cb4c4366780dd0c8f1723a77c911ca72dc5f921cf215fc9ffc60a6b18b357387

General

Target

d2a5238060219037c3728de9f4304d82_JaffaCakes118.apk
Size

788KB
MD5

d2a5238060219037c3728de9f4304d82
SHA1

4c7b1a0a091873d8999a5e20b469c89005d46259
SHA256

cb4c4366780dd0c8f1723a77c911ca72dc5f921cf215fc9ffc60a6b18b357387
SHA512

ed0946321ebbe56eb8affdc6cb6ec5bb2f705a1aaed3c2f06ca20776c90864ba02c6de2c6dbaaf07d4ef456cae05943c8379ed88db3546ccfc0d75e89e47ec22
SSDEEP

24576:sQEaFmFN9v46flHtIxo+8lqBtYRNX4Ex7s9N:sQEaFmL9Ac/YB68YsH

Score

8^/10

banker discovery evasion impact persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4268	com.gaze.pint

Checks Android system properties for emulator presence. 1 TTPs 1 IoCs

evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.product.model	com.gaze.pint

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.gaze.pint/app_ttmp/t.jar	4300	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.gaze.pint/app_ttmp/t.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.gaze.pint/app_ttmp/oat/x86/t.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.gaze.pint/app_ttmp/t.jar	4268	com.gaze.pint

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.gaze.pint

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.gaze.pint

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.gaze.pint

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.gaze.pint

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.gaze.pint

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.gaze.pint

com.gaze.pint
1⤵
- Removes its main activity from the application launcher
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4268
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.gaze.pint/app_ttmp/t.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.gaze.pint/app_ttmp/oat/x86/t.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4300

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Hide Artifacts

1

T1628

Suppress Application Icon

1

T1628.001

Virtualization/Sandbox Evasion

3

T1633

System Checks

3

T1633.001

Credential Access

Discovery

Software Discovery

1

T1418

Security Software Discovery

1

T1418.001

System Information Discovery

2

T1426

System Network Configuration Discovery

1

T1422

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.gaze.pint/app_ttmp/oat/t.jar.cur.prof

Filesize
705B

MD5
96a69f70c3858c57ee52dec0d688f202

SHA1
fcfaadd02a6e42273cb9591cf68c2d557b986adc

SHA256
9e54199759f2cbb05d96c8f25abefa0e74dcfb25cd660561f2238ffcce6e0e4b

SHA512
b9daa6b2e96f6b2ce3209f3224542750bf150b1929c37731700f7a17da2c04ea5b51bcb133c96bc8cf61c0eed31e3abf942e9a56da61dc5a97198e5050d3f382

Download Submit
/data/data/com.gaze.pint/app_ttmp/t.jar

Filesize
276KB

MD5
9aaea567e0c93e51718ba7eade0e83df

SHA1
0005116aad1779361b70093db00fed5ac090ae23

SHA256
b30a95dff6f65f444472971c8aaf895ffc8e66e0117ce242ec4cb8a8a519a5ec

SHA512
2aef1034335d8752f4e25ce6c5823ce03019536cc6e51ee61b5291c77a0f356a2517e0cbe7f2c4cc2d897115dc856449a342cfdc247c9d34d313187d15b2f890

Download Submit
/data/data/com.gaze.pint/databases/com.gaze.pintb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.gaze.pint/databases/com.gaze.pintb-journal

Filesize
512B

MD5
3af191197ac5a5cb577c3e72705c7535

SHA1
4e569803af60d319b33c92cdaa6a90c15f13d52c

SHA256
cc99af99a8e8f7cba5cbef9b2dba2715adb0625fca6c04db450558a3a3f4ca06

SHA512
628fea278d078a00c524ffda7e71e21530f17e39d451ee51901710429bd256cb77436a68a7d2abe542f32c0ee56fb28197bdf5d1236535b445967f4bce5f84e6

Download Submit
/data/data/com.gaze.pint/databases/com.gaze.pintb-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.gaze.pint/databases/com.gaze.pintb-wal

Filesize
92KB

MD5
904f13c14831af78c63dbf13f6f105a4

SHA1
78c45186142a7a98b254944d40462e17b39d3da8

SHA256
c36a6295eb00fee0dd3fcc667b9daadab33e6686a0807128de36249e97c7d701

SHA512
d742125a3005767cf3dc8730f6fb50ee13b57bc7a5bc921d6a30898dce5da1ee0d6b56e1106cd065c7f5a98a2fa99c2f54eb0841331a2cc477a2b9ffaad93497

Download Submit
/data/user/0/com.gaze.pint/app_ttmp/t.jar

Filesize
587KB

MD5
5f187161b6cbaeb08a57c166bc1c8954

SHA1
71897ad46bf5ce055e0891775fbf3949d1e03e10

SHA256
f093e6aed6e100f7c164174270f384493e63a449c02f5df02f88aadfdf0ebaed

SHA512
71c2854911e5a145ac6cc2f63f35f00339c7f63456aaddb4c7a4c7d314eabea729cd5c11393ed415fdd3f25c88ba55a327912d406900245a8ddd35ae59dfd3f4

Download Submit
/data/user/0/com.gaze.pint/app_ttmp/t.jar

Filesize
587KB

MD5
f72c3d07507c3e26d317e9117ba757d1

SHA1
cdede4739e9dd9fd95243aab5e44c24f93f825c3

SHA256
1c65834d9ca018c6496a8b9957589d0e94657911b6635dc21a448d78f9238887

SHA512
3420714252e7503abc13c99274d767b0bc08671d769460dc61823ab9470e145fb75c5dfaadc617d3a05cf251ed5ecf38ea7e8c1d7b343bca4d7e8296f1b805d4

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads