5bc35ae0a77f6a4e475a5fa05e5436d6ce070ae107389aa0525f4341d240a9fc

Analysis

max time kernel
179s
max time network
138s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
29/08/2024, 08:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c876c947ea7f8dfc3c5dc4df0866c609_JaffaCakes118.apk
Size

22.0MB
MD5

c876c947ea7f8dfc3c5dc4df0866c609
SHA1

590e3388a9187b527b2e60e78ba7316e63337c55
SHA256

5bc35ae0a77f6a4e475a5fa05e5436d6ce070ae107389aa0525f4341d240a9fc
SHA512

b771d233f605ed244680520812cef6d8cab9b7b5252a18e36fcdfe875eda2a240fc045d8c62dca7aae61dd54d2bce9c45980ce860467f20029489e44d0b09f3c
SSDEEP

393216:80nvTACGbQfKBvdMlt973blGIszoxOKUPkiNX8snBvCNciQiDBtuHsi:tvT3GsCBvdMf97BfUsKvCHWHsi

Score

8^/10

banker discovery evasion impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.secondarm.taptapdash

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.secondarm.taptapdash/cache/1582435991586.jar	4515	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.secondarm.taptapdash/cache/1582435991586.jar --output-vdex-fd=198 --oat-fd=199 --oat-location=/data/user/0/com.secondarm.taptapdash/cache/oat/x86/1582435991586.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.secondarm.taptapdash/cache/1582435991586.jar	4310	com.secondarm.taptapdash

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.secondarm.taptapdash

Queries information about active data network 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.secondarm.taptapdash
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.secondarm.taptapdash:service

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.secondarm.taptapdash

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.secondarm.taptapdash
Framework service call	android.app.IActivityManager.registerReceiver	com.secondarm.taptapdash:service

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.secondarm.taptapdash

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.secondarm.taptapdash

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.secondarm.taptapdash

com.secondarm.taptapdash
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4310
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.secondarm.taptapdash/cache/1582435991586.jar --output-vdex-fd=198 --oat-fd=199 --oat-location=/data/user/0/com.secondarm.taptapdash/cache/oat/x86/1582435991586.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4515

com.secondarm.taptapdash:service
1⤵
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4345

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.secondarm.taptapdash/app_Parse/installationId

Filesize
38B

MD5
cf73006bcb32f7761776d6d67e000e87

SHA1
5c36182fc28046bee287c562daa9c41141419d92

SHA256
a3dd71cfd1cc58f519c5cebe78df58a40d6f1e1de66412951d1c172074ca397f

SHA512
40e90078ad3eab297c30612ba0a4a0c09d2374156d7c60b6bafbf39961ad96ca0e07ea5db2e1a3b3f8a84bf8aea8b9a3c5afbb78a943893926c03872f1666f96

Download Submit
/data/data/com.secondarm.taptapdash/cache/1582435991586.jar

Filesize
9KB

MD5
e8e0527a01aefdb89afd2c508f131da1

SHA1
f1103e6b260c657ceb3d95f1b023af3fda8b133a

SHA256
f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce

SHA512
fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34

Download Submit
/data/data/com.secondarm.taptapdash/cache/com.heyzap.sdk/entries.json

Filesize
26B

MD5
9abb23440eb098329d40e2c2ab91f020

SHA1
3f804b1a0b720796c9ba9e9e4365f31094c51b24

SHA256
619232d578647cd5da389f8f52723df7347cbace501fdd160869ec53addfab54

SHA512
0ee0813d36e7e060fc2b6f48acd10c7ddd1eace15cd39daf4903d91382a00b6aa9199be424c13bc1bb420689cb57904a90c77aefcb4bad1605045eb6d24151e2

Download Submit
/data/data/com.secondarm.taptapdash/cache/com.parse/applicationId

Filesize
40B

MD5
755f2ab578c203e0a125b89d7c227c00

SHA1
10b9926fadfa088513d3de42593a35bd92d4e6c8

SHA256
3b3200868fb359b08e668f2e9912bd6527738beb9689b225f4357548a6510c64

SHA512
ee25f387fc6ccb2b66f2320f67e45c2c6fab27ddd91f9a2c1666fa65d2771d1e537f6abffdba88c10f68dd1b4fac66cef571fa0f34ddda2252585eb047ff74a2

Download Submit
/data/data/com.secondarm.taptapdash/databases/google_analytics_v4.db

Filesize
4KB

MD5
d304741e488b3294a420d9ab982233fe

SHA1
272c278784acbd3199b1204617916b5943915218

SHA256
a299d7ff573af48acd49f9983fa9de598e99e7dae5d0996f6a1e82a59fd5cc79

SHA512
5cac4fe7278b14078de333e179f021e34af7e7bbebac4f414d6875940d524187245ce330db75423fa2534ffed9f20ea76e226a35bb3f1ec945e13fa465d2110e

Download Submit
/data/data/com.secondarm.taptapdash/databases/google_analytics_v4.db-journal

Filesize
512B

MD5
314004415a443275f2bdf4c7b0e27b1a

SHA1
0bed0abf4bc09ec2d8e76ba8e7aec4bd1e353e1f

SHA256
2f856d6ff2a6ed296502f5087c13cbad6a08446dc94e9e61a8f9849fdb8c3824

SHA512
f1d312160aab28bf1ea9b7e01cbec826e9444a4b02fc3fb9ed03d854f8530613f183ca9f7c657710c34defb9d7e55b218a2d30a1c69fa4c1e39cc3a5db4d75bd

Download Submit
/data/data/com.secondarm.taptapdash/databases/google_analytics_v4.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.secondarm.taptapdash/databases/google_analytics_v4.db-wal

Filesize
52KB

MD5
93b0995e0716db06a6f127d6a1b0d212

SHA1
3a35f9331cdc55ece317d9cd3265794c5e8d1f6a

SHA256
d6b8ee462b273b4cd15862d342a315701f38dfdfbe800d0ede5a58bda44a454d

SHA512
987e30c2f5047459dc02dd756094e3972617d76b985f2251f580abfa4ab411e93b54fb2c4290d33a850b85255dced730b7519022d5ef3bf11ced38f713276c83

Download Submit
/data/data/com.secondarm.taptapdash/files/.YFlurrySenderIndex.info.AnalyticsData_JWSMRPCKFVG83C9ZFYDD_211

Filesize
88B

MD5
6699ca6300977f6d80567425bf344eeb

SHA1
e9a1578f6d8e9fcf605d2cddcf1cf849d8ca2806

SHA256
1e944090f01d38636b326362ec851af1d579c9e0e16ff7372ab9a1d1ce0a99cf

SHA512
bb806edfa6b0088d7ebcd913a8a7a6a9b55480fece40b55ccdbf52bb92eab3fb9a9b93f4e5cf82fdb5ce3056bf0e0049294b36d0afc87603036195686c87a830

Download Submit
/data/data/com.secondarm.taptapdash/files/.YFlurrySenderIndex.info.AnalyticsMain

Filesize
72B

MD5
e6ab0c491832e46f1a0806a071c17085

SHA1
82402cebde95c3bc122ce62c3f7e38ba27ebb941

SHA256
0a95663388533d88401025d64e944d7196384bd750fd28764c6071b6b081e443

SHA512
59523673121682886e2e63f4ccd63efb6ae8174c1e932c8256f70171f46c05c54daaf1e79102fdf689d046125a8ad9eb82825808b9b9b59c95da27d31766ca6f

Download Submit
/data/data/com.secondarm.taptapdash/files/.yflurrydatasenderblock.05576617-3a1b-4e43-8201-a4d123cce526

Filesize
334B

MD5
e0c4d73833697976b91ab3343ba352c8

SHA1
dcfb5c03266b69aa2e6ba460a0a0a5422c12805b

SHA256
df404b138d8e339429bb34d518b2c349f8eca14307ca20b07bed4a1355aa0574

SHA512
690007cd5732c8453ebdd48436f2a25c22ee5793471f75ec172e2374b9b9dcf6664f70a6a30f8b03b298f4b52375422d514d92eca0b6793cbf3d85c702563a39

Download Submit
/data/data/com.secondarm.taptapdash/files/Chanel.dat

Filesize
38B

MD5
25b73c3e42217b09ee064c4ae7ba15e7

SHA1
97b2aa5cb739df7abc9bd19ef6b8cb08893ace38

SHA256
8ccd3a1a53d7ca7e4e2de205a9a66325384c242bd6a16f7f8eaae927ce3cdbcf

SHA512
19cb5a74eaaeb9999d964d609bb95bc9af5a45837bb26a76118fea49a781ab681fc8f7f86d381e57cc4ae25e5fcee4500727866049d5afc120d1caa915fd4723

Download Submit
/data/data/com.secondarm.taptapdash/files/drptcache/common/103-a41ba1fb-66d02d6f-2.ich_tmp

Filesize
17B

MD5
1af0dbf45402d99084af5e93c240af21

SHA1
c1e1f23fc31bbd00224d42b17360c381962fee69

SHA256
c1129c533da327a31f7bd2cd30ab8afe51c3a607f739daaa21d3be05b645af19

SHA512
fbfa4ecdfe566ba00de54fc5a16dee9c45e47db342195974a56ecdb5aef0bbc8b8f88ca5ee1dda5a1ce0e9cdb0299c047598013957f264573dae0daffbd411d3

Download Submit
/data/data/com.secondarm.taptapdash/files/drptcache/common/103-d9249493-66d02db2-5.ich_tmp

Filesize
17B

MD5
28f6d9e2341002566a0a822dcfc4768b

SHA1
22e501cf9f0e0edb1c9b932d047b97c38b0586d3

SHA256
1eeae5d282bbf2a38cc0ea7c6642ab4a5f5b1176092ce707c9101f77df376199

SHA512
744f2cc97dd2eb059a5be606bad3b8646375cdef928c481a2e9d639e83d6b1785f884b1982ae9406277ca2c2b243082929fb83d85efcb4ffbab0372137fe5c70

Download Submit
/data/data/com.secondarm.taptapdash/files/drptcache/self/102-4d37521b-66d02d72-4.ich_tmp

Filesize
48B

MD5
bf00f48b1e321f1395b3e69631dd7dee

SHA1
315929cfdfd59b3dc4e83487e41b8ab18820c312

SHA256
775665c737e90bd09861385849b9ee317c0c2ca7945cc6c7c3578922a567a13c

SHA512
e40fd89700b89a3bad55f0cbb346fd7327f2ab805926e1d3b0acd0d1792de070dd3f2c4c65ebd0a47914fb200e445c1fc97d20634c793350699f73ed986a0c9e

Download Submit
/data/data/com.secondarm.taptapdash/files/drptcache/self/104-ede7cda3-66d02d70-3.ich_tmp

Filesize
45B

MD5
d29d064dd90b3878be5b86bf067d1c70

SHA1
91b5d93670cdcae5d347d78eea52e80dc73cabf4

SHA256
3325444a1248ec40bb1c673301c5eac9ecab7ff5be8f2075be4886df24c7f0c8

SHA512
3d94ba418a158b844e1fefd9358df2bf818c9052cfaa7ccb3b00af7ddbac6e88f9a6d7a0597ca9fec215a88c4aed7c294f37e89ee6c55ae68839ecd7d6f19697

Download Submit
/data/data/com.secondarm.taptapdash/files/pnofb.png

Filesize
6KB

MD5
4c21a4ae77f1608be7a249c59f20d48b

SHA1
9cea951cf96fb41cdf83c682d74d34c27098fc8e

SHA256
78fa11a9707a333d30f9945b725d3601d29aafba1294df39ba5c66113b0c6622

SHA512
18310e92fa27e2f08436349b73a94c14e7c2ea7ab7727ae0fa335e4b145ae5c6febaf38c0dd5aff8edecdeeb35f22626ffbb228284df07f8a7ffdee4b4254dc5

Download Submit
/data/user/0/com.secondarm.taptapdash/cache/1582435991586.jar

Filesize
20KB

MD5
2048eb6124a452540ee51dae4145aadf

SHA1
d05005b2cd7fe4cd652b0d7fd1bdac2c19d51451

SHA256
105c54b6fe3f25350e92187467761598e4c21d62b1091b77d091f65f3bd98864

SHA512
bb6cb3853dd2a5d0701e20607d4e153ae201268dd2e5e2d06cc2df208b3b4dc50132a4ab428251b1644d2399fcc717662438d082ff14203387bab8794109d44d

Download Submit
/data/user/0/com.secondarm.taptapdash/cache/1582435991586.jar

Filesize
20KB

MD5
fde2ee00cbd121cfab5290b078aa3ceb

SHA1
e2b77d5320e155e413d040a8c20020962065b2f8

SHA256
2897b0812077c654a9b3fbb0b6303d5cde681eeba7ad9981de65716c7810d685

SHA512
a9326aff8e454a2b4ac09984ef2a65fddd4dc146b4c44d839035549bff8c9fdaae490326d0b018f76c1ca2e4fb25426d74f550ca0950982fba632a023af99a56

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads