Analysis
-
max time kernel
147s -
max time network
157s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
11-09-2024 05:31
General
-
Target
d9b427c189fbdda7c2d74cace3e5f184_JaffaCakes118.apk
-
Size
2.1MB
-
MD5
d9b427c189fbdda7c2d74cace3e5f184
-
SHA1
e11c14c65b923f2a0565398c36eaab6846739522
-
SHA256
5c4a0458c581c9bc0a7729b01926cd7b1f6b5b58aaecb2f31f571d4ded7ee419
-
SHA512
8160e92113549e662c89655f77afadb9736687fce2693f04e2b5e5a2787091debb3a37da9f8297fa8a6dd36be391de893150d011308fd12594624a95424f4ada
-
SSDEEP
49152:8RWMOdwtaY1wr9VOge7sGR8WVlNMUHr+yP8vnIKFG53RsiXZsP2:8kMOgh1wr9H+s48UlNMUHiTvIUG53RsY
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests enabling of the accessibility settings. 1 IoCs
Processes
-
com.vrzjrmfhoxl.vmfmkdj1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about active data network
- Queries the mobile country code (MCC)
- Requests enabling of the accessibility settings.
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
971B
MD58b7fb9bdf35b5869e23073a36be1697e
SHA1d0f56bb1c5d61a10c72189f3bd5ca83ef1a61cf3
SHA2567a34cfcc4f65005ceecace6dcf03c7b707960388ad2948f83cbec680f291022e
SHA512451d66bbba6789936f7af83ea03362a041283c0f547dd7ae7f243b2b00f75efeba0085e4e1847ff76c9e688f3c3e7b2437c2a02fb477666360e4e12148000868
-
Filesize
252KB
MD5e5e4f960399d9c4c7f8c4ebb200c33c6
SHA1f16b52afb8dbbef2fcee7b490271a46a5aac5986
SHA256134620390effcdbdddbf4d8c537c18afee9f2e68e87ca988642e446f7f51971b
SHA512abbf3c72f88df57843274975c62bc6895c7c03801fb72e85e170ba77fee2777a3696e8f63bf3ddc7c83f76895da44841d7848985506ce47ef712af28e9fd352c
-
Filesize
567KB
MD5338587b85fd30eb1a0a520d1cd0a71b4
SHA1c59c57512ede75a8bc92946532a13037adb22322
SHA2565b16833ddb23ba2d682af2482279f54c7ad96ff4996dcf4c3721e7fc5342e5a7
SHA5126a84bb145d29d7aba41946da8090245b3d03ffee9d99ad804b8716032be71b9c5f73d79cdb054f366e356eab3fed04e3a63a02736f2ee5e0a77ebe6b3a9fbeb2