Analysis
-
max time kernel
179s -
max time network
131s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
28-07-2024 01:03
General
-
Target
0463719b17d6d11d364aefe067669468_JaffaCakes118.apk
-
Size
4.7MB
-
MD5
0463719b17d6d11d364aefe067669468
-
SHA1
e7dc170ecb885081a95c9ca6940bbb2b8c6d2ae9
-
SHA256
afe9d5ea1d5b43b83c35ec40464a1dbe05ffeb563c059cba0b8e153a90d87e08
-
SHA512
b97a43174028b3ded889f0f3c77947b847da2a45d81a8fd03b4057c7e1f3c3de91488c3c85beb99ecdca55ed55669e6418d05cc1b653676cd4a1afd1660aa8f7
-
SSDEEP
98304:38iFw0+DXKG6sgZOkLQphj3vmw+v+wzQNqttVbvqZKfGgp4JI:3B+7KG6Z4hrRe+wzhFbS4f4O
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra payload 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes
-
cxu.smnlgnhuqdihggdl.oxynkjgraxubptjtmitri1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/cxu.smnlgnhuqdihggdl.oxynkjgraxubptjtmitri/app_DynamicOptDex/yWmxt.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/cxu.smnlgnhuqdihggdl.oxynkjgraxubptjtmitri/app_DynamicOptDex/oat/x86/yWmxt.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD541156a29a9b3ff50a9c06b0369558498
SHA12e72c80abbe517cc29609de4b18f2fd8b12e75b4
SHA25640e05f9dafb3e9ae2ca546758a8d74536aeee4245f6ae986ca3f176f235e6864
SHA512d4b0492672c1d27f8970b3aad7dd051f47d5008f66691b051f7fefb7d4946dea6ec2ab5484edfbb8416c7814bf8458bc6d61ba20d193104bc5f939fa868c9891
-
Filesize
2.9MB
MD50cb066c7a2a1249ee30d8b90b238402a
SHA15cbb73cd307d5c0ee7103fdd999bad8a46ee7bd0
SHA2562f6bd86c2b5b099e103dd4bce68a6381168252c2cc79877f6f98bc22c9ca452e
SHA5120f322b15d2118a5956dee6996c8eeeba704595e04de3f7196a3f64f2204cb430f257bb0c46242d16e9d9a6b6cf3e36888849707bbceb89fe25f9269ee677eda5
-
Filesize
2.9MB
MD5af3ef3631ec1dfc409b5b6386931ea4a
SHA198bbfc27653cbef6dd710ca9bcb3d99c4f650993
SHA2569016b8bd33393af5e6ae56386513afa0f67f6a664ad5f9f121895a76af963e80
SHA5123af0794561a7bbd07629c3a59c3205465e7c74d90f352fd1f5eb259ac32f13111f9cef80960348ba11b705f75c0cdcc91edc80a83b46df19e2398c526a409e7a
-
Filesize
2.9MB
MD5318f448d9dae827d475c6347a8e34a54
SHA1fc9639e79e4470bb492cab565c8e54e9f5accbe6
SHA2565593acd8257991c66f847229c58252c189e614b2f593f97640d870a19080988d
SHA512dfa5c9855dffe3b3b7321fe0f82234d883f33ad1067881b42419c6fed88b91c36e72a697bca8e82246a1202084cfa1c0455bf0402cda7eaf504c41c05ca12b0f