a5ab3c0eac6ba2a764bafe24e4e6d4cc262b26b22ab0e3b52b24786cd5cecbaf

General

Target
ca03ff5d0ac8cbfd8a0d4faa8e318adb_JaffaCakes118.apk
Size 271KB
Sample240830-b8w3dashnl
SHA256 a5ab3c0eac6ba2a764bafe24e4e6d4cc262b26b22ab0e3b52b24786cd5cecbaf
MD5 ca03ff5d0ac8cbfd8a0d4faa8e318adb
SHA1 82310aebfaac5a515c7b603144cc05dcc21579f1
SHA512 c3a226cf3031fc9a645c185ed93b381cfc8e0dd1328f376615bb6c628157e6bfb55f22cb3b4799876f2da2e9f3ca2e485fcdd4723adbcfd7ca6babcd2a5f780b
SSDEEP 6144:u2IuwTsBRA3mnpcABMLe0HQ0NEKq/ZaRaw4IzEsS/ZXBc24nS5fNf:8TsbHBMLeH0NCYa/IvcR8nKf
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection credential_access discovery evasion execution impact persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4477	com.Bangkok.kmarij.cgvjqszv

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.Bangkok.kmarij.cgvjqszv/app_tfile/fields.jar	4477	com.Bangkok.kmarij.cgvjqszv

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.Bangkok.kmarij.cgvjqszv

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.Bangkok.kmarij.cgvjqszv

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.Bangkok.kmarij.cgvjqszv

Schedules tasks to execute at a specified time 1 TTPs 2 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.Bangkok.kmarij.cgvjqszv
Framework service call	android.app.job.IJobScheduler.schedule	com.Bangkok.kmarij.cgvjqszv:guard

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.Bangkok.kmarij.cgvjqszv

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.Bangkok.kmarij.cgvjqszv

com.Bangkok.kmarij.cgvjqszv
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries account information for other applications stored on the device
- Queries information about active data network
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:4477

com.Bangkok.kmarij.cgvjqszv:RemoteProcess
1⤵
PID:4527

com.Bangkok.kmarij.cgvjqszv:guard
1⤵
- Schedules tasks to execute at a specified time
PID:4850

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

1

T1603

Persistence

Scheduled Task/Job

1

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Hide Artifacts

1

T1628

Suppress Application Icon

1

T1628.001

Virtualization/Sandbox Evasion

1

T1633

System Checks

1

T1633.001

Credential Access

Clipboard Data

1

T1414

Discovery

Software Discovery

1

T1418

Security Software Discovery

1

T1418.001

System Information Discovery

1

T1426

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Clipboard Data

1

T1414

Stored Application Data

1

T1409

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1

T1471

Data Manipulation

1

T1641

Transmitted Data Manipulation

1

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

fields.jar

Path /data/user/0/com.Bangkok.kmarij.cgvjqszv/app_tfile/fields.jar
Size 146KB
SHA256 019feaf1e8612507b326deac0f012c2d86faaf978e5949a15c4616205ecc1259
MD5 d68d0de648acf867fc7a328f3ba9ec61
SHA1 8616de93f234e6c9fd541a64a1835e3cc9d90267
SHA512 d5cbbaa91470a32c3e5bbd1a39ab49f04fa2526fe05c7e437591aebac80948d0fa063d6beb1a0da4de21ca89de0852c9ff95eb81fb703b88bbd49dce08d3eb6f
SSDEEP 3072:Pqt65X05LZ262uZRCv3Mk/7D7nJ4sXbQUbFrBf1zzL6EJlVpC07CwmG5:yt6S5LCXv3Mkz2MnFrBdzzLNlVoGZmK
MD5 SHA1 SHA512 SSDEEP

Submit Download

fields.jar

Path /data/user/0/com.Bangkok.kmarij.cgvjqszv/app_tfile/fields.jar
Size 298KB
SHA256 a0828b2ced584eb0097166421a856d8839822d9610432141977a804cb2f25b3c
MD5 f2b4315e6df8b8407f7edd5dcbf43376
SHA1 f125042d426cdb025092830007801d6a04217f3a
SHA512 5d7464e8970a44fa87ecd45be3a196f975cc0b8a5f29e5e37ffd766994287b1855404d57297b12bb9fbbb5463aa23f3511638548e2b1685526be9f383e137066
SSDEEP 6144:8HJarsnjiQd+c0BHVjXXHalaq/WsBK0bQYClpFC:8arud+R9hXXx0ZbQYCl2
MD5 SHA1 SHA512 SSDEEP

Download

tbcom.Bangkok.kmarij.cgvjqszv

Path /data/user/0/com.Bangkok.kmarij.cgvjqszv/databases/tbcom.Bangkok.kmarij.cgvjqszv
Size 36KB
SHA256 5f49bca53de766023101cc1ac8dda79a83c485fce8d9138452b39d1853d2fe0f
MD5 ebfd4869bb86abd638bc48b891f3e1c8
SHA1 a27f262fe7a41ec9976d457416447f8b78c80e03
SHA512 062fd15e0a34619071834f2d81889e6a100c3a707e53621b16d584182a57c690f6a24a73e19fb77678d857fde477935811a963998a73d7ffe971d6ebd9cafb07
SSDEEP 24:TLCOfl8M/LxIx2pq4WwHkuEHV6psLT0vGSgIQQ:T3GqdIgpT1EHV6e8eS
MD5 SHA1 SHA512 SSDEEP

Submit Download

tbcom.Bangkok.kmarij.cgvjqszv-journal

Path /data/user/0/com.Bangkok.kmarij.cgvjqszv/databases/tbcom.Bangkok.kmarij.cgvjqszv-journal
Size 512B
SHA256 85bd07307b99390facc9fd3f3533efa864fdbd8d62785041fc4c589930e53d31
MD5 423ad6c70ae9b0f961a8b87b542a66e9
SHA1 1a28edb6ebc9b1f17e00bbb4cca94b7ed50bd5e4
SHA512 7485a3903e58d752c8c90c39444b9ebc1fdbe8bb8e6f5bf3ec952d88b5c3fb6ad23d53e8144bef6df975b2e39549a89ab1843a92eee6e15e70ae80602a32c29c
MD5 SHA1 SHA512

Submit Download

tbcom.Bangkok.kmarij.cgvjqszv-journal

Path /data/user/0/com.Bangkok.kmarij.cgvjqszv/databases/tbcom.Bangkok.kmarij.cgvjqszv-journal
Size 8KB
SHA256 a107cfd9e59aadf2669ba8b10b65230de6117dcbb05f248fad6d51ee646612da
MD5 ffc52e57c5c81b85bd7c653b58940ebd
SHA1 525c47d54828a945248978eaac8aa8e9edab329d
SHA512 0383d5b2ccb98f8077a5b651f700b179dc649ff2d8bd05aef8d18a389b2b9b48b909c7727974c9da839fa30f034f3eb634c5c0bbe8c7f3b26e86709174ae1709
SSDEEP 6:7+/l9TOn14cRg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKofn:7+tN5cRqLiuWdYRmBEyPb1n
MD5 SHA1 SHA512 SSDEEP

Submit Download

tbcom.Bangkok.kmarij.cgvjqszv-journal

Path /data/user/0/com.Bangkok.kmarij.cgvjqszv/databases/tbcom.Bangkok.kmarij.cgvjqszv-journal
Size 8KB
SHA256 26f9815a1fd502c99505e23a59050915f0f28a9512785c32f60ee0f5b5dea673
MD5 7d0c46d80ae01703b23291a6cd6a8d5d
SHA1 273a2f2c93b4861073db9a82394510511ceb4f9d
SHA512 b70b9724bbc0376dd3a78734ac3a5eb69656a51ecdfedf76c4ed763c63d5fdb9b8a42268ddcbe6e5f87ea7a6db54cb31bdf1d0164f78c5273310fd35339c9289
SSDEEP 6:7+/l9O4Pg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKm//m7:7+tzqLJdeWRmBEyPbtS
MD5 SHA1 SHA512 SSDEEP

Submit Download

sdsid

Path /storage/emulated/0/Download/sdsid
Size 4B
SHA256 fe675fe7aaee830b6fed09b64e034f84dcbdaeb429d9cccd4ebb90e15af8dd71
MD5 b8c37e33defde51cf91e1e03e51657da
SHA1 dd01903921ea24941c26a48f2cec24e0bb0e8cc7
SHA512 e3d0e2ef3cab0dab2c12f297e3bc618f6b976aced29b3a301828c6f9f1e1aabbe6dab06e1f899c9c2ae2ca86caa330115218817f4ce36d333733cb2b4c7afde7
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads