Analysis
-
max time kernel
8s -
max time network
131s -
platform
android_x86 -
resource
android-x86-arm-20240611.1-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system -
submitted
18-06-2024 11:47
Static task
static1
Behavioral task
behavioral1
Sample
bbc39f755b123ae1d1a2f8ed279badd3_JaffaCakes118.apk
Resource
android-x86-arm-20240611.1-en
Behavioral task
behavioral2
Sample
bbc39f755b123ae1d1a2f8ed279badd3_JaffaCakes118.apk
Resource
android-33-x64-arm64-20240611.1-en
General
-
Target
bbc39f755b123ae1d1a2f8ed279badd3_JaffaCakes118.apk
-
Size
12.0MB
-
MD5
bbc39f755b123ae1d1a2f8ed279badd3
-
SHA1
f86017a9216932f636e01cb89e53e2b707573311
-
SHA256
3f8f6d307ff497b21fa48ecef396bd76e632f2fc7ac3a2f6963d737a9d5608bf
-
SHA512
1e87bbad29d0fb84fba00cb5fcf7c08aeee9886d99651773c374d1cbcf9d8cf00b7645e34936d0cd7a37857c195d514b7e0940373da83e79e8b21acb205afeaf
-
SSDEEP
393216:uYPRKNBATQF+pTvvtgmSnJyUuWaDPL/JYUQnLe9gROrksK:pPwN60F+hvvthSnJyUuZDPL/J3QLeOOQ
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 2 IoCs
ioc Process /system/app/Superuser.apk com.mobile.kadian /sbin/su /system/bin/sh -c type su -
Loads dropped Dex/Jar 1 TTPs 5 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/data/com.mobile.kadian/mix.dex 4262 com.mobile.kadian /data/data/com.mobile.kadian/mix.dex 4262 com.mobile.kadian /data/data/com.mobile.kadian/mix.dex 4365 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.mobile.kadian/mix.dex --output-vdex-fd=50 --oat-fd=53 --oat-location=/data/data/com.mobile.kadian/oat/x86/mix.odex --compiler-filter=quicken --class-loader-context=& /data/data/com.mobile.kadian/mix.dex 4262 com.mobile.kadian /data/data/com.mobile.kadian/mix.dex 4262 com.mobile.kadian -
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.mobile.kadian -
Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.mobile.kadian -
Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.mobile.kadian -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.mobile.kadian -
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
description ioc Process Framework API call android.hardware.SensorManager.registerListener com.mobile.kadian -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.mobile.kadian Framework service call android.app.IActivityManager.registerReceiver com.mobile.kadian:pushcore -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.mobile.kadian -
Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.mobile.kadian -
Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.mobile.kadian
Processes
-
com.mobile.kadian1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4262 -
/system/bin/sh -c getprop ro.board.platform2⤵PID:4294
-
-
sh -c getprop ro.yunos.version2⤵PID:4313
-
-
getprop ro.board.platform2⤵PID:4294
-
-
getprop ro.yunos.version2⤵PID:4313
-
-
/system/bin/sh -c type su2⤵
- Checks if the Android device is rooted.
PID:4346
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.mobile.kadian/mix.dex --output-vdex-fd=50 --oat-fd=53 --oat-location=/data/data/com.mobile.kadian/oat/x86/mix.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4365
-
-
com.mobile.kadian:pushcore1⤵
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4437
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Execution Guardrails
1Geofencing
1Hide Artifacts
1User Evasion
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
120KB
MD5410301444adb7b642d603f548b7f7606
SHA17750a42ac40b3bfbd81c38b1601bc9820a33e05f
SHA2563d99637597dbdaf8ccc35daf6a10e2f857b5cf0c21bef802b99cd3486e8f5c10
SHA512431b68e167b84dd099bfc446b6a53af91f9b2ef0363cc63afc754d88862c079b6cbd70d2c90cca8221d992695961603770fcbee7daadf0035403aeb32d25b2c4
-
Filesize
28KB
MD5cf845a781c107ec1346e849c9dd1b7e8
SHA1b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA25618619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
SHA5124802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
-
Filesize
92KB
MD5506406bb68fa2fa3388786ab5c20305d
SHA1e2d5ef60c2b6e7243fa9b90c453337c84909adbd
SHA2565b920f4b559d9ed28e1ab55ba0184941b9f8f76c4041487c4f6dc2a836d5ab99
SHA5121013fcf17a2af3e34d1569f02a8af8f0a23959e1d8509ab746a737d1ae85d105e6e9b0379eed9821260d9b45cbd20cf4e17619184f2f05d8daf3c3c60175714f
-
Filesize
292B
MD563f77f99bd2c2b772a479923bde11974
SHA1c7632e7d301e4463fafce85f84e9c3d7da3fdbbe
SHA2564c76a3af64cdd2f8713ffe2733dea50dbe714d0ca41c17d1847ee5b62a7ca615
SHA5123aae4a89d1ed51fdd911cb367eb10afe3c2264e4222085891b18a60d5412f85d10bf5c8f3c6642db70abb9aa42732bac5c42c42ee32d587100f53c21b5beb16c