Analysis
-
max time kernel
148s -
max time network
131s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
28-09-2024 23:58
General
-
Target
fd66ce40e73dbfe2a1f6a718c5ca30da_JaffaCakes118.apk
-
Size
4.7MB
-
MD5
fd66ce40e73dbfe2a1f6a718c5ca30da
-
SHA1
696431ac145a50da1b1060639d7908c682f134c8
-
SHA256
b0ac55805196efd6af8d21642c3dd81ea0900847c2544404292b4bfd1ce84fa3
-
SHA512
371c38332a1ba8e1ea8224c1d2f47f14df4e8c9f78c981aacb7fa36496e7dbe0ea06e369f9236fa61b1588f0ef5b9784be1583872df4ef6b7c9504d338c00fe3
-
SSDEEP
98304:hN23CGCNT1OO6CuFJaylF8ZCCfxOk13C3cFR+ARW5yYbsae+P7Wv/2TrJ1ebpFA:hI3C/NTt6HVlCZCQxERARW5galPi2TFP
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra payload 2 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes
-
army.custom.bridge1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/army.custom.bridge/app_DynamicOptDex/nONUI.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/army.custom.bridge/app_DynamicOptDex/oat/x86/nONUI.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD5ce7a6326e03a012353382c57c7003cca
SHA1cc387b5a1acd3d6ca37be33a334b8853321ada39
SHA25689b2027db7f4979061ab23bba5f0255d65ab4831d40996609091cee6993bdb17
SHA512810676b55874324fa44d1f45f06a7fcfe667ef73eecc48fc1295b3c1010b7899fa14ae049da10c549cb572eac29990c1381719fca6e9bea436492d63c480d3bb
-
Filesize
2.9MB
MD5e88baf55960ac7227c804a0b02fdd5a3
SHA1cc577285ad57737e7f1dd29638f1319876b68d3e
SHA25612e54bd019c6d386c786cc33b8365036ab47aa2af1f9c43c40a0632cd76e38c5
SHA512317d858abb6b531e86ae7a60fe1e69402e5d86afd8b7332168d6afd8aa4f213efc2bf7fddbc3b3efe92f0ff5029de580d53ef09fd537d95e76d9cc9f66c83779
-
Filesize
1KB
MD53733d0e246f4f045611ac3159638c66e
SHA12087c29b7c1d219ce4b88d54f16480b2b9b3e2c0
SHA256703118b8fe3954083ee7416658906ef4b1991b11ccf4091b926e8a5797694006
SHA5123e1130141f3a74d2af15022cf3bc8fa29599a63a0d4677f972c7dbdd8371d068be8c4e071514793199ad379a48c7eca64ccf6218bcf0a93de0c3558611667620
-
Filesize
2.9MB
MD55b5803ac430cd235eaee4daedc32a9e8
SHA120fa07aafd9e051e5b12de9c7eb441738abd797c
SHA25676f6b5af61515ee5857bfcd80bc62a330f36732839fb1181577a84e6a1853f1d
SHA512a3eef28087af2c444c2a063b0604302c8ce0a1650dcd054e118754c4d2ae3af345e3e87a4bcfc0762ad7aadedf2bc90cb25ef23af763b20c030e17204823c0b5