Analysis
-
max time kernel
5s -
max time network
127s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
02/10/2024, 22:30
General
-
Target
0cb62d063ba8058b19bfc84b4a8f6501_JaffaCakes118.apk
-
Size
1.5MB
-
MD5
0cb62d063ba8058b19bfc84b4a8f6501
-
SHA1
a39afabfe3468be04d117307276c6446ec72562e
-
SHA256
d75a56a2ca338495c3c0da0c8cd46134054668fd8291104cd59a0a24c20c0f9a
-
SHA512
050f6f8b858b9cb1e3415168af186f6b0fdd2238edda86fb7b3e7f8957f639290f546897463d462cb41dc23e2462ea69384f7a75b467a1f72e79df57876257b5
-
SSDEEP
24576:ucTqD5mZM/c3LBCGZh4zLPWvl6EEoHrX94S7SZorgozEbnW87YGnW9eYY:ucTqD50M4f6zLPAQSX9LFrgm4WW7WMn
Malware Config
Signatures
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Reads the content of the SMS messages. 1 TTPs 1 IoCs
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.xyzx.abcdx1⤵
- Loads dropped Dex/Jar
- Reads the content of the SMS messages.
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.xyzx.abcdx/app_zhifulibs/zhifu.zip --output-vdex-fd=91 --oat-fd=92 --oat-location=/data/user/0/com.xyzx.abcdx/app_zhifulibs/oat/x86/zhifu.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD5b28345137232092ca8547dbc3c42cd45
SHA1a686324e50568f1195faa76d269d4212b4edfc75
SHA25647452040d1947868cfdcf648264940a8ebaab11adafafb44f9fb811e9708c15d
SHA5123226a7201a66d7f59a513d1bd804ba05b2918d968a13f222d47789c408cd02b3005a3ec7459364cc4f979f6163f39245e1b97974ab4955a1913e6066832d73f2
-
Filesize
117KB
MD5fd0cb9619eb90e1eeb446351dc522557
SHA1e239b99b78e2faead4d52af8e16eda6b1a699c8b
SHA256972815bc505b3b5f6b91ac9d1c5d31c518d9b13cf346ee677355546cbbadb5f4
SHA51291d3cc07060f1e55422c36881e979525436ef68715a9459c32a4e08a4f8105dadafb7928cacc48bb00603d878d7f7bb03c1a7660023d9223976dbf1edd8e19bc
-
Filesize
342KB
MD54f130038446ec66c7d49232473f8d4a2
SHA118829810ed7d4161316f3b591c4beff50ba3e174
SHA256913d2c8b9d6cba8172d90b0ecc67d33aa1f399cc9219cd283004105dea26de31
SHA51212b0329a41b1bcbcfff6dd473df8818507b93639456d25dc0c71e96c2f42ba303a91b359ae68376ab455e14492f3f791947a3ada1161c98694f9db22852ee6dc
-
Filesize
342KB
MD580fa79e2a7a0a373aa8a2b6cca763481
SHA1f0650385c11e102f6ad15216e1e12c54bac7af01
SHA256f9edb8b962e7ebb37805ef558690ab10c495bcc78bfa729052298d4b0c3221d1
SHA512c066b751940a8a069312ffd282715bc6918565c92e8db49de25d8682fe176b3f1368ed473c55a0af249e50020221e137eb952aee3d7bdd70a9e38c85984665f5