9cb27a45cd414dd4016f25d49fcf1223027c150e06ea254151afdda9ed80a553

Analysis

max time kernel
7s
max time network
130s
platform
android_x86
resource
android-x86-arm-20240611.1-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
submitted
17/06/2024, 07:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b74d99ebe9af2cf9cc0f84f47fddb815_JaffaCakes118.apk
Size 2.9MB
Sample240617-hxdvzstcmp
SHA256 9cb27a45cd414dd4016f25d49fcf1223027c150e06ea254151afdda9ed80a553
MD5 b74d99ebe9af2cf9cc0f84f47fddb815
SHA1 d081e4523b4f1eaa4fd2b07211b6b563745f5aaf
SHA512 6a6c899bafb2a76ef60085a6128918d28e17bd2469f649df5bcf7b0ac15ae1743e51765f9d976465064dc1e4342db8a55c0994f57cddf14cfad3e1c3fd35c926
SSDEEP 49152:yebEoRR/+UXgZNvxEDKJ84INrIQ7UDa6+We718RRvyyRvy0WrS:JEe+UsoKRINp+a6e18nJ0S
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection discovery evasion persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/bin/su	aaBbO.hQhmsK.DYWN
/system/xbin/su	aaBbO.hQhmsK.DYWN

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/aaBbO.hQhmsK.DYWN/files/.ca/lWySsXg.jar	4256	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/aaBbO.hQhmsK.DYWN/files/.ca/lWySsXg.jar --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/aaBbO.hQhmsK.DYWN/files/.ca/oat/x86/lWySsXg.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/aaBbO.hQhmsK.DYWN/files/.ca/lWySsXg.jar	4230	aaBbO.hQhmsK.DYWN
/data/user/0/aaBbO.hQhmsK.DYWN/app_workbench89836/apk.zip	4230	aaBbO.hQhmsK.DYWN

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	aaBbO.hQhmsK.DYWN

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	aaBbO.hQhmsK.DYWN

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	aaBbO.hQhmsK.DYWN

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	aaBbO.hQhmsK.DYWN

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	aaBbO.hQhmsK.DYWN

aaBbO.hQhmsK.DYWN
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4230
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/aaBbO.hQhmsK.DYWN/files/.ca/lWySsXg.jar --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/aaBbO.hQhmsK.DYWN/files/.ca/oat/x86/lWySsXg.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4256
- chmod 666 /storage/emulated/0/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.main.apk
  2⤵
  PID:4326

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Execution Guardrails

T1627

Geofencing

T1627.001

Credential Access

Discovery

Location Tracking

T1430

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

apk.zip

Path /data/data/aaBbO.hQhmsK.DYWN/app_workbench89836/apk.zip
Size 52KB
SHA256 3313e87fd2c7c453aed704b05da5f527aca6e8a7bfe1e70ac63ed3c1e3d30f5a
MD5 60fe1574bf85375c4328bcde98187c78
SHA1 d2d2c9c4bae6d062ec3c7a9f7938e3d5324c25d8
SHA512 2685b549c16c336f96dcc8f834282d561e55aaf3000d3283503ab88a3f6190399169ac3cc6afbf84603eb25bb7a0070465a76e7f2a3c5cbf26e56039211c247a
SSDEEP 1536:iXGIY3NljGfdIjiycEBHQhPE1mUbrNmhxnC6riZv4kR:1ImfGm98wmUbt6qvNR
MD5 SHA1 SHA512 SSDEEP

Submit Download

lWySsXg.jar

Path /data/data/aaBbO.hQhmsK.DYWN/files/.ca/lWySsXg.jar
Size 979KB
SHA256 d09ad588179caa7e0fef9b4c2da8c45c7334e21053401255a5343d41489803be
MD5 064e7586271a5aea294ca64163dadf7a
SHA1 fe7a0fbea5c24f768806e02fcdc30720b400012b
SHA512 92657c78d6e016f083a997100d57c738f8716ad728165eb9547620e7889cf32987d6861566ca8e0a4dab31ab739f1c071b22df802da765401b246c1dbf321234
SSDEEP 24576:UE6sKyB2Y3obhsGaSBPLqmH36MgrTe9CgqL/BtCz9vK+dZypHmXuRp:UyBj4bep2LqmHqMQKxe5gZ38F5p
MD5 SHA1 SHA512 SSDEEP

Submit Download

apk.zip

Path /data/user/0/aaBbO.hQhmsK.DYWN/app_workbench89836/apk.zip
Size 122KB
SHA256 43335928ff5d2e22a90e3385510a9c7e01bcf9eb342b9819ec057efa6e3e97f2
MD5 cc62151230d0ef1f9a71f8b7377a920d
SHA1 ee7875d5eba357f7bea326cf319fa82e51440cf9
SHA512 a5b35770ad86d8217996bdb50ca04bf38a7357b1b60c16be20a9bbb2cd0d9ff95b1df8a6111926ad60b6e0d01e97db12e999798895060988639bd9b3ea4cfdf9
SSDEEP 3072:DhZvAchaWffbAJcYM5VAQUcnLKY1/UeNOspzQ:lZThaMUJVMvAQUcnLAeLQ
MD5 SHA1 SHA512 SSDEEP

Download

lWySsXg.jar

Path /data/user/0/aaBbO.hQhmsK.DYWN/files/.ca/lWySsXg.jar
Size 2.2MB
SHA256 776cd9dae04c9c4e71c881ed3108082ce8980262f4d787067e76698f8793968b
MD5 866fc3a41ae02c2b8fc66242d3a40d40
SHA1 6cbb34ba971fe8f275cb4c33445e847131573912
SHA512 d354e1f4953ed5a4d3ea07bd7852decdbc4290bc8a9364e0a416c0b053867066358a5a4b5628927974ad39db8b180c2d25105b7aa4642f7cab6703543183fe25
SSDEEP 49152:K1H9B6qJqSqqqKqkJvi2lQ1+Oc1JowHyZY54oYIJP/6sxx1vSFhPjaMF8+4VW6GH:OdqcAOVGAu4P8
MD5 SHA1 SHA512 SSDEEP

Download

lWySsXg.jar

Path /data/user/0/aaBbO.hQhmsK.DYWN/files/.ca/lWySsXg.jar
Size 2.2MB
SHA256 3776b04872d50b53e1ff092be2198b03a6a4ff5246c08235b77728fa759a1642
MD5 adfe16e131330733f1f0e6f3df909051
SHA1 f8db963d973d4c8d809aa4c8eadcdf781d9096cc
SHA512 69c01a549c00cc95ff9929ccfdb9f188a62cdd60b01385f7e2bb0c226638077bb50fccca734d7401d70e34b161c4d96216aedfd5c10e2d1fa33d78382b18361d
SSDEEP 49152:K1H9c6+6nhTmPmgl3eBlQ7zqSqqqKmddAkoJ0XovHbeQwdY+mmoVe8vqTUvH3Kg0:OdwKOVGAu4P8
MD5 SHA1 SHA512 SSDEEP

Download

com.skymobi.pay.plugin.main.apk

Path /storage/emulated/0/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.main.apk
Size 59KB
SHA256 09a1eaa8ea5844ad9fa0cc8ac61848ad769d62bf90fa9b15d2aa21a9fc593413
MD5 af3d9be42c31205f5c5835876219a080
SHA1 94ee91f71c77d45efcbc3a5b41c1153b9eff2bf4
SHA512 51903ef751775c31e4a1f5f1190deaee2d50c93d5e36968045c67e446c7545c1cb12f26575e9d741a258a5882fbe357ac1657f18b9eca995bd533700828eeff2
SSDEEP 1536:+wSyx28ZQi8KwGltzgA4iPBUFOIWGpJj3CqgOwETU+gI9nuTk:+wnx//DwiSGgOW7Cz9yb9nuTk
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.skymobi.pay.plugin.smspay.apk

Path /storage/emulated/0/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.smspay.apk
Size 248KB
SHA256 229dc2c46231d85e6b4298f7e6a067df9840c754d4b1440e2e9594f92d000040
MD5 f7b9113f2220d0c9bafb01c3c1864e5e
SHA1 40e8abb05c69f87a9e4e723885e6855d177c44e5
SHA512 7342091212a23843a2d5d4d9ef18d3aeff8d3c27657f4ece882f0a90844c00ee6b6179de9c750c3050468ed3aaaff46c37f6b966110b65b22c59330d2f614756
SSDEEP 6144:M5djDaCE+IKyOhmkHkj0cCTfT/YPoUt75p3KV8zaqqD1:AzE+aOfTOZtFxaDD1
MD5 SHA1 SHA512 SSDEEP

Submit Download

channel_conf

Path /storage/emulated/0/Download/channel_conf
Size 5B
SHA256 e929c4872d0dfcdbcb3569aaa7e40e0c89ce98e6f4a54c42f0733c70583556cf
MD5 30e78bbe90e4fa00b725dbc54f11cf91
SHA1 2123ba3a00b9062073322d3987a520f7925f725f
SHA512 d0e73afdfb7a435f85c478349708ef6a2d8bd3c1a0d5348413c5239208af530293525c2845b137af6c31b8dc870ffc79552ed2c7aa0bc65cb2da205423b5e515
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads