Analysis
-
max time kernel
12s -
max time network
131s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
11-09-2024 05:31
General
-
Target
d9b427c189fbdda7c2d74cace3e5f184_JaffaCakes118.apk
-
Size
2.1MB
-
MD5
d9b427c189fbdda7c2d74cace3e5f184
-
SHA1
e11c14c65b923f2a0565398c36eaab6846739522
-
SHA256
5c4a0458c581c9bc0a7729b01926cd7b1f6b5b58aaecb2f31f571d4ded7ee419
-
SHA512
8160e92113549e662c89655f77afadb9736687fce2693f04e2b5e5a2787091debb3a37da9f8297fa8a6dd36be391de893150d011308fd12594624a95424f4ada
-
SSDEEP
49152:8RWMOdwtaY1wr9VOge7sGR8WVlNMUHr+yP8vnIKFG53RsiXZsP2:8kMOgh1wr9H+s48UlNMUHiTvIUG53RsY
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 1 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests enabling of the accessibility settings. 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes
-
com.vrzjrmfhoxl.vmfmkdj1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about active data network
- Queries the mobile country code (MCC)
- Requests enabling of the accessibility settings.
- Registers a broadcast receiver at runtime (usually for listening for system events)
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.vrzjrmfhoxl.vmfmkdj/app_offline/xpqfdyxvcphm.jar --output-vdex-fd=43 --oat-fd=44 --oat-location=/data/user/0/com.vrzjrmfhoxl.vmfmkdj/app_offline/oat/x86/xpqfdyxvcphm.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
252KB
MD5e5e4f960399d9c4c7f8c4ebb200c33c6
SHA1f16b52afb8dbbef2fcee7b490271a46a5aac5986
SHA256134620390effcdbdddbf4d8c537c18afee9f2e68e87ca988642e446f7f51971b
SHA512abbf3c72f88df57843274975c62bc6895c7c03801fb72e85e170ba77fee2777a3696e8f63bf3ddc7c83f76895da44841d7848985506ce47ef712af28e9fd352c
-
Filesize
567KB
MD565ff56faf0da133fbb7fa531dd9d1acb
SHA1c2921bd3c95cab2853bb3830cdffd7ddb99153a2
SHA256bcead479dc73193fdb1eebfe73e5874db67a672e5e9e0510e6190a17ee93e1e7
SHA512156c8b0b3f486c005b3bd8a657216f33718cbd5ccfbeaa0a30a206c3acc68a98bbd73a9ff0d36afb4c9ee411a902cf0e0be15523b69ace8dee6cb7cd3d74364a
-
Filesize
567KB
MD5338587b85fd30eb1a0a520d1cd0a71b4
SHA1c59c57512ede75a8bc92946532a13037adb22322
SHA2565b16833ddb23ba2d682af2482279f54c7ad96ff4996dcf4c3721e7fc5342e5a7
SHA5126a84bb145d29d7aba41946da8090245b3d03ffee9d99ad804b8716032be71b9c5f73d79cdb054f366e356eab3fed04e3a63a02736f2ee5e0a77ebe6b3a9fbeb2