Malware Analysis Report

2024-07-28 11:35

Sample ID 240616-wzxmrs1grh
Target b48b5ce7ba4c2a0ccf0d83888d88874f_JaffaCakes118
SHA256 9257345f42daab05d6d80988f1cc76a76f15364eabe083347cebc98d97decad0
Tags
banker collection credential_access discovery evasion impact stealth trojan persistence
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

9257345f42daab05d6d80988f1cc76a76f15364eabe083347cebc98d97decad0

Threat Level: Likely malicious

The file b48b5ce7ba4c2a0ccf0d83888d88874f_JaffaCakes118 was found to be: Likely malicious.

Malicious Activity Summary

banker collection credential_access discovery evasion impact stealth trojan persistence

Removes its main activity from the application launcher

Loads dropped Dex/Jar

Obtains sensitive information copied to the device clipboard

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Checks Android system properties for emulator presence.

Requests dangerous framework permissions

Queries the mobile country code (MCC)

Queries the unique device ID (IMEI, MEID, IMSI)

Uses Crypto APIs (Might try to encrypt user data)

Registers a broadcast receiver at runtime (usually for listening for system events)

Checks memory information

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-16 18:22

Signatures

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-16 18:22

Reported

2024-06-16 18:25

Platform

android-x64-arm64-20240611.1-en

Max time kernel

177s

Max time network

132s

Command Line

com.example.testdex

Signatures

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.example.testdex/app_ttmp/t.jar N/A N/A

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.example.testdex

Network

Country Destination Domain Proto
GB 142.250.187.206:443 tcp
GB 142.250.187.206:443 tcp
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 216.58.201.104:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 a.asense.in udp
US 208.100.26.245:80 a.asense.in tcp
GB 142.250.179.228:443 tcp
GB 142.250.179.228:443 tcp

Files

/data/data/com.example.testdex/100classes.dex

MD5 871748595bf8912a62a16ccc88fe1d87
SHA1 4af9633ecf9e61aa79fb3aeb3d295a9c4ebe9596
SHA256 0d4961513ff3b8bea46b00c367f280e290003d3216fc281bd7f05861a4afc0e3
SHA512 55976b804e6f299e656716a5ff6ca9a2d5ee5335f1edb94fbef0ae012dd616eae2c99ac6af18ba202a5861763b7b159b4c0272a75fd14927c80ffbfdac9281bc

/data/user/0/com.example.testdex/app_ttmp/t.jar

MD5 e3447d5435bc33cb03183a57f3474f1e
SHA1 13b41650892f79bff94f3edf8689c3218ba962d0
SHA256 8eabaa1e5b64a753f5aeeee5e02ce584ab8e65c5edfc5e3bdf38f25462024dc9
SHA512 e4e7906b57056c413942ea3f5fa91cf3bc5f508a2e9c8273524c0cf84d7189f26b770f0130f57218ecba8982ac337f46a6d11d10dd8f8dc4f5f0c0fa02447ab6

/data/user/0/com.example.testdex/app_ttmp/t.jar

MD5 4e1e6aa783bb8974b1436f0100156de6
SHA1 8d2d20dbf86960783c889dd9834e281bac850642
SHA256 58665fea32655b49869f9f7e6812f36906cd75dbe4af3f1d497e9bdeaf33fc53
SHA512 0a45ddb1269a3cd8a789ce3b9edef67e69c2968480938aac76e9e975c4cce049a42ebbcf0cf4058eef117e1041a1e7a8f15d504c5a9ca95b1b3d014ca91aadbf

/data/user/0/com.example.testdex/databases/com.example.testdexb-journal

MD5 785c0333468042d3252ec3bb7f35f341
SHA1 83c1a6cfbea90ad904fbc373b1d657f4e79405bf
SHA256 b333f857812c7f183913bb4eedf75d302e37d672f7a3915e7fd6d752c21056f2
SHA512 bb32d545958df58a76563bedd18406b0ed067c27f70bfad5974a9d6f6c1678af7e5a52db827976fd8f728e0b1fddee6115b04a2c58fdcd534842b8794cae198f

/data/user/0/com.example.testdex/databases/com.example.testdexb

MD5 a40cf33b77058c4b38c7d7a3eb0fae9c
SHA1 6c0030cd9dd730e6b0a2eef2e9ccfde6356bad63
SHA256 d505a025581d4f6f6d8e9cfae130d385da05310c6cb78cb9a5fbd04af8ab51ae
SHA512 e7abf381e1cb2e2ece339c828ecce9f457284cd4ff0891ec98bbcd6225ae83404bb563ef7a23fca80e9beff81de06e9476dd064afec10a71ec119d0b1dc37df5

/data/user/0/com.example.testdex/databases/com.example.testdexb-journal

MD5 13f505a2e7bd914a649fcd4a55c7562c
SHA1 356fc3c8d58d8ddf5e77a99c7ea7f3ad1e4f2be1
SHA256 a0a6b04a33e6f003f03bd6da91c48d8bfb7cd7702966a1d59af22364028598f3
SHA512 4a3a228f136c3251c4b93d55cd6cf1c2ea16254a86c520690d99c437e0eddc9b37866ddd38877bbbe6c0e6aaa1ae7a363f252f2c5663da591657f4a5161e3729

/data/user/0/com.example.testdex/databases/com.example.testdexb-journal

MD5 a139a7a2ad3d9300009d596d3ed58e7c
SHA1 e0c86a0cd65cd1b45e80c768526f3caac6c3f499
SHA256 b70cd8cd65be9e8700feb0f22cace8f9bffdf14dea7a7a48234fd2078ced4fcf
SHA512 f6f6960ca1799519ad0979a532fbc26b7d01c2c111755e2aecfd1f8e8022fd11f32aa1f9bdc80aea2a894450ad1a5c26450a93ea5de97751e4d2d13786570f1e

/data/user/0/com.example.testdex/databases/com.example.testdexb-journal

MD5 1106705e8dac2242d0c3864cae6eca94
SHA1 a2541f3545068ee15f5fda5392afdd273cd8f599
SHA256 038e024cd525b071ab55dab054121a91f8d7cbb981b69bf0518fdc16e74559dc
SHA512 975218984c96e44525c46b8cc45ea7c3937c4be1925bb4689b17d919776cd0f19179fc83ade5a64a4dccef88a5190758a742f67070c66b1f2f7288e0743bc3d6

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-16 18:22

Reported

2024-06-16 18:25

Platform

android-x86-arm-20240611.1-en

Max time kernel

179s

Max time network

131s

Command Line

com.example.testdex

Signatures

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Checks Android system properties for emulator presence.

evasion
Description Indicator Process Target
Accessed system property key: ro.product.model N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.example.testdex/app_ttmp/t.jar N/A N/A
N/A /data/user/0/com.example.testdex/app_ttmp/t.jar N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.example.testdex

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.example.testdex/app_ttmp/t.jar --output-vdex-fd=49 --oat-fd=50 --oat-location=/data/user/0/com.example.testdex/app_ttmp/oat/x86/t.odex --compiler-filter=quicken --class-loader-context=&

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 216.58.212.234:443 tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
US 1.1.1.1:53 a.asense.in udp
US 208.100.26.245:80 a.asense.in tcp
GB 142.250.187.206:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 142.250.200.46:443 android.apis.google.com tcp
GB 216.58.212.202:443 tcp

Files

/data/data/com.example.testdex/100classes.dex

MD5 871748595bf8912a62a16ccc88fe1d87
SHA1 4af9633ecf9e61aa79fb3aeb3d295a9c4ebe9596
SHA256 0d4961513ff3b8bea46b00c367f280e290003d3216fc281bd7f05861a4afc0e3
SHA512 55976b804e6f299e656716a5ff6ca9a2d5ee5335f1edb94fbef0ae012dd616eae2c99ac6af18ba202a5861763b7b159b4c0272a75fd14927c80ffbfdac9281bc

/data/data/com.example.testdex/app_ttmp/t.jar

MD5 e3447d5435bc33cb03183a57f3474f1e
SHA1 13b41650892f79bff94f3edf8689c3218ba962d0
SHA256 8eabaa1e5b64a753f5aeeee5e02ce584ab8e65c5edfc5e3bdf38f25462024dc9
SHA512 e4e7906b57056c413942ea3f5fa91cf3bc5f508a2e9c8273524c0cf84d7189f26b770f0130f57218ecba8982ac337f46a6d11d10dd8f8dc4f5f0c0fa02447ab6

/data/user/0/com.example.testdex/app_ttmp/t.jar

MD5 4e1e6aa783bb8974b1436f0100156de6
SHA1 8d2d20dbf86960783c889dd9834e281bac850642
SHA256 58665fea32655b49869f9f7e6812f36906cd75dbe4af3f1d497e9bdeaf33fc53
SHA512 0a45ddb1269a3cd8a789ce3b9edef67e69c2968480938aac76e9e975c4cce049a42ebbcf0cf4058eef117e1041a1e7a8f15d504c5a9ca95b1b3d014ca91aadbf

/data/user/0/com.example.testdex/app_ttmp/t.jar

MD5 73b590f8bfdd3d17d710d7b4969592e8
SHA1 8b211d7488ba8023c2982d2bc3bb71405245d01b
SHA256 d6901db366b8f33db6af0d33225c19caa6723719264fafd52cda172119e38e4e
SHA512 7e1a5a6b97e7b3b927ac88749dfb0a59e87a00f27693e0c7909d6e6130696f5bc3bc1d26bf5de480ab14550a198c3a3cab8ffdc59cacb8cf9f2ce109ac67487b

/data/data/com.example.testdex/databases/com.example.testdexb-journal

MD5 c26f4742cae9d782156b05a209b5d3a7
SHA1 2b6cb802d88fea23470941b20e2637627ca1b8b7
SHA256 aaef0b02c16dd9c4d22fb51cec4b9489f3bb3df94c82175b2807f604eae0b02b
SHA512 b1765b78d7cc1b43071089bc16a9bd988a24a78d91b9daaffafbd4fbdd4fc1a55735cc68a5c0aae1ccc2075803162eee728ef0c3e774ccac9ef871258d3ce088

/data/data/com.example.testdex/databases/com.example.testdexb

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.example.testdex/databases/com.example.testdexb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.example.testdex/databases/com.example.testdexb-wal

MD5 f75237fcdf7a903384134bd47924cf1c
SHA1 1b2f6349ee9b2f98ae5398aa3702d6d1c6904d5c
SHA256 f9a7a941900c7c662c27178cff7747b4caa1f102ad1e884ebc0ea59094e89515
SHA512 d8f36512ca9fc3e557f773911565bdafbc4949b71d1e64d0ff6f2653011e1fb3fee8aa5c8ef370164260d319fbc3b473f20e3624fb65e0d62fdce739c43c0f82

/data/data/com.example.testdex/app_ttmp/oat/t.jar.cur.prof

MD5 c1cb31860f8837ee9732d6a58d93de11
SHA1 e9736099e0b0d8f9dff106480664ded23be1175c
SHA256 2ddd6438bcc6b8e525211949e2d8d81b3c6e0022f9ce7fe1c2a5425fa5121337
SHA512 94ca48687c169edba281f1b477dc7470b3142e23ea30c5a533ff9426e8884dc689ace9c9d3ce6c478a045e402ac9d8487769ca0b6f979d104870d2b9c1343d08

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-16 18:22

Reported

2024-06-16 18:25

Platform

android-x64-20240611.1-en

Max time kernel

179s

Max time network

131s

Command Line

com.example.testdex

Signatures

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped Dex/Jar

evasion
Description Indicator Process Target
N/A /data/user/0/com.example.testdex/app_ttmp/t.jar N/A N/A

Obtains sensitive information copied to the device clipboard

collection credential_access impact
Description Indicator Process Target
Framework service call android.content.IClipboard.addPrimaryClipChangedListener N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

banker discovery

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Queries the unique device ID (IMEI, MEID, IMSI)

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Uses Crypto APIs (Might try to encrypt user data)

impact
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Checks memory information

Description Indicator Process Target
File opened for read /proc/meminfo N/A N/A

Processes

com.example.testdex

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.179.232:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 a.asense.in udp
US 208.100.26.245:80 a.asense.in tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 216.58.201.110:443 android.apis.google.com tcp
GB 142.250.178.14:443 tcp
GB 142.250.187.226:443 tcp
GB 142.250.179.228:443 tcp
GB 142.250.179.228:443 tcp
GB 216.58.204.78:443 tcp

Files

/data/data/com.example.testdex/100classes.dex

MD5 871748595bf8912a62a16ccc88fe1d87
SHA1 4af9633ecf9e61aa79fb3aeb3d295a9c4ebe9596
SHA256 0d4961513ff3b8bea46b00c367f280e290003d3216fc281bd7f05861a4afc0e3
SHA512 55976b804e6f299e656716a5ff6ca9a2d5ee5335f1edb94fbef0ae012dd616eae2c99ac6af18ba202a5861763b7b159b4c0272a75fd14927c80ffbfdac9281bc

/data/data/com.example.testdex/app_ttmp/t.jar

MD5 e3447d5435bc33cb03183a57f3474f1e
SHA1 13b41650892f79bff94f3edf8689c3218ba962d0
SHA256 8eabaa1e5b64a753f5aeeee5e02ce584ab8e65c5edfc5e3bdf38f25462024dc9
SHA512 e4e7906b57056c413942ea3f5fa91cf3bc5f508a2e9c8273524c0cf84d7189f26b770f0130f57218ecba8982ac337f46a6d11d10dd8f8dc4f5f0c0fa02447ab6

/data/user/0/com.example.testdex/app_ttmp/t.jar

MD5 4e1e6aa783bb8974b1436f0100156de6
SHA1 8d2d20dbf86960783c889dd9834e281bac850642
SHA256 58665fea32655b49869f9f7e6812f36906cd75dbe4af3f1d497e9bdeaf33fc53
SHA512 0a45ddb1269a3cd8a789ce3b9edef67e69c2968480938aac76e9e975c4cce049a42ebbcf0cf4058eef117e1041a1e7a8f15d504c5a9ca95b1b3d014ca91aadbf

/data/data/com.example.testdex/databases/com.example.testdexb-journal

MD5 b04a1546eb3a691582315299a3bbbc09
SHA1 78891d9c603db56471ae8d10fe631124b83eb93e
SHA256 a99a83dbc7b9250d72627ecba9f0629ee5e3e37344a90c4d1788c5da32bc923a
SHA512 991f1410a46f6766de252259a563c2d65a2d16f5544d3a8c2ca87a190dbab84004e145f4d8d6110d09c7d7e9a5a2068decd3eb5f9191c83078f02cb28eaba6a3

/data/data/com.example.testdex/databases/com.example.testdexb

MD5 e272f5c7076521d7f27ce22d6143609c
SHA1 3e034264dd61394378ecccc8f1705ad9af773891
SHA256 6e13cea57c6b3ad60b20e7c6ef0ab8083677be4700a97af4a1c466d52b022330
SHA512 50dd1c3a2846a5f4263f436f7a395757364ad3a730e451fd7cd143a5d9b3a270786a430ba90ec978e8bca8bc366fe09f336b209d8948d95783c2a80d06590e51

/data/data/com.example.testdex/databases/com.example.testdexb-journal

MD5 9bd36c4a9e5119d2b7d36d305d3255df
SHA1 d145ad14a2c115354ea563f12c3e995f6b969ddd
SHA256 9e94a5dfaef34c165272f23109adaf7c9913c6ac80e049d90ead43d87379526e
SHA512 4ca85a2582943c7e44c137063241c74dbbc34161dad0ec2085fe4c88eabe95136ff2d7fe58bab3d7548f9427612edbe75e5c41dce8c46b2d5acfffe3551c5b07

/data/data/com.example.testdex/databases/com.example.testdexb-journal

MD5 cfc34d489c45c4dde782138a3ee778c6
SHA1 6898474f7346a741f55ea3c0abde9ab93631d8b8
SHA256 c8a307370c37291a01615a197fe8b6b58a919d3b94a05e3c803390c916349c15
SHA512 ebc3dcc73c7c4f94ea24a25f6f6b5d11513959329f27f9983424a5b14691dedd25c80a9815c3aeb5969c71a220851ce025934c7c8f23c5b6f87d4a824ddb44d4

/data/data/com.example.testdex/databases/com.example.testdexb-journal

MD5 5b28e3b8743d8d98e4109e01f594870a
SHA1 c4b502496650bac4d64904546f678996835c50d8
SHA256 5d8969d706ec4a74eaa2ba6cbe60754e01925c20522919c18b13b9d58709e49b
SHA512 a7a65202b993ede7f8b21a9f9b5f7ecf0ec4dcbe88917da6cbd60e518ce7e9f2e7951d77fdb621585a6bdc163710fddd068182f2a8d852bc2620d8305aafbc8e

/data/data/com.example.testdex/app_ttmp/oat/t.jar.cur.prof

MD5 7775ef2935388586230468a1533490c0
SHA1 9bc70917563ce87174e5b0ddc26f8b4de4cdc9f9
SHA256 7f9ed1774c1162b0b1484f5e7bede7edae3349d9f33410a44f8a49c09e1736f3
SHA512 487b394ecb91fa7f130cf5234392b52581b8b90b3fdde8bb2c25f9cfdb8aae79a86ee5785edd38fae52e0ca956d6ecb9b837484d04d1d49bb526df09b8807869