6fe632e90237297a525906ebfd26466a2dc2286eebe6322bba2ce2c14e524914

Analysis

max time kernel
9s
max time network
133s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
13/09/2024, 18:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dead7fe5946da528e6ee8181b5f1823d_JaffaCakes118.apk
Size

22.6MB
MD5

dead7fe5946da528e6ee8181b5f1823d
SHA1

43498181e0f62adfb7499895420c3fb40a3d9ef3
SHA256

6fe632e90237297a525906ebfd26466a2dc2286eebe6322bba2ce2c14e524914
SHA512

95cb14e7bfc79076f1d775c80af7fdf9ec0679099c56d555f84e5642827f8372e89e36653224b559dd847c60bc8a3264d796f01ddf4fcda9283ad20d937d60ba
SSDEEP

393216:h63GlgrfD2sYtXV8htkqyxcfeCHxQ43oxkAy4EpxY418mEKQlaQbbU56xGOtLSx+:h64gDYtXSht5VwlkbbEcubUJP8

Score

7^/10

discovery evasion

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.blingstorm.szty.fishhunter/files/stares/updates/sta.jar	4390	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.blingstorm.szty.fishhunter/files/stares/updates/sta.jar --output-vdex-fd=53 --oat-fd=54 --oat-location=/data/user/0/com.blingstorm.szty.fishhunter/files/stares/updates/oat/x86/sta.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.blingstorm.szty.fishhunter/files/stares/updates/sta.jar	4315	com.blingstorm.szty.fishhunter

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.blingstorm.szty.fishhunter
1⤵
- Loads dropped Dex/Jar
PID:4315
- getprop ro.board.platform
  2⤵
  PID:4350
- getprop ro.mediatek.platform
  2⤵
  PID:4369
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.blingstorm.szty.fishhunter/files/stares/updates/sta.jar --output-vdex-fd=53 --oat-fd=54 --oat-location=/data/user/0/com.blingstorm.szty.fishhunter/files/stares/updates/oat/x86/sta.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4390

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.blingstorm.szty.fishhunter/files/stares/updates/sta.jar

Filesize
1.8MB

MD5
8ec43e10005ec4bc91c4e45b8e68e304

SHA1
66fb42cb11e77900e55cbd4a8e247841dad1c5ea

SHA256
18d90827352cf0ed3084c4f1f94d98026908f674914889e1e58c2ac5e68be63f

SHA512
6077f32c03361faa552bde6c7cb9676c6393a9b7a30a9622095e6eb93da484b29fd75edd955523c8b51d4e86fe4a19fbce5cc456f7612162dbdec76e43b563d6

Download Submit
/data/user/0/com.blingstorm.szty.fishhunter/files/stares/updates/sta.jar

Filesize
3.5MB

MD5
a76a0eec70efc99ea0ac64c07f6bec32

SHA1
8102d17f7690ba9697f1be3de7cedfb765e70d51

SHA256
aa563dff1eff005677766ff94f60884b3ca72e1b4e0e478dd8ba781269dca37e

SHA512
dff801c2e27bf4e62a1fb04f0a120a8be7f7cabc3640195dd3caacca4c6c3741eaeeb4d9e5afe151d6b8cf38684779acff4f99d37fe784329ca6b9ecfd2cd0c0

Download Submit
/data/user/0/com.blingstorm.szty.fishhunter/files/stares/updates/sta.jar

Filesize
3.5MB

MD5
f4e9864345c65cfda19a2f32209cc1ac

SHA1
a28bd5640006c97399085831a71f444cc9142123

SHA256
a908ee5efebad005c51ab86e6a47b56ea8f11b44129e149db376fa8d5eeb383c

SHA512
9b0f40b2f8eebed0817b5a1ab31ab61af2da9d2e3ae1f5b880b40552986e5bd192ed9d1c31c5fe74cf458a51e809f05300f1fade9e4c28a3517a3a1c6ffc5f7c

Download Submit
/storage/emulated/0/data/.systemid

Filesize
36B

MD5
2fc3766f568f59b55663922c09af19c1

SHA1
a02a30f33402b02d73b7c57795dfda71c2da5b96

SHA256
57a4a55a7759511a895b69b9d34f8877f041b925d9c3279f8df601a8fca5ef9f

SHA512
ee172c49982824ed30f6a3cfa4f4abcef63bfaec6a1aa2bb868d7acd9127a099f541122031f10af69e78ac2cec46309f3438ecf303b191f558cd45a33a044503

Download Submit