5ad64a6117b913444409c5a50500d8cadcab23acca6b08e100b379308dcc738f

General

Target

17b550b857afa34e22de97352e5e4bcc_JaffaCakes118.apk
Size

8.5MB
MD5

17b550b857afa34e22de97352e5e4bcc
SHA1

023d949c000d3f2a4ca8175e5123e5fdc81e0bdd
SHA256

5ad64a6117b913444409c5a50500d8cadcab23acca6b08e100b379308dcc738f
SHA512

175934d6d62c4c3d8d0b85079ed092413fcf9740c127405d1172450866f57f6b8ad5040aa9282a0a0a878ff29c78011f6cdd03ad17ab5324850889242bbc3368
SSDEEP

196608:lEnQbsmMdsETgq+6dDylRy9ErsGsS50IQ68k0w4IiqNJ758kApL8u:uQtdEsqxyLy93S50IQ68k09IiqNhCTz

Score

7^/10

banker discovery execution persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Acquires the wake lock 1 IoCs

Processes:

ir.barfin.anvashirini

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	ir.barfin.anvashirini

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

Processes:

ir.barfin.anvashirini

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	ir.barfin.anvashirini

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

Processes:

ir.barfin.anvashirini

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	ir.barfin.anvashirini

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

Processes:

ir.barfin.anvashirini

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	ir.barfin.anvashirini

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

Processes:

ir.barfin.anvashirini

description	ioc	Process
File opened for read	/proc/cpuinfo	ir.barfin.anvashirini

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

Processes:

ir.barfin.anvashirini

description	ioc	Process
File opened for read	/proc/meminfo	ir.barfin.anvashirini

ir.barfin.anvashirini
1⤵
- Acquires the wake lock
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4242

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

1

T1603

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

Scheduled Task/Job

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Discovery

Software Discovery

1

T1418

Security Software Discovery

1

T1418.001

System Information Discovery

2

T1426

System Network Configuration Discovery

2

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/ir.barfin.anvashirini/databases/__pushe_base_lib_db-journal

Filesize
512B

MD5
5be833c12f308cf45ea48ca22b9781de

SHA1
4eac8cb42ab8ef1bf5b5526ab518715fa011ffb4

SHA256
7adac1d68848d65a7df2b5118b0f43bdaf32c8287a713e791a854bc5c1f5904b

SHA512
29caf10d040a2af7080d60cd2275b733e6801e1e988bc0f80b65f4b406c93e7d01bbc1f5e8d472c93c11faa10fa28dab2a0116585615a226ca5ce625d79d1408

Download Submit
/data/data/ir.barfin.anvashirini/databases/__pushe_base_lib_db-wal

Filesize
96KB

MD5
529c5bf81fcd7c190e3637bb1bcba200

SHA1
c62b7a4789708b598b3bab11b3308a55953c07ad

SHA256
59da961d7e4a424a09d0f40d0e467faf48d0143e829cf9d73069c9d46eb6de65

SHA512
20f69876636ed3d09b5e8ec4fae09298c0b4400c56194e5ac0497fbd3bdb3dca7486f00c5d9e86d9da369837ad4e3691a8e68fcdc2930ca991c3bc9962f4fdd8

Download Submit
/data/data/ir.barfin.anvashirini/databases/evernote_jobs.db

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/ir.barfin.anvashirini/databases/evernote_jobs.db-journal

Filesize
512B

MD5
c40ff8ef7fa8e181a45f52e969634fef

SHA1
3837f2f746a0113a52621af05cdf9e01d5865a9d

SHA256
0b26214ba279259b554fcbfa0d117d1807c9cdc7db9ff5a68a51e43428332cfe

SHA512
5fc3d295dafd2217648827dbd919da62b96870bbbe30fea2723fd07eda29d54a2a8ceb44fcfb2a8ad5ba9010a02f51a3f98c47806a2240e32f026c4359154ff7

Download Submit
/data/data/ir.barfin.anvashirini/databases/evernote_jobs.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/ir.barfin.anvashirini/databases/evernote_jobs.db-wal

Filesize
84KB

MD5
844063835fe107f9055d9c7c6d81e1a5

SHA1
89107fef4be93dd1ecd05636a86704a7a51fba51

SHA256
1a22dd8b22b5d5382fe8f296bd0ea08e042d4ba444565d475d24178f3635289a

SHA512
2bd7f91ef89e21ac842d27810940e838f25c08329c09ebe2ac20f883f37b20349558cd8c189e025adbda4e2dd4522c002c21f93c36680d29cd6980ba50c1fe81

Download Submit
/data/data/ir.barfin.anvashirini/files/unsent_requests

Filesize
58B

MD5
0d210bfb2a0e1f1b4c082a6a0f79de07

SHA1
bb8ed9e364db79d1d9f2fcde3f15091893222faa

SHA256
988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d

SHA512
536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads