9257345f42daab05d6d80988f1cc76a76f15364eabe083347cebc98d97decad0

Analysis

max time kernel
179s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240611.1-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
submitted
16/06/2024, 18:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b48b5ce7ba4c2a0ccf0d83888d88874f_JaffaCakes118.apk
Size

615KB
MD5

b48b5ce7ba4c2a0ccf0d83888d88874f
SHA1

33c6cd294d5ef4288f0454de874d44295ab7d4df
SHA256

9257345f42daab05d6d80988f1cc76a76f15364eabe083347cebc98d97decad0
SHA512

57c5d253500565affb74fecad9a413a77798b6f048442997ef088288bb545c30fb2f8ee4ba8c6181b60babf29811bec0d8af5df6a90729d57f3c2776a0d2a1b7
SSDEEP

12288:+w0zqPeE4Yl+yavGkGxQqQKvhfGCEBDFTIKn1MQWnA+RhffmdarN:UlDktauk4QqQKviFTJ+REE

Score

8^/10

banker discovery evasion impact persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4267	com.example.testdex

Checks Android system properties for emulator presence. 1 TTPs 1 IoCs

evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.product.model	com.example.testdex

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.example.testdex/app_ttmp/t.jar	4298	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.example.testdex/app_ttmp/t.jar --output-vdex-fd=49 --oat-fd=50 --oat-location=/data/user/0/com.example.testdex/app_ttmp/oat/x86/t.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.example.testdex/app_ttmp/t.jar	4267	com.example.testdex

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.example.testdex

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.example.testdex

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.example.testdex

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.example.testdex

com.example.testdex
1⤵
- Removes its main activity from the application launcher
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:4267
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.example.testdex/app_ttmp/t.jar --output-vdex-fd=49 --oat-fd=50 --oat-location=/data/user/0/com.example.testdex/app_ttmp/oat/x86/t.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4298

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.example.testdex/100classes.dex

Filesize
96KB

MD5
871748595bf8912a62a16ccc88fe1d87

SHA1
4af9633ecf9e61aa79fb3aeb3d295a9c4ebe9596

SHA256
0d4961513ff3b8bea46b00c367f280e290003d3216fc281bd7f05861a4afc0e3

SHA512
55976b804e6f299e656716a5ff6ca9a2d5ee5335f1edb94fbef0ae012dd616eae2c99ac6af18ba202a5861763b7b159b4c0272a75fd14927c80ffbfdac9281bc

Download Submit
/data/data/com.example.testdex/app_ttmp/oat/t.jar.cur.prof

Filesize
443B

MD5
c1cb31860f8837ee9732d6a58d93de11

SHA1
e9736099e0b0d8f9dff106480664ded23be1175c

SHA256
2ddd6438bcc6b8e525211949e2d8d81b3c6e0022f9ce7fe1c2a5425fa5121337

SHA512
94ca48687c169edba281f1b477dc7470b3142e23ea30c5a533ff9426e8884dc689ace9c9d3ce6c478a045e402ac9d8487769ca0b6f979d104870d2b9c1343d08

Download Submit
/data/data/com.example.testdex/app_ttmp/t.jar

Filesize
220KB

MD5
e3447d5435bc33cb03183a57f3474f1e

SHA1
13b41650892f79bff94f3edf8689c3218ba962d0

SHA256
8eabaa1e5b64a753f5aeeee5e02ce584ab8e65c5edfc5e3bdf38f25462024dc9

SHA512
e4e7906b57056c413942ea3f5fa91cf3bc5f508a2e9c8273524c0cf84d7189f26b770f0130f57218ecba8982ac337f46a6d11d10dd8f8dc4f5f0c0fa02447ab6

Download Submit
/data/data/com.example.testdex/databases/com.example.testdexb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.example.testdex/databases/com.example.testdexb-journal

Filesize
512B

MD5
c26f4742cae9d782156b05a209b5d3a7

SHA1
2b6cb802d88fea23470941b20e2637627ca1b8b7

SHA256
aaef0b02c16dd9c4d22fb51cec4b9489f3bb3df94c82175b2807f604eae0b02b

SHA512
b1765b78d7cc1b43071089bc16a9bd988a24a78d91b9daaffafbd4fbdd4fc1a55735cc68a5c0aae1ccc2075803162eee728ef0c3e774ccac9ef871258d3ce088

Download Submit
/data/data/com.example.testdex/databases/com.example.testdexb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.example.testdex/databases/com.example.testdexb-wal

Filesize
100KB

MD5
f75237fcdf7a903384134bd47924cf1c

SHA1
1b2f6349ee9b2f98ae5398aa3702d6d1c6904d5c

SHA256
f9a7a941900c7c662c27178cff7747b4caa1f102ad1e884ebc0ea59094e89515

SHA512
d8f36512ca9fc3e557f773911565bdafbc4949b71d1e64d0ff6f2653011e1fb3fee8aa5c8ef370164260d319fbc3b473f20e3624fb65e0d62fdce739c43c0f82

Download Submit
/data/user/0/com.example.testdex/app_ttmp/t.jar

Filesize
469KB

MD5
73b590f8bfdd3d17d710d7b4969592e8

SHA1
8b211d7488ba8023c2982d2bc3bb71405245d01b

SHA256
d6901db366b8f33db6af0d33225c19caa6723719264fafd52cda172119e38e4e

SHA512
7e1a5a6b97e7b3b927ac88749dfb0a59e87a00f27693e0c7909d6e6130696f5bc3bc1d26bf5de480ab14550a198c3a3cab8ffdc59cacb8cf9f2ce109ac67487b

Download Submit
/data/user/0/com.example.testdex/app_ttmp/t.jar

Filesize
469KB

MD5
4e1e6aa783bb8974b1436f0100156de6

SHA1
8d2d20dbf86960783c889dd9834e281bac850642

SHA256
58665fea32655b49869f9f7e6812f36906cd75dbe4af3f1d497e9bdeaf33fc53

SHA512
0a45ddb1269a3cd8a789ce3b9edef67e69c2968480938aac76e9e975c4cce049a42ebbcf0cf4058eef117e1041a1e7a8f15d504c5a9ca95b1b3d014ca91aadbf

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads