9257345f42daab05d6d80988f1cc76a76f15364eabe083347cebc98d97decad0

Analysis

max time kernel
177s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240611.1-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
submitted
16/06/2024, 18:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b48b5ce7ba4c2a0ccf0d83888d88874f_JaffaCakes118.apk
Size

615KB
MD5

b48b5ce7ba4c2a0ccf0d83888d88874f
SHA1

33c6cd294d5ef4288f0454de874d44295ab7d4df
SHA256

9257345f42daab05d6d80988f1cc76a76f15364eabe083347cebc98d97decad0
SHA512

57c5d253500565affb74fecad9a413a77798b6f048442997ef088288bb545c30fb2f8ee4ba8c6181b60babf29811bec0d8af5df6a90729d57f3c2776a0d2a1b7
SSDEEP

12288:+w0zqPeE4Yl+yavGkGxQqQKvhfGCEBDFTIKn1MQWnA+RhffmdarN:UlDktauk4QqQKviFTJ+REE

Score

8^/10

banker collection credential_access discovery evasion impact stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4444	com.example.testdex

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.example.testdex/app_ttmp/t.jar	4444	com.example.testdex

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.example.testdex

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.example.testdex

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.example.testdex

com.example.testdex
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:4444

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.example.testdex/100classes.dex

Filesize
96KB

MD5
871748595bf8912a62a16ccc88fe1d87

SHA1
4af9633ecf9e61aa79fb3aeb3d295a9c4ebe9596

SHA256
0d4961513ff3b8bea46b00c367f280e290003d3216fc281bd7f05861a4afc0e3

SHA512
55976b804e6f299e656716a5ff6ca9a2d5ee5335f1edb94fbef0ae012dd616eae2c99ac6af18ba202a5861763b7b159b4c0272a75fd14927c80ffbfdac9281bc

Download Submit
/data/user/0/com.example.testdex/app_ttmp/t.jar

Filesize
220KB

MD5
e3447d5435bc33cb03183a57f3474f1e

SHA1
13b41650892f79bff94f3edf8689c3218ba962d0

SHA256
8eabaa1e5b64a753f5aeeee5e02ce584ab8e65c5edfc5e3bdf38f25462024dc9

SHA512
e4e7906b57056c413942ea3f5fa91cf3bc5f508a2e9c8273524c0cf84d7189f26b770f0130f57218ecba8982ac337f46a6d11d10dd8f8dc4f5f0c0fa02447ab6

Download Submit
/data/user/0/com.example.testdex/app_ttmp/t.jar

Filesize
469KB

MD5
4e1e6aa783bb8974b1436f0100156de6

SHA1
8d2d20dbf86960783c889dd9834e281bac850642

SHA256
58665fea32655b49869f9f7e6812f36906cd75dbe4af3f1d497e9bdeaf33fc53

SHA512
0a45ddb1269a3cd8a789ce3b9edef67e69c2968480938aac76e9e975c4cce049a42ebbcf0cf4058eef117e1041a1e7a8f15d504c5a9ca95b1b3d014ca91aadbf

Download Submit
/data/user/0/com.example.testdex/databases/com.example.testdexb

Filesize
72KB

MD5
a40cf33b77058c4b38c7d7a3eb0fae9c

SHA1
6c0030cd9dd730e6b0a2eef2e9ccfde6356bad63

SHA256
d505a025581d4f6f6d8e9cfae130d385da05310c6cb78cb9a5fbd04af8ab51ae

SHA512
e7abf381e1cb2e2ece339c828ecce9f457284cd4ff0891ec98bbcd6225ae83404bb563ef7a23fca80e9beff81de06e9476dd064afec10a71ec119d0b1dc37df5

Download Submit
/data/user/0/com.example.testdex/databases/com.example.testdexb-journal

Filesize
512B

MD5
785c0333468042d3252ec3bb7f35f341

SHA1
83c1a6cfbea90ad904fbc373b1d657f4e79405bf

SHA256
b333f857812c7f183913bb4eedf75d302e37d672f7a3915e7fd6d752c21056f2

SHA512
bb32d545958df58a76563bedd18406b0ed067c27f70bfad5974a9d6f6c1678af7e5a52db827976fd8f728e0b1fddee6115b04a2c58fdcd534842b8794cae198f

Download Submit
/data/user/0/com.example.testdex/databases/com.example.testdexb-journal

Filesize
8KB

MD5
13f505a2e7bd914a649fcd4a55c7562c

SHA1
356fc3c8d58d8ddf5e77a99c7ea7f3ad1e4f2be1

SHA256
a0a6b04a33e6f003f03bd6da91c48d8bfb7cd7702966a1d59af22364028598f3

SHA512
4a3a228f136c3251c4b93d55cd6cf1c2ea16254a86c520690d99c437e0eddc9b37866ddd38877bbbe6c0e6aaa1ae7a363f252f2c5663da591657f4a5161e3729

Download Submit
/data/user/0/com.example.testdex/databases/com.example.testdexb-journal

Filesize
8KB

MD5
a139a7a2ad3d9300009d596d3ed58e7c

SHA1
e0c86a0cd65cd1b45e80c768526f3caac6c3f499

SHA256
b70cd8cd65be9e8700feb0f22cace8f9bffdf14dea7a7a48234fd2078ced4fcf

SHA512
f6f6960ca1799519ad0979a532fbc26b7d01c2c111755e2aecfd1f8e8022fd11f32aa1f9bdc80aea2a894450ad1a5c26450a93ea5de97751e4d2d13786570f1e

Download Submit
/data/user/0/com.example.testdex/databases/com.example.testdexb-journal

Filesize
12KB

MD5
1106705e8dac2242d0c3864cae6eca94

SHA1
a2541f3545068ee15f5fda5392afdd273cd8f599

SHA256
038e024cd525b071ab55dab054121a91f8d7cbb981b69bf0518fdc16e74559dc

SHA512
975218984c96e44525c46b8cc45ea7c3937c4be1925bb4689b17d919776cd0f19179fc83ade5a64a4dccef88a5190758a742f67070c66b1f2f7288e0743bc3d6

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads