496d30a0e7a6e3e1a21e7240d70881769d2531e0e54f0f4d29c6dbab03ebbb94

Analysis

max time kernel
3s
max time network
151s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
18-09-2024 20:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e9e93e6a92840d96c1af18bd3931d786_JaffaCakes118.apk
Size

1.6MB
MD5

e9e93e6a92840d96c1af18bd3931d786
SHA1

dda33cdec4dc48c3c302a6a1ed64f10fda138520
SHA256

496d30a0e7a6e3e1a21e7240d70881769d2531e0e54f0f4d29c6dbab03ebbb94
SHA512

46ca0bf1ef9b2f225b441305d7218051a1f353fe56214bca90b8104b3925f4780f2a379bc5cbfcb140012b7f8c262236d5c18f1aa81c8f76b6ff9de294802e84
SSDEEP

49152:HPWa1x+NE0Radp03DIGMAUYDptOQmT12MwZmYL9:H9x+B8dp0cGzUYDpgQm729

Score

7^/10

discovery evasion impact

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.tft.nyblvu/files/xio/XHHUm.jar	4243	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tft.nyblvu/files/xio/XHHUm.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.tft.nyblvu/files/xio/oat/x86/XHHUm.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.tft.nyblvu/files/xio/XHHUm.jar	4214	com.tft.nyblvu

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.tft.nyblvu

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.tft.nyblvu

com.tft.nyblvu
1⤵
- Loads dropped Dex/Jar
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
PID:4214
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tft.nyblvu/files/xio/XHHUm.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.tft.nyblvu/files/xio/oat/x86/XHHUm.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4243

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact