e5e17f18f71f610707ab2aa8ad4fd3949c5fb53a9b136bd4f97820e73104188f

General

Target
b8067342244d2b1b17ed380923e713a8_JaffaCakes118.apk
Size 263KB
Sample240617-l1fqjazcmp
SHA256 e5e17f18f71f610707ab2aa8ad4fd3949c5fb53a9b136bd4f97820e73104188f
MD5 b8067342244d2b1b17ed380923e713a8
SHA1 c7f07a5c867e4535376ed22e0668bfb08d4f982a
SHA512 c7a3c2995dad04990b7e2a95f7014ecd50c74324fd68da7668285841a6a44992f419dc58abf69bc08ac0c60d21268fd20e697ed43c25f4604d82ae718c5a1693
SSDEEP 6144:aPNvivXSCeVvnD2IJOsBFaw4IzEsS/ZXBc2Y4MT5fNt:Ei6tQIwsBFa/IvcR9Ut
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection credential_access discovery evasion execution impact persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4498	com.osaka.dwriljr.iejqpiinuwfyrap

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.osaka.dwriljr.iejqpiinuwfyrap/app_tfile/fields.jar	4498	com.osaka.dwriljr.iejqpiinuwfyrap

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.osaka.dwriljr.iejqpiinuwfyrap

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.osaka.dwriljr.iejqpiinuwfyrap

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.osaka.dwriljr.iejqpiinuwfyrap

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Schedules tasks to execute at a specified time 1 TTPs 2 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.osaka.dwriljr.iejqpiinuwfyrap
Framework service call	android.app.job.IJobScheduler.schedule	com.osaka.dwriljr.iejqpiinuwfyrap:guard

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.osaka.dwriljr.iejqpiinuwfyrap

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.osaka.dwriljr.iejqpiinuwfyrap

com.osaka.dwriljr.iejqpiinuwfyrap
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries account information for other applications stored on the device
- Queries information about active data network
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:4498

com.osaka.dwriljr.iejqpiinuwfyrap:RemoteProcess
1⤵
PID:4546

com.osaka.dwriljr.iejqpiinuwfyrap:guard
1⤵
- Schedules tasks to execute at a specified time
PID:4875

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

1

T1603

Persistence

Scheduled Task/Job

1

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Hide Artifacts

1

T1628

Suppress Application Icon

1

T1628.001

Virtualization/Sandbox Evasion

1

T1633

System Checks

1

T1633.001

Credential Access

Clipboard Data

1

T1414

Discovery

Software Discovery

1

T1418

Security Software Discovery

1

T1418.001

System Information Discovery

1

T1426

System Network Configuration Discovery

1

T1422

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Clipboard Data

1

T1414

Stored Application Data

1

T1409

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1

T1471

Data Manipulation

1

T1641

Transmitted Data Manipulation

1

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

fields.jar

Path /data/user/0/com.osaka.dwriljr.iejqpiinuwfyrap/app_tfile/fields.jar
Size 138KB
SHA256 e900cb4c3fe9d8f45196a7457e9645c65b0f3cde820f4161950252cff67a4d97
MD5 cceb8db3b057d24673d49eda229e9892
SHA1 b18f6353b2156410249079a3b7b86ef3a530e8ee
SHA512 4a42cde3165a706e823caa1362001ed8aa647caf22325a4f2554c64fc4ebcd79afe44fe5eab5474221806f26e7aca9d2901026de6e597ef62fe867f123e4bd57
SSDEEP 3072:KmCi2YMNjc0deii5lYQWVS75lpPQ8NR3h/EiVxqgtp:PCZHZpeiYoVoy8NR3h1VxbX
MD5 SHA1 SHA512 SSDEEP

Submit Download

fields.jar

Path /data/user/0/com.osaka.dwriljr.iejqpiinuwfyrap/app_tfile/fields.jar
Size 281KB
SHA256 52132037e9b950a9cb48d6374ee2c6747a6bfe776e13a726395771f1b40ee9da
MD5 73b11c4c10150bbd4f29ad012dc11dde
SHA1 65c83ad32c29f9811c32eda75d7fcdc92ef42dda
SHA512 3e53b1ee22a00e60896da86d2695195e0965c93d190c4d1c0dba2eb5c611d670ee7693a9f8756858255e2b170cb82a753719dd4d6a827af437309b7a1dcc6f01
SSDEEP 3072:1pvE7Pwv2RBvf6O6V/xmK/EOrVLH1QhVHM4e1rSZV7IPelASJ0XQlb0rI5cVgZi7:LdUJaxyOBLejirHqxJQrBXRyOpd
MD5 SHA1 SHA512 SSDEEP

Download

tbcom.osaka.dwriljr.iejqpiinuwfyrap

Path /data/user/0/com.osaka.dwriljr.iejqpiinuwfyrap/databases/tbcom.osaka.dwriljr.iejqpiinuwfyrap
Size 36KB
SHA256 5f49bca53de766023101cc1ac8dda79a83c485fce8d9138452b39d1853d2fe0f
MD5 ebfd4869bb86abd638bc48b891f3e1c8
SHA1 a27f262fe7a41ec9976d457416447f8b78c80e03
SHA512 062fd15e0a34619071834f2d81889e6a100c3a707e53621b16d584182a57c690f6a24a73e19fb77678d857fde477935811a963998a73d7ffe971d6ebd9cafb07
SSDEEP 24:TLCOfl8M/LxIx2pq4WwHkuEHV6psLT0vGSgIQQ:T3GqdIgpT1EHV6e8eS
MD5 SHA1 SHA512 SSDEEP

Submit Download

tbcom.osaka.dwriljr.iejqpiinuwfyrap-journal

Path /data/user/0/com.osaka.dwriljr.iejqpiinuwfyrap/databases/tbcom.osaka.dwriljr.iejqpiinuwfyrap-journal
Size 512B
SHA256 f88a5275b5f05be91d10406e72dd4e5b375d9466bcde8a6624595156960e304e
MD5 d3d8fdc487bc3308345e5d3ffbf5c540
SHA1 49fea1fd49e3c25e678aa8fd39ebe18d3b8dee48
SHA512 a7d4517903c37f8b39052b2c6c70f9f53b80b380dac6c9facb9b6782be6ebc3561607169eb2a65b718ff62ef6e8e7b298a37aca2974fb0ecf6cce95f276c7281
MD5 SHA1 SHA512

Submit Download

tbcom.osaka.dwriljr.iejqpiinuwfyrap-journal

Path /data/user/0/com.osaka.dwriljr.iejqpiinuwfyrap/databases/tbcom.osaka.dwriljr.iejqpiinuwfyrap-journal
Size 8KB
SHA256 d8614c8750849fb64f3bc49cb62961b879d56b4019caa1474fe676f0f25c6481
MD5 9656ef0579b3c3cecfdad04edb17422f
SHA1 97ea2321a91cc4d48cea7a6c8320bbb85cbea850
SHA512 cb41e4ffab054922e743129e65d1e9a7d7447f4e26c592adc8f29866d4726f3593f5ab75bb5d0227e3473fe44f106eda37ecd7afea470ded02f22d2f6fd2612e
SSDEEP 6:7+/l9VI4n1aRg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKcs:7+tMRqLiuWdYRmBEyPb7s
MD5 SHA1 SHA512 SSDEEP

Submit Download

tbcom.osaka.dwriljr.iejqpiinuwfyrap-journal

Path /data/user/0/com.osaka.dwriljr.iejqpiinuwfyrap/databases/tbcom.osaka.dwriljr.iejqpiinuwfyrap-journal
Size 8KB
SHA256 6ff8a7e202ec55be9c4da0cf401d01dbddaa3c68f6fdd29628d83c6dbcf50d59
MD5 8eb2236b956add33066fea6764e63df3
SHA1 e00830e030e3d831688af606d96e6a82c762a65d
SHA512 f71c1edba9d762dd81a1977d87ddd3975e695ad96aeacb0b1bb8276d303b7dc424232eb0b578a6f1444e8a9246a4d671198ec5c40b896dd181d324969e7bb734
SSDEEP 6:7+/l9wjTPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKWU/uo:7+tYLqLJdeWRmBEyPbH0n
MD5 SHA1 SHA512 SSDEEP

Submit Download

sdsid

Path /storage/emulated/0/Download/sdsid
Size 4B
SHA256 fe675fe7aaee830b6fed09b64e034f84dcbdaeb429d9cccd4ebb90e15af8dd71
MD5 b8c37e33defde51cf91e1e03e51657da
SHA1 dd01903921ea24941c26a48f2cec24e0bb0e8cc7
SHA512 e3d0e2ef3cab0dab2c12f297e3bc618f6b976aced29b3a301828c6f9f1e1aabbe6dab06e1f899c9c2ae2ca86caa330115218817f4ce36d333733cb2b4c7afde7
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads