Analysis
-
max time kernel
149s -
max time network
132s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
11-09-2024 05:31
General
-
Target
d9b427c189fbdda7c2d74cace3e5f184_JaffaCakes118.apk
-
Size
2.1MB
-
MD5
d9b427c189fbdda7c2d74cace3e5f184
-
SHA1
e11c14c65b923f2a0565398c36eaab6846739522
-
SHA256
5c4a0458c581c9bc0a7729b01926cd7b1f6b5b58aaecb2f31f571d4ded7ee419
-
SHA512
8160e92113549e662c89655f77afadb9736687fce2693f04e2b5e5a2787091debb3a37da9f8297fa8a6dd36be391de893150d011308fd12594624a95424f4ada
-
SSDEEP
49152:8RWMOdwtaY1wr9VOge7sGR8WVlNMUHr+yP8vnIKFG53RsiXZsP2:8kMOgh1wr9H+s48UlNMUHiTvIUG53RsY
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes
-
com.vrzjrmfhoxl.vmfmkdj1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
945B
MD5275298ccf8e8c59883b7b6c100b17d9e
SHA1b7db9bf4480b568f5d0bab989890078b630961d1
SHA256e2dbb6aae56dde1dacf844558aac1c5ed457771ae58fd943fe159b825ea5eda7
SHA512d178ca1748045a95b52401026bde5e630e928ac232605d2d0192e0292e671d6766029db74824c6e5921bb7552a53d93318e30fb2934abdaa7581d535501c1e4c
-
Filesize
252KB
MD5e5e4f960399d9c4c7f8c4ebb200c33c6
SHA1f16b52afb8dbbef2fcee7b490271a46a5aac5986
SHA256134620390effcdbdddbf4d8c537c18afee9f2e68e87ca988642e446f7f51971b
SHA512abbf3c72f88df57843274975c62bc6895c7c03801fb72e85e170ba77fee2777a3696e8f63bf3ddc7c83f76895da44841d7848985506ce47ef712af28e9fd352c
-
Filesize
567KB
MD5338587b85fd30eb1a0a520d1cd0a71b4
SHA1c59c57512ede75a8bc92946532a13037adb22322
SHA2565b16833ddb23ba2d682af2482279f54c7ad96ff4996dcf4c3721e7fc5342e5a7
SHA5126a84bb145d29d7aba41946da8090245b3d03ffee9d99ad804b8716032be71b9c5f73d79cdb054f366e356eab3fed04e3a63a02736f2ee5e0a77ebe6b3a9fbeb2