cb4c4366780dd0c8f1723a77c911ca72dc5f921cf215fc9ffc60a6b18b357387

General

Target

d2a5238060219037c3728de9f4304d82_JaffaCakes118.apk
Size

788KB
MD5

d2a5238060219037c3728de9f4304d82
SHA1

4c7b1a0a091873d8999a5e20b469c89005d46259
SHA256

cb4c4366780dd0c8f1723a77c911ca72dc5f921cf215fc9ffc60a6b18b357387
SHA512

ed0946321ebbe56eb8affdc6cb6ec5bb2f705a1aaed3c2f06ca20776c90864ba02c6de2c6dbaaf07d4ef456cae05943c8379ed88db3546ccfc0d75e89e47ec22
SSDEEP

24576:sQEaFmFN9v46flHtIxo+8lqBtYRNX4Ex7s9N:sQEaFmL9Ac/YB68YsH

Score

8^/10

banker collection credential_access discovery evasion impact persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
5049	com.gaze.pint

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.gaze.pint/app_ttmp/t.jar	5049	com.gaze.pint

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.gaze.pint

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.gaze.pint

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.gaze.pint

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.gaze.pint

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.gaze.pint

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.gaze.pint

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.gaze.pint

com.gaze.pint
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:5049

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Hide Artifacts

1

T1628

Suppress Application Icon

1

T1628.001

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Clipboard Data

1

T1414

Discovery

Software Discovery

1

T1418

Security Software Discovery

1

T1418.001

System Information Discovery

2

T1426

System Network Configuration Discovery

2

T1422

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Clipboard Data

1

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1

T1471

Data Manipulation

1

T1641

Transmitted Data Manipulation

1

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.gaze.pint/app_ttmp/oat/t.jar.cur.prof

Filesize
702B

MD5
83a72f83a97ba70b3ef63f0a65d5a226

SHA1
07676af821192df557f9d8c9062745f249ae27a7

SHA256
921bb71d0cb3ef3ad80b0a4cc9da00aef09396b428ad967a9b3bbc38cb4d0947

SHA512
a1e2aff1de9ef0cec2522bc266e1d0bfa0fde5a4098af550372203dac2720a7e7323d43829c193ae241924ab65fd957938c766d7d3617cd234f34fe5526ff5e2

Download Submit
/data/data/com.gaze.pint/app_ttmp/t.jar

Filesize
276KB

MD5
9aaea567e0c93e51718ba7eade0e83df

SHA1
0005116aad1779361b70093db00fed5ac090ae23

SHA256
b30a95dff6f65f444472971c8aaf895ffc8e66e0117ce242ec4cb8a8a519a5ec

SHA512
2aef1034335d8752f4e25ce6c5823ce03019536cc6e51ee61b5291c77a0f356a2517e0cbe7f2c4cc2d897115dc856449a342cfdc247c9d34d313187d15b2f890

Download Submit
/data/data/com.gaze.pint/databases/com.gaze.pintb

Filesize
72KB

MD5
8ce3a97290e289a7810a22ce2cf6025b

SHA1
daa1ff6335a83830cc9fbf9abf4eef94409926d5

SHA256
01e2f26e48e64e2a651813827ed104a9b7b3d7db743e1b0e1c06d763641c6193

SHA512
2bfc03703d5afeb53f62a9f5ce2b027ab56774e3ee4b9be1803772dfc5e17678724446f5716f7229ad7d0361e1f857a66adedf871a9fb26120e3c0b09335fdf3

Download Submit
/data/data/com.gaze.pint/databases/com.gaze.pintb-journal

Filesize
512B

MD5
144025ebfbe61a701f5384d1a954be6a

SHA1
2f88488f511092cd58cf12f00c73b70cdda23574

SHA256
1b6e64c742edbf18e6ac3a2af2f886e46d26384042762d8d469967e3cdcd097d

SHA512
c76d3e6165bc347d83e57e63e264b7682e503344ea1ff68aafc5b9a538e4f7ebc0c3b8f04dc9380a204593bdccb31f72a31fb43a8d06569964adb1d19d76a31c

Download Submit
/data/data/com.gaze.pint/databases/com.gaze.pintb-journal

Filesize
8KB

MD5
4ad9d452faac3363b3541db2bfc34d7b

SHA1
1cfa3a51cab5bc94d7bd23c07d12ef7bf5ed1ba2

SHA256
873513ea607a9548038f7d49f6817463e7232d0e9ac96e5893c1c0c2674718c8

SHA512
c8fe8992d87864a184af9374013618d98e9fce2ff86c7ce5c63590c3ca762b2ab32fa3ce224165e664e66f9d29600babdfe010063e932c2b5756a0c2e8c7d82d

Download Submit
/data/data/com.gaze.pint/databases/com.gaze.pintb-journal

Filesize
8KB

MD5
c36fc70d40f8ae65457dfe569202d21a

SHA1
c15efbd28720286f5e1c9dae80c0bfa6d423ac5b

SHA256
0b5931a1b101606e142badeed94ead51eb61d7dec9226b6be47be571bde2ea3c

SHA512
815f0a2b3ab4f417e44c1ccb7dd11505ce8a7382c87aaae2a9785a8fc9dd70a0ece8fdbea5a83f04dbdada4eabcc6e811ac48f6196d45ddb4816bda323c3ba1c

Download Submit
/data/data/com.gaze.pint/databases/com.gaze.pintb-journal

Filesize
12KB

MD5
db2185fb11f7000d77df0e332d1cd713

SHA1
539531b27ce7373fd972b3d318b90c990f10d097

SHA256
bfa896f2f202b3d2978e60241a2c6941805d597481cc266ef661c2ee9f3e2815

SHA512
1594fb862f232f85eef0bc6a3251c1e8b914cd77f613772faed69f3068781eecae849a1aedf4595279c482941f37b9d2c89e66b29171d845d11ed89b12acfb8a

Download Submit
/data/user/0/com.gaze.pint/app_ttmp/t.jar

Filesize
587KB

MD5
f72c3d07507c3e26d317e9117ba757d1

SHA1
cdede4739e9dd9fd95243aab5e44c24f93f825c3

SHA256
1c65834d9ca018c6496a8b9957589d0e94657911b6635dc21a448d78f9238887

SHA512
3420714252e7503abc13c99274d767b0bc08671d769460dc61823ab9470e145fb75c5dfaadc617d3a05cf251ed5ecf38ea7e8c1d7b343bca4d7e8296f1b805d4

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads