5942a2210e98fc24195f8fdfa5de1c97ca0305a461c4010fa440a3a97772f706

Analysis

max time kernel
3s
max time network
151s
platform
android-9_x86
resource
android-x86-arm-20240910-en
resource tags

arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
submitted
30-09-2024 11:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

012022da23ee3f23abb8d596580ddfe5_JaffaCakes118.apk
Size

4.6MB
MD5

012022da23ee3f23abb8d596580ddfe5
SHA1

f1297abe74cf9c832472b9268899da9bd399c3b9
SHA256

5942a2210e98fc24195f8fdfa5de1c97ca0305a461c4010fa440a3a97772f706
SHA512

0b5ea274086d9d2f91c22571a4620408208d6800c20f63feff29eab13f2810af953f6b554058fc508f28bd5ff6cac6675c67c6778ed9f7d65cfdb719405c381c
SSDEEP

98304:w4UUDA6Rzp602VgHv/i1SW/1UEA8800ong5kdnhyQFTk9jEmEvO7:w47sU96cv/i1Sc9800ong5kdnhyF9wG

Score

7^/10

banker discovery evasion

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/storage/emulated/0/Android/data/li/ci.zip	4295	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/storage/emulated/0/Android/data/li/ci.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/storage/emulated/0/Android/data/li/oat/x86/ci.odex --compiler-filter=quicken --class-loader-context=&
/storage/emulated/0/Android/data/li/ci.zip	4269	com.android.amili

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.android.amili
1⤵
- Loads dropped Dex/Jar
PID:4269
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/storage/emulated/0/Android/data/li/ci.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/storage/emulated/0/Android/data/li/oat/x86/ci.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4295

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/Android/data/li/ci.zip

Filesize
4.4MB

MD5
b8c3d87fb67344cda23e9edc6e9e87a8

SHA1
75c8b016a0d10188eea4ac4cab45d371cdd377f4

SHA256
849298ae09391e6f07f738c44d5d1e379f7b853b7bf70996096fe29ad3474bf7

SHA512
7337f0c9d078e39a8b9c59115679491a913ae23a4d606bfa7962d25aa371cbc238bec926bcbccc45850de26888855d326fa893dcf32ccb57c39c7d56b8e3e94d

Download Submit
/storage/emulated/0/Android/data/li/ci.zip

Filesize
2.1MB

MD5
f67d9fa0dce06f29ecc5f0203b5d8bce

SHA1
ee2bc5071821a9cc573f559c64d7eaf103befdf4

SHA256
222b771e63a3360884cc59f544190d744177d1de6d8ed20ae13a6611bedbf5fc

SHA512
1c144cd9081a59ab20c2acd147d08582efc78b303a75773e0bcf9b6c5436a43d2c8a44fdd19bf1fde62a0c0e3dda2feb4ef8f20f605987d343fedc6fddc46f0b

Download Submit