Overview

overview

8

Static

static

6

b4500d97be...18.apk

android-9-x86

8

b4500d97be...18.apk

android-10-x64

8

b4500d97be...18.apk

android-11-x64

8

Analysis

  • max time kernel
    138s
  • max time network
    141s
  • platform
    android_x86
  • resource
    android-x86-arm-20240611.1-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
  • submitted
    16-06-2024 15:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b4500d97beb41fe730f118546977a77e_JaffaCakes118.apk

  • Size

    263KB

  • MD5

    b4500d97beb41fe730f118546977a77e

  • SHA1

    2c506133161eeb55cf37920ea285e1a7d5cf269c

  • SHA256

    91580dec4d188d56132b7e26202df4451e7b57abd0f7da8478fa983871495c25

  • SHA512

    2adc20d8b31b1869bd710d272100bc963209dff8763e0889978f778404b42ed66fa9db160564f450316aafcad99fc44a3f16973f2d0ee66e1bd54d192ea7ae64

  • SSDEEP

    6144:WEPNvivXSCeVvnD2IJOsBFaw4IzEsS/ZXBc2Y4MT5fNw:3i6tQIwsBFa/IvcR9Uw

Score
8/10
bankercollectiondiscoveryevasionexecutionimpactpersistencestealthtrojan

Malware Config

Signatures

  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries account information for other applications stored on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect account information stored on the device.

    collection
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Schedules tasks to execute at a specified time 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.bangkok.bqupmorm.fhjqstiv
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Queries account information for other applications stored on the device
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks memory information
    PID:4313
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.bangkok.bqupmorm.fhjqstiv/app_tfile/fields.jar --output-vdex-fd=48 --oat-fd=50 --oat-location=/data/user/0/com.bangkok.bqupmorm.fhjqstiv/app_tfile/oat/x86/fields.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4345
  • com.bangkok.bqupmorm.fhjqstiv:RemoteProcess
    1⤵
      PID:4359
    • com.bangkok.bqupmorm.fhjqstiv:guard
      1⤵
      • Schedules tasks to execute at a specified time
      PID:4680

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • /data/data/com.bangkok.bqupmorm.fhjqstiv/app_tfile/fields.jar
      Filesize

      138KB

      MD5

      cceb8db3b057d24673d49eda229e9892

      SHA1

      b18f6353b2156410249079a3b7b86ef3a530e8ee

      SHA256

      e900cb4c3fe9d8f45196a7457e9645c65b0f3cde820f4161950252cff67a4d97

      SHA512

      4a42cde3165a706e823caa1362001ed8aa647caf22325a4f2554c64fc4ebcd79afe44fe5eab5474221806f26e7aca9d2901026de6e597ef62fe867f123e4bd57

      Download Submit
    • /data/data/com.bangkok.bqupmorm.fhjqstiv/databases/tbcom.bangkok.bqupmorm.fhjqstiv
      Filesize

      4KB

      MD5

      f2b4b0190b9f384ca885f0c8c9b14700

      SHA1

      934ff2646757b5b6e7f20f6a0aa76c7f995d9361

      SHA256

      0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

      SHA512

      ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

      Download Submit
    • /data/data/com.bangkok.bqupmorm.fhjqstiv/databases/tbcom.bangkok.bqupmorm.fhjqstiv-journal
      Filesize

      512B

      MD5

      cecfa7f69229a87b7543d5e0f65bc1e5

      SHA1

      19a1307f31787918ff6440dbb59d8517615898f5

      SHA256

      52988980fa694ee6a2ae527a09629efea72b061245f92a323a50c6354c1e8f24

      SHA512

      65721fe1c33c1ecc857a5f46a00977516401afcd65a50eb002baeb66c8a74089d2ded0ee51faee063319d03c9fa80ced5a82441c6e5a4552770855c23b4da335

      Download Submit
    • /data/data/com.bangkok.bqupmorm.fhjqstiv/databases/tbcom.bangkok.bqupmorm.fhjqstiv-shm
      Filesize

      28KB

      MD5

      cf845a781c107ec1346e849c9dd1b7e8

      SHA1

      b44ccc7f7d519352422e59ee8b0bdbac881768a7

      SHA256

      18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

      SHA512

      4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

      Download Submit
    • /data/data/com.bangkok.bqupmorm.fhjqstiv/databases/tbcom.bangkok.bqupmorm.fhjqstiv-wal
      Filesize

      48KB

      MD5

      0242bed1c231ea4607264024420672c0

      SHA1

      aa19214000db7612305bcefb0f3bc50cbd42c90e

      SHA256

      f321c404d0a71084246a5a72e527b1a4d475fe749f343df43834e575344e489b

      SHA512

      e854901211dcb017886d9739d73a7bb8d526099446a0e90bc17a34745a299e7a706ad1551f9a80a952b469e14d07c0ce96ad7bed0061fe500ea0892250246102

      Download Submit
    • /data/user/0/com.bangkok.bqupmorm.fhjqstiv/app_tfile/fields.jar
      Filesize

      281KB

      MD5

      4654f352b1b2095d54e0945af0e3948c

      SHA1

      4819b9827e70025c72a74869a85c996d92603931

      SHA256

      71c5cdeeaea45916c993908370cb7b1d60911d8e233dc9d1def0e75915e4548e

      SHA512

      a58ba607dbdb9af50beb9bec719e24c7d4e457e6bd9a6ef71460b0ee629f002788ac8a93d2d18728304c695fca3ac000138f19427c064cd66c628dab8a839ce3

      Download Submit
    • /data/user/0/com.bangkok.bqupmorm.fhjqstiv/app_tfile/fields.jar
      Filesize

      281KB

      MD5

      73b11c4c10150bbd4f29ad012dc11dde

      SHA1

      65c83ad32c29f9811c32eda75d7fcdc92ef42dda

      SHA256

      52132037e9b950a9cb48d6374ee2c6747a6bfe776e13a726395771f1b40ee9da

      SHA512

      3e53b1ee22a00e60896da86d2695195e0965c93d190c4d1c0dba2eb5c611d670ee7693a9f8756858255e2b170cb82a753719dd4d6a827af437309b7a1dcc6f01

      Download Submit
    • /storage/emulated/0/Download/sdsid
      Filesize

      4B

      MD5

      b8c37e33defde51cf91e1e03e51657da

      SHA1

      dd01903921ea24941c26a48f2cec24e0bb0e8cc7

      SHA256

      fe675fe7aaee830b6fed09b64e034f84dcbdaeb429d9cccd4ebb90e15af8dd71

      SHA512

      e3d0e2ef3cab0dab2c12f297e3bc618f6b976aced29b3a301828c6f9f1e1aabbe6dab06e1f899c9c2ae2ca86caa330115218817f4ce36d333733cb2b4c7afde7

      Download Submit