cb4c4366780dd0c8f1723a77c911ca72dc5f921cf215fc9ffc60a6b18b357387

Analysis

max time kernel
149s
max time network
148s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
07-09-2024 19:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2a5238060219037c3728de9f4304d82_JaffaCakes118.apk
Size

788KB
MD5

d2a5238060219037c3728de9f4304d82
SHA1

4c7b1a0a091873d8999a5e20b469c89005d46259
SHA256

cb4c4366780dd0c8f1723a77c911ca72dc5f921cf215fc9ffc60a6b18b357387
SHA512

ed0946321ebbe56eb8affdc6cb6ec5bb2f705a1aaed3c2f06ca20776c90864ba02c6de2c6dbaaf07d4ef456cae05943c8379ed88db3546ccfc0d75e89e47ec22
SSDEEP

24576:sQEaFmFN9v46flHtIxo+8lqBtYRNX4Ex7s9N:sQEaFmL9Ac/YB68YsH

Score

8^/10

banker collection credential_access discovery evasion impact stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4506	com.gaze.pint

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.gaze.pint/app_ttmp/t.jar	4506	com.gaze.pint

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.gaze.pint

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.gaze.pint

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.gaze.pint

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.gaze.pint

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.gaze.pint

com.gaze.pint
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4506

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.gaze.pint/app_ttmp/t.jar

Filesize
276KB

MD5
9aaea567e0c93e51718ba7eade0e83df

SHA1
0005116aad1779361b70093db00fed5ac090ae23

SHA256
b30a95dff6f65f444472971c8aaf895ffc8e66e0117ce242ec4cb8a8a519a5ec

SHA512
2aef1034335d8752f4e25ce6c5823ce03019536cc6e51ee61b5291c77a0f356a2517e0cbe7f2c4cc2d897115dc856449a342cfdc247c9d34d313187d15b2f890

Download Submit
/data/user/0/com.gaze.pint/app_ttmp/t.jar

Filesize
587KB

MD5
f72c3d07507c3e26d317e9117ba757d1

SHA1
cdede4739e9dd9fd95243aab5e44c24f93f825c3

SHA256
1c65834d9ca018c6496a8b9957589d0e94657911b6635dc21a448d78f9238887

SHA512
3420714252e7503abc13c99274d767b0bc08671d769460dc61823ab9470e145fb75c5dfaadc617d3a05cf251ed5ecf38ea7e8c1d7b343bca4d7e8296f1b805d4

Download Submit
/data/user/0/com.gaze.pint/databases/com.gaze.pintb

Filesize
72KB

MD5
2849e965f4690db0e73e29b45617a61d

SHA1
7e6ea5d9b8fff25c897ef44bd50d22016a61dfa6

SHA256
1840f688936a9b01fd599b35fe6c9260babf142939a6d6891063abaf5db3eb48

SHA512
fbda2fd7fddcf7712d011c89bd7e0a85676e7337dc77081d427ca43a7403c4fdb9a3dd384fa0fe9a58c9129f6064d3e940e71b87fb0cfef1c32e795b4ee0fa59

Download Submit
/data/user/0/com.gaze.pint/databases/com.gaze.pintb-journal

Filesize
512B

MD5
459f5bcd825a731500c6b4705e30e573

SHA1
c5b3079a2f25b545ba40e2200721ac700311dd52

SHA256
6bd754446eb6ebe3b0fbb1932c5fe626e8229e6d3b51654626a5f1cd11727a29

SHA512
27586c2fd752d45a014632282faf4d1afda146800dee140bea4f830b8b741d5bcdd67e330a40f059a89c8f07160537067f056ecaa0dafeef7a32b1e5f0409f67

Download Submit
/data/user/0/com.gaze.pint/databases/com.gaze.pintb-journal

Filesize
8KB

MD5
8198f4f34d1d410280f8e32de7e41d30

SHA1
97d1d50f32c21c4117534ce42361e91f5a9160fa

SHA256
da9dcaf58f541091521a65781a89cb904d775a6e0328b5dc079a5f5d8a93d9a9

SHA512
66c4e39ec1fe95a4b4479e0857e7726e558f5d3348411148c8ebed493929028f5a9ccdd874026ac495c323b2554bdf254a93499d33cb189c208dba00cfcc28b8

Download Submit
/data/user/0/com.gaze.pint/databases/com.gaze.pintb-journal

Filesize
8KB

MD5
e7d34aa5f181769de415c513e676bf0e

SHA1
48fc171d3bbd00740a4229f6eff75b195207ebfe

SHA256
445a74c81371702b8dae16e6d7b944e1006b65ee3179db03c5d76602ad8849b5

SHA512
8875df9339bce241a1d3ec217b87ed98b3e887a0038b9d80a53c74431231f7016fcf440da1f43d3f0a2695e46747b68a4a1ea55735f80ac0de057d9c4432cc89

Download Submit
/data/user/0/com.gaze.pint/databases/com.gaze.pintb-journal

Filesize
12KB

MD5
773103dead5c2a80a67fc83bb2c20282

SHA1
2747d07b0fb31c75e03abbd4e96c93301fff87d7

SHA256
df107751bad485f05a0c5f76f603830f426f80eb892da2bcdd53612758ff9b8c

SHA512
d385d294b6e8b08a66df94d9ad8090982963647bc7cfb18c0148a4517d44ecbf6d8ec7ec8a902598b1d3e3efd284526e20215396cda8fada25efdc66cf8bc5e8

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads