0546af2e35fcda21cd2db1a785d5b9356fd45ebad06e5a49d3d1a478f1fe3c4a

General

Target
b6908d5b96a81b180e4b608f7025bb3e_JaffaCakes118.apk
Size 692KB
Sample240617-d5v21swgnl
SHA256 0546af2e35fcda21cd2db1a785d5b9356fd45ebad06e5a49d3d1a478f1fe3c4a
MD5 b6908d5b96a81b180e4b608f7025bb3e
SHA1 1f959e6c69278e6f52566a2010196ab6f3107504
SHA512 e84d9c877c487fa0fbd7122385fae3afbe0ac021aa30ee7f4a8821c87c4d3013d8d601e054bdfc4ba7104fda04feb93cc6aceb6d435d5e24d2c08256b416f4d9
SSDEEP 12288:83uEvFGy0w9lbsWs5+NZYMjQzdE2bm/z87Q5CvvkG/9lAIzx7c:8+GGy0Z5+YMjQzd0/c/9lnzx7c
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection discovery evasion impact privilege_escalation stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4270	com.cwapng.bybhktk

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.cwapng.bybhktk/app_tnlztdjae/lcaurg.jar	4306	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.cwapng.bybhktk/app_tnlztdjae/lcaurg.jar --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.cwapng.bybhktk/app_tnlztdjae/oat/x86/lcaurg.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.cwapng.bybhktk/app_tnlztdjae/lcaurg.jar	4270	com.cwapng.bybhktk

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.cwapng.bybhktk

Reads the contacts stored on the device. 1 TTPs 1 IoCs

collection

Contact List

T1636.003

description	ioc	Process
URI accessed for read	content://com.android.contacts/contacts	com.cwapng.bybhktk

Reads the content of SMS inbox messages. 1 TTPs 1 IoCs

collection

SMS Messages

T1636.004

description	ioc	Process
URI accessed for read	content://sms/inbox	com.cwapng.bybhktk

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.cwapng.bybhktk

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Tries to add a device administrator. 2 TTPs 1 IoCs

privilege_escalation impact

Device Administrator Permissions

T1626.001

Account Access Removal

T1640

description	ioc	Process
Intent action	android.app.action.ADD_DEVICE_ADMIN	com.cwapng.bybhktk

com.cwapng.bybhktk
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Reads the contacts stored on the device.
- Reads the content of SMS inbox messages.
- Acquires the wake lock
- Tries to add a device administrator.
PID:4270
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.cwapng.bybhktk/app_tnlztdjae/lcaurg.jar --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.cwapng.bybhktk/app_tnlztdjae/oat/x86/lcaurg.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4306

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1626

Device Administrator Permissions

1

T1626.001

Defense Evasion

Download New Code at Runtime

1

T1407

Hide Artifacts

1

T1628

Suppress Application Icon

1

T1628.001

Credential Access

Discovery

Process Discovery

1

T1424

Software Discovery

1

T1418

Security Software Discovery

1

T1418.001

System Network Configuration Discovery

1

T1422

Lateral Movement

Collection

Protected User Data

2

T1636

Contact List

1

T1636.003

SMS Messages

1

T1636.004

Command and Control

Exfiltration

Impact

Account Access Removal

1

T1640

Replay Monitor

Loading Replay Monitor...

Downloads

lcaurg.jar

Path /data/data/com.cwapng.bybhktk/app_tnlztdjae/lcaurg.jar
Size 78KB
SHA256 3ba8ece2e14931c18066f2ea23b0dbdae9cef026f051694ceb7514546a86b25b
MD5 01eb30f67424c22ea90511e2ff886305
SHA1 0fa72a5717c383ea483aa12b2e7e6c945caec005
SHA512 1a2b502ff8b5f942ab15d257a28aadbbe28d87e2990a4a3123d3c894abfd62f2d1d783f911aa34f63284a5d314c3b3ae57c5fc1bd5ca176f370c05cb5094908e
SSDEEP 1536:ct0oNJuiYfa/1aW6kKaO3/veJTg8tmcncGv9LeAPyfYeYEAD:a0oTuzi/76kKaO3/v+NLcGvI6ydVW
MD5 SHA1 SHA512 SSDEEP

Submit Download

lcaurg.jar

Path /data/user/0/com.cwapng.bybhktk/app_tnlztdjae/lcaurg.jar
Size 179KB
SHA256 32bd20c313096087bb7628e9a6adc6da4c939e188674618a434ab83ac5f28be9
MD5 8d4c6a02017310a35986f187d6eaf537
SHA1 3bf11eff7f43481952b25620f1bfca15b839fc7b
SHA512 a0bfdf9bac2c1eee1707746a069824c47d2808d5834c7661e119920c14ab8b41048749168bb39689e217082a0468ee82bfd650e409baa762e57307a132923273
SSDEEP 3072:Wmi6SnZY4ECXsPOwTy4OZSN/oSz2HauDs5x2cTjX+Pq9bEbzyHY1LWlGDf:WAje/BHPs5hKqtmgiWO
MD5 SHA1 SHA512 SSDEEP

Download

lcaurg.jar

Path /data/user/0/com.cwapng.bybhktk/app_tnlztdjae/lcaurg.jar
Size 179KB
SHA256 f9ee47ca5718fa7060db95b9ca57d1f43e3735a6e23c2989558459e7ca55666e
MD5 f46d43764d4d0f1d0427bf2e73e94ca2
SHA1 fe0b3140138c4f53a98d87318849b6000feb87d4
SHA512 cf21d4a0068d9ee8ae9cbdcd8f740f834b7e3676edd4a021716f756b2c6218a669503a182d6e178140e6c76af5b3a97f44af472ee699400f11d0f28f85422b38
SSDEEP 3072:Wmi6SnZY4ECXsPOwTy4OZSN/oSz2HauDs5x2Noc3qBzmnx/NEGS2+VGDf:WAje/BHPs50qwnxiGSZ+
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads