Analysis
-
max time kernel
179s -
max time network
170s -
platform
android_x86 -
resource
android-x86-arm-20240611.1-en -
resource tags
-
submitted
17-06-2024 03:35
General
-
Target
b6908d5b96a81b180e4b608f7025bb3e_JaffaCakes118.apk
-
Size
692KB
-
MD5
b6908d5b96a81b180e4b608f7025bb3e
-
SHA1
1f959e6c69278e6f52566a2010196ab6f3107504
-
SHA256
0546af2e35fcda21cd2db1a785d5b9356fd45ebad06e5a49d3d1a478f1fe3c4a
-
SHA512
e84d9c877c487fa0fbd7122385fae3afbe0ac021aa30ee7f4a8821c87c4d3013d8d601e054bdfc4ba7104fda04feb93cc6aceb6d435d5e24d2c08256b416f4d9
-
SSDEEP
12288:83uEvFGy0w9lbsWs5+NZYMjQzdE2bm/z87Q5CvvkG/9lAIzx7c:8+GGy0Z5+YMjQzd0/c/9lnzx7c
Malware Config
Signatures
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Reads the contacts stored on the device. 1 TTPs 1 IoCs
-
Reads the content of SMS inbox messages. 1 TTPs 1 IoCs
-
Acquires the wake lock 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Tries to add a device administrator. 2 TTPs 1 IoCs
Processes
-
com.cwapng.bybhktk1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Reads the contacts stored on the device.
- Reads the content of SMS inbox messages.
- Acquires the wake lock
- Tries to add a device administrator.
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.cwapng.bybhktk/app_tnlztdjae/lcaurg.jar --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.cwapng.bybhktk/app_tnlztdjae/oat/x86/lcaurg.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.cwapng.bybhktk/app_tnlztdjae/lcaurg.jarFilesize
78KB
MD501eb30f67424c22ea90511e2ff886305
SHA10fa72a5717c383ea483aa12b2e7e6c945caec005
SHA2563ba8ece2e14931c18066f2ea23b0dbdae9cef026f051694ceb7514546a86b25b
SHA5121a2b502ff8b5f942ab15d257a28aadbbe28d87e2990a4a3123d3c894abfd62f2d1d783f911aa34f63284a5d314c3b3ae57c5fc1bd5ca176f370c05cb5094908e
-
/data/user/0/com.cwapng.bybhktk/app_tnlztdjae/lcaurg.jarFilesize
179KB
MD58d4c6a02017310a35986f187d6eaf537
SHA13bf11eff7f43481952b25620f1bfca15b839fc7b
SHA25632bd20c313096087bb7628e9a6adc6da4c939e188674618a434ab83ac5f28be9
SHA512a0bfdf9bac2c1eee1707746a069824c47d2808d5834c7661e119920c14ab8b41048749168bb39689e217082a0468ee82bfd650e409baa762e57307a132923273
-
/data/user/0/com.cwapng.bybhktk/app_tnlztdjae/lcaurg.jarFilesize
179KB
MD5f46d43764d4d0f1d0427bf2e73e94ca2
SHA1fe0b3140138c4f53a98d87318849b6000feb87d4
SHA256f9ee47ca5718fa7060db95b9ca57d1f43e3735a6e23c2989558459e7ca55666e
SHA512cf21d4a0068d9ee8ae9cbdcd8f740f834b7e3676edd4a021716f756b2c6218a669503a182d6e178140e6c76af5b3a97f44af472ee699400f11d0f28f85422b38