Overview

overview

8

Static

static

6

b6908d5b96...18.apk

android-9-x86

8

b6908d5b96...18.apk

android-10-x64

8

b6908d5b96...18.apk

android-11-x64

8

Analysis

  • max time kernel
    179s
  • max time network
    177s
  • platform
    android_x64
  • resource
    android-x64-20240611.1-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system
  • submitted
    17-06-2024 03:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b6908d5b96a81b180e4b608f7025bb3e_JaffaCakes118.apk

  • Size

    692KB

  • MD5

    b6908d5b96a81b180e4b608f7025bb3e

  • SHA1

    1f959e6c69278e6f52566a2010196ab6f3107504

  • SHA256

    0546af2e35fcda21cd2db1a785d5b9356fd45ebad06e5a49d3d1a478f1fe3c4a

  • SHA512

    e84d9c877c487fa0fbd7122385fae3afbe0ac021aa30ee7f4a8821c87c4d3013d8d601e054bdfc4ba7104fda04feb93cc6aceb6d435d5e24d2c08256b416f4d9

  • SSDEEP

    12288:83uEvFGy0w9lbsWs5+NZYMjQzdE2bm/z87Q5CvvkG/9lAIzx7c:8+GGy0Z5+YMjQzd0/c/9lnzx7c

Score
8/10
bankercollectiondiscoveryevasionstealthtrojan

Malware Config

Signatures

  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
    stealthtrojanevasion
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Reads the contacts stored on the device. 1 TTPs 1 IoCs
    collection
  • Reads the content of SMS inbox messages. 1 TTPs 1 IoCs
    collection
  • Acquires the wake lock 1 IoCs
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery

Processes

  • com.cwapng.bybhktk
    1⤵
    • Removes its main activity from the application launcher
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Reads the contacts stored on the device.
    • Reads the content of SMS inbox messages.
    • Acquires the wake lock
    PID:5164

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.cwapng.bybhktk/app_tnlztdjae/lcaurg.jar
    Filesize

    78KB

    MD5

    01eb30f67424c22ea90511e2ff886305

    SHA1

    0fa72a5717c383ea483aa12b2e7e6c945caec005

    SHA256

    3ba8ece2e14931c18066f2ea23b0dbdae9cef026f051694ceb7514546a86b25b

    SHA512

    1a2b502ff8b5f942ab15d257a28aadbbe28d87e2990a4a3123d3c894abfd62f2d1d783f911aa34f63284a5d314c3b3ae57c5fc1bd5ca176f370c05cb5094908e

    Download Submit
  • /data/user/0/com.cwapng.bybhktk/app_tnlztdjae/lcaurg.jar
    Filesize

    179KB

    MD5

    f46d43764d4d0f1d0427bf2e73e94ca2

    SHA1

    fe0b3140138c4f53a98d87318849b6000feb87d4

    SHA256

    f9ee47ca5718fa7060db95b9ca57d1f43e3735a6e23c2989558459e7ca55666e

    SHA512

    cf21d4a0068d9ee8ae9cbdcd8f740f834b7e3676edd4a021716f756b2c6218a669503a182d6e178140e6c76af5b3a97f44af472ee699400f11d0f28f85422b38

    Download Submit