8b045d96f092454b87bbc06023fe2d879bffa317cabd7c4a2f546c2c4d9f9655

General

Target
b35c111f51d038df13aefbd4841a5798_JaffaCakes118.apk
Size 12.4MB
Sample240616-n1akmasbmd
SHA256 8b045d96f092454b87bbc06023fe2d879bffa317cabd7c4a2f546c2c4d9f9655
MD5 b35c111f51d038df13aefbd4841a5798
SHA1 c0ded56110ba4d01bcca41cad52864037c13a015
SHA512 2169e19b9120161b270c84afc074723aefc6150f84cd89ce3396f61d3f1fce0af00153300e56cd98a54c3cec31dc6dbcff00b9c3fc24aa9cec4c003a32c6fc30
SSDEEP 196608:wjDULhpGvgxDzJd+ZQBXht6dJD4MhdlmxMhkyLxvUzJt0/F4+mUke0pwfpyDRviz:Pkv21kZQBK4iCIkyF8zqe3eowU8b
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection credential_access discovery evasion impact persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/hooked.fisher.masters/cache/DA39A3EE5E6B4B0D3255BFEF95601890AFD80709	5134	hooked.fisher.masters
/data/user/0/hooked.fisher.masters/cache/DA39A3EE5E6B4B0D3255BFEF95601890AFD80709!classes2.dex	5134	hooked.fisher.masters

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	hooked.fisher.masters

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	hooked.fisher.masters

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	hooked.fisher.masters

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	hooked.fisher.masters

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	hooked.fisher.masters

hooked.fisher.masters
1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks memory information
PID:5134

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Virtualization/Sandbox Evasion

1

T1633

System Checks

1

T1633.001

Credential Access

Clipboard Data

1

T1414

Discovery

System Information Discovery

1

T1426

System Network Configuration Discovery

2

T1422

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Clipboard Data

1

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

1

T1641

Transmitted Data Manipulation

1

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

DA39A3EE5E6B4B0D3255BFEF95601890AFD80709

Path /data/data/hooked.fisher.masters/cache/DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
Size 2.1MB
SHA256 6fed0689af5c7891f701d86417dc3fdfc638e79d205e3ab11997cfa4fc291083
MD5 c7a0c679a86d93c6dbaf33f1f73545f6
SHA1 32f6fec3800956b6eb42bd21416872ce7dd7a6c3
SHA512 d036fcb42b92be783d86ebc4d4d369dcda86076be756a7c063272bf86fe9b34678d2995358a20df56b18189f7e07e36665ebe97d3c4800f0a9e98c144e52fb6a
SSDEEP 49152:YX4soZ71ZAL8FLy28Lx4NgmzIZeIIlx45:K4s27TU8FLyhO9IZbR5
MD5 SHA1 SHA512 SSDEEP

Submit Download

UnityAdsStorage-public-data.json

Path /data/data/hooked.fisher.masters/files/UnityAdsStorage-public-data.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

DA39A3EE5E6B4B0D3255BFEF95601890AFD80709

Path /data/user/0/hooked.fisher.masters/cache/DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
Size 408KB
SHA256 011820a15c682410fb5e8aaa8a680a817ab89ae216b79574e656c7407c531672
MD5 c9cd5b0a674d358a27316dbe54ea3e2d
SHA1 ea212bd265204d0d770a4fe67d0a34662a949bf9
SHA512 7838941de9a0fca12ac5a2c2089e6f31ef85aa7f61ac9b8f155537d29eaeed9d83de1622cf64a3bc9e6ad70c161579c2b4d533fcc57364e787fb50ac2a6ee200
SSDEEP 6144:607qUjEO8aU9xPbYFvLXYYQSrdzaoQF7eH/QfA/szXvr/7OiOlfpKHmsDm5AFO:EUEO8aU0lePC/yfOBhKGsy5Ao
MD5 SHA1 SHA512 SSDEEP

Download

DA39A3EE5E6B4B0D3255BFEF95601890AFD80709!classes2.dex

Path /data/user/0/hooked.fisher.masters/cache/DA39A3EE5E6B4B0D3255BFEF95601890AFD80709!classes2.dex
Size 4.5MB
SHA256 6943424553cd812f44f2ccb51801c9afc95bd3c13de99ef2ee4dda0483847922
MD5 1329090387ecea3bc021e9f7d2fc7fc7
SHA1 a7d48dd3c70d67f651c190803db69b7833b45acd
SHA512 502a6102be7466bcfd9f8db3470c33a0acc4ccdb18c5fed2f205c0a4ae133d684fc296d2d3dd526831e6a9d3ae821faedef5fa2cb1f38ca1986b0e6427687caa
SSDEEP 49152:yMrbo1ZDK62nyq/swLcqf3FWhc5m+pM80vOmEgVuxDEg8uhx2/:yMrQK62VBf4hc0cMAEg8uhx2/
MD5 SHA1 SHA512 SSDEEP

Download

UnityAdsTest.txt

Path /storage/emulated/0/Android/data/hooked.fisher.masters/cache/UnityAdsCache/UnityAdsTest.txt
Size 4B
SHA256 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
MD5 098f6bcd4621d373cade4e832627b4f6
SHA1 a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
SHA512 ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff
MD5 SHA1 SHA512

Submit Download

UnityAdsWebApp.html

Path /storage/emulated/0/Android/data/hooked.fisher.masters/cache/UnityAdsCache/UnityAdsWebApp.html
Size 1.9MB
SHA256 9ea0a288b22c0362017915a3d22f564bdf00f64b062df7d370a962fc9b81f984
MD5 f8c288de0a0535a78b44bf2885201d3d
SHA1 54d4eca8834f5ffc79cf0809f043ef31fa75da4e
SHA512 a80b89f12aa2dcd4cc62253f91aa4d7790c06d2249ff9ff166cba7e1c3590d3c3239c21f40f54a53a4d707bb4dec0f6e26d183a9f5b777ec306d63fc8f8508f7
SSDEEP 12288:60AK7yRqaPvhpdkkLdhuKNoRQeUd4qaToBCFK:ORqaR/kqdoKwQeUdPa0d
MD5 SHA1 SHA512 SSDEEP

Submit Download

google.id

Path /storage/emulated/0/Google/google.id
Size 36B
SHA256 0a99f70b932aaf0978f149e5e038ec1b2450ed9e756a0bf71339fd5408d61502
MD5 685442d7d421840bdce2075c4b76ee41
SHA1 59c9ea944fa2c0944b1283420f8917fcc9ed5ef8
SHA512 a6a71ac08130371dfed7d10cf462129e158f3d0f344e50e43473c339b4fc155a90314d2ae9ca1b0f69854593bee0758297c36204855778d7ac580c26bd8bed98
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads