9257345f42daab05d6d80988f1cc76a76f15364eabe083347cebc98d97decad0

Analysis

max time kernel
179s
max time network
131s
platform
android_x64
resource
android-x64-20240611.1-en
resource tags

androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system
submitted
16-06-2024 18:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b48b5ce7ba4c2a0ccf0d83888d88874f_JaffaCakes118.apk
Size

615KB
MD5

b48b5ce7ba4c2a0ccf0d83888d88874f
SHA1

33c6cd294d5ef4288f0454de874d44295ab7d4df
SHA256

9257345f42daab05d6d80988f1cc76a76f15364eabe083347cebc98d97decad0
SHA512

57c5d253500565affb74fecad9a413a77798b6f048442997ef088288bb545c30fb2f8ee4ba8c6181b60babf29811bec0d8af5df6a90729d57f3c2776a0d2a1b7
SSDEEP

12288:+w0zqPeE4Yl+yavGkGxQqQKvhfGCEBDFTIKn1MQWnA+RhffmdarN:UlDktauk4QqQKviFTJ+REE

Score

8^/10

banker collection credential_access discovery evasion impact persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

T1628.001

Processes:

com.example.testdex

pid process

5037 com.example.testdex
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
evasion

T1407

Processes:

com.example.testdex

ioc pid process

/data/user/0/com.example.testdex/app_ttmp/t.jar 5037 com.example.testdex
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
collection credential_access impact

T1414

T1641.001

Processes:

com.example.testdex

description ioc process

Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.example.testdex
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

T1418.001
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

T1422

Processes:

com.example.testdex

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.example.testdex
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

T1422
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

T1624.001

Processes:

com.example.testdex

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.example.testdex
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

T1471

Processes:

com.example.testdex

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.example.testdex
Checks memory information 2 TTPs 1 IoCs

T1633.001

T1426

Processes:

com.example.testdex

description ioc process

File opened for read /proc/meminfo com.example.testdex

pid	process
5037	com.example.testdex

ioc	pid	process
/data/user/0/com.example.testdex/app_ttmp/t.jar	5037	com.example.testdex

description	ioc	process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.example.testdex

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.example.testdex

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.example.testdex

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.example.testdex

description	ioc	process
File opened for read	/proc/meminfo	com.example.testdex

com.example.testdex
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:5037

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.example.testdex/100classes.dex
Filesize
96KB

MD5
871748595bf8912a62a16ccc88fe1d87

SHA1
4af9633ecf9e61aa79fb3aeb3d295a9c4ebe9596

SHA256
0d4961513ff3b8bea46b00c367f280e290003d3216fc281bd7f05861a4afc0e3

SHA512
55976b804e6f299e656716a5ff6ca9a2d5ee5335f1edb94fbef0ae012dd616eae2c99ac6af18ba202a5861763b7b159b4c0272a75fd14927c80ffbfdac9281bc

Download Submit
/data/data/com.example.testdex/app_ttmp/oat/t.jar.cur.prof
Filesize
465B

MD5
7775ef2935388586230468a1533490c0

SHA1
9bc70917563ce87174e5b0ddc26f8b4de4cdc9f9

SHA256
7f9ed1774c1162b0b1484f5e7bede7edae3349d9f33410a44f8a49c09e1736f3

SHA512
487b394ecb91fa7f130cf5234392b52581b8b90b3fdde8bb2c25f9cfdb8aae79a86ee5785edd38fae52e0ca956d6ecb9b837484d04d1d49bb526df09b8807869

Download Submit
/data/data/com.example.testdex/app_ttmp/t.jar
Filesize
220KB

MD5
e3447d5435bc33cb03183a57f3474f1e

SHA1
13b41650892f79bff94f3edf8689c3218ba962d0

SHA256
8eabaa1e5b64a753f5aeeee5e02ce584ab8e65c5edfc5e3bdf38f25462024dc9

SHA512
e4e7906b57056c413942ea3f5fa91cf3bc5f508a2e9c8273524c0cf84d7189f26b770f0130f57218ecba8982ac337f46a6d11d10dd8f8dc4f5f0c0fa02447ab6

Download Submit
/data/data/com.example.testdex/databases/com.example.testdexb
Filesize
72KB

MD5
e272f5c7076521d7f27ce22d6143609c

SHA1
3e034264dd61394378ecccc8f1705ad9af773891

SHA256
6e13cea57c6b3ad60b20e7c6ef0ab8083677be4700a97af4a1c466d52b022330

SHA512
50dd1c3a2846a5f4263f436f7a395757364ad3a730e451fd7cd143a5d9b3a270786a430ba90ec978e8bca8bc366fe09f336b209d8948d95783c2a80d06590e51

Download Submit
/data/data/com.example.testdex/databases/com.example.testdexb-journal
Filesize
512B

MD5
b04a1546eb3a691582315299a3bbbc09

SHA1
78891d9c603db56471ae8d10fe631124b83eb93e

SHA256
a99a83dbc7b9250d72627ecba9f0629ee5e3e37344a90c4d1788c5da32bc923a

SHA512
991f1410a46f6766de252259a563c2d65a2d16f5544d3a8c2ca87a190dbab84004e145f4d8d6110d09c7d7e9a5a2068decd3eb5f9191c83078f02cb28eaba6a3

Download Submit
/data/data/com.example.testdex/databases/com.example.testdexb-journal
Filesize
8KB

MD5
9bd36c4a9e5119d2b7d36d305d3255df

SHA1
d145ad14a2c115354ea563f12c3e995f6b969ddd

SHA256
9e94a5dfaef34c165272f23109adaf7c9913c6ac80e049d90ead43d87379526e

SHA512
4ca85a2582943c7e44c137063241c74dbbc34161dad0ec2085fe4c88eabe95136ff2d7fe58bab3d7548f9427612edbe75e5c41dce8c46b2d5acfffe3551c5b07

Download Submit
/data/data/com.example.testdex/databases/com.example.testdexb-journal
Filesize
8KB

MD5
cfc34d489c45c4dde782138a3ee778c6

SHA1
6898474f7346a741f55ea3c0abde9ab93631d8b8

SHA256
c8a307370c37291a01615a197fe8b6b58a919d3b94a05e3c803390c916349c15

SHA512
ebc3dcc73c7c4f94ea24a25f6f6b5d11513959329f27f9983424a5b14691dedd25c80a9815c3aeb5969c71a220851ce025934c7c8f23c5b6f87d4a824ddb44d4

Download Submit
/data/data/com.example.testdex/databases/com.example.testdexb-journal
Filesize
12KB

MD5
5b28e3b8743d8d98e4109e01f594870a

SHA1
c4b502496650bac4d64904546f678996835c50d8

SHA256
5d8969d706ec4a74eaa2ba6cbe60754e01925c20522919c18b13b9d58709e49b

SHA512
a7a65202b993ede7f8b21a9f9b5f7ecf0ec4dcbe88917da6cbd60e518ce7e9f2e7951d77fdb621585a6bdc163710fddd068182f2a8d852bc2620d8305aafbc8e

Download Submit
/data/user/0/com.example.testdex/app_ttmp/t.jar
Filesize
469KB

MD5
4e1e6aa783bb8974b1436f0100156de6

SHA1
8d2d20dbf86960783c889dd9834e281bac850642

SHA256
58665fea32655b49869f9f7e6812f36906cd75dbe4af3f1d497e9bdeaf33fc53

SHA512
0a45ddb1269a3cd8a789ce3b9edef67e69c2968480938aac76e9e975c4cce049a42ebbcf0cf4058eef117e1041a1e7a8f15d504c5a9ca95b1b3d014ca91aadbf

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads