412d2035451d3c48dc4a

SHA256
26cf4c03e90ea17d53c81611d0cd15089cd2c8987ed97a50b0cbc03ea4a1e5a2

SHA512
9feb6ac0bd9eaae63690cb61e2619b54634e2969df7bc520f95664ab68fac7a0b1cfa57c38857be8bd3a493b885165e0c947bf0908f1c49753f92f2a79eac5d4

Download Submit
/data/data/com.cn.zzmain/app_ttmp/t.jar
Filesize
172KB

MD5
39f7c5d4a7962708aa7d98bf2fadfc27

SHA1
cb348f750596b2e54705eb7d20b9fb2cc9d8807f

SHA256
e303dc3a3e31e4d525840e20486b6a99821e330b75c11e61c0f78d56f5dd9558

SHA512
55267b2721b056f9dab24c9f29df40db648cc3bd2eef0f4464da5545e6540f3f18cd8cdd9b7e7c77fe7a4fe37a08eb1bde482edbdd7eb364dd840f7f83740caa

Download Submit
/data/data/com.cn.zzmain/app_ttmp/t.jar
Filesize
172KB

MD5
cf9c7fb39d30b43019bfac428a3269ab

SHA1
912d7b2f83d9d0eae24d5b4cf1a5033cd2b8a283

SHA256
9031644073855d5bc7ad4ac8f211b472c7b52b8a5b743e85b40d1864f95a09af

SHA512
2450ac53f0f2ecec5d32ce0fb90ce4ed051d25319965d6758d90e0ede8cc813d445911e7511f140510d3ed19390a1effb9c1758861a95cecde8760abe127590f

Download Submit
/data/data/com.cn.zzmain/databases/com.cn.zzmainb
Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.cn.zzmain/databases/com.cn.zzmainb-journal
Filesize
512B

MD5
2eda622f9acdd7768467a72486e3e519

SHA1
0fea86e762f526dd6a969ffab89b58350b1c1397

SHA256
baea362f0032acc49d82243bb7e011588db3a33cb2948288fb62bea26ef18c9a

SHA512
e7e84a6ace36e9a995867b07529273d78469439e041daad6477d93c03cc774c9d98ebc6e2a1ed15696dce40a7435bb0e08bfb8369fefe52dcf85b06d2937c7cf

Download Submit
/data/data/com.cn.zzmain/databases/com.cn.zzmainb-shm
Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.cn.zzmain/databases/com.cn.zzmainb-wal
Filesize
84KB

MD5
0d9e13ff1abd6ac50d8bf380b9e8b100

SHA1
19d21f101d7d2cf55e3e257ece42659eca163c9e

SHA256
3ef0ff2b14103b70fa92dbacaf473a23727ad18c86b418095e3e8881835354f6

SHA512
d002910119faaa538c6d9c621f85a597c5f9bafa6f8abf722b7955962ad8bcef6107537cb25e31b39eb6d1bea02d30e8e2da9bdda598b5a7426058b13712f796

Download Submit
/data/user/0/com.cn.zzmain/app_ttmp/t.jar
Filesize
363KB

MD5
4d50d49666dd4a7aab4ba4c4152abbd4

SHA1
b0ed22f4b8b27c2c20bf081eaf7f95a9dfd9cdfa

SHA256
67ee73418973fbe2d071df13f4e340c8951157a1594914b987605df034063963

SHA512
7979989b4a22c23d175052478c75c9884f51f85fde38dc440c42a76202e81bf51622fa9fd44a58748c0b562111cb54fd8e4fc0aac702b506a58ced2db2e680ff

Download Submit
/data/user/0/com.cn.zzmain/app_ttmp/t.jar
Filesize
363KB

MD5
71f79ba9526f0b6a04ff423212d75238

SHA1
ff505b3673f566a812ae925acc84157a1b6f34d7

SHA256
ab9672e93263e2459e8381f5216b8d8ce928c7bff5fd74cca8ae6f32977e557f

SHA512
b8df08dabb951a4881c0bb7cba6b80b76eeef9776fff51730daa8672f0afb6fa514b9c8bb8981b93db698698a83b77391e16aa612b55cf1150d6c18881aa2253

Download Submit