f712979e8c921243d7bf9e57611e6990f263532a36a0f0dc05c0b3d653172065

Analysis

max time kernel
5s
max time network
130s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
09/10/2024, 03:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a365590fa1379afd5c6f0a02dbc27db_JaffaCakes118.apk
Size

4.6MB
MD5

2a365590fa1379afd5c6f0a02dbc27db
SHA1

e582593f546c1b6cc0f8a48118addf699e560607
SHA256

f712979e8c921243d7bf9e57611e6990f263532a36a0f0dc05c0b3d653172065
SHA512

74963ea582ee80885676cf1f9dfc30d4a73cf3de9fc148e3a7a15e3976ec376cc5c5be244359f5dcb779176602fce3ba2fcbb543dcf76ae2ac8e5dc40d7ec612
SSDEEP

98304:r41SDVvfRgFyoN7GQxSFYqdcon/szVVL/NS91VzImoDSLxsx1fUzUhRIRmQ:r4cxvgxkYXonCVNaWlx1szCRIRmQ

Score

7^/10

banker discovery evasion

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/storage/emulated/0/Android/data/ci/ci.zip	4336	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/storage/emulated/0/Android/data/ci/ci.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/storage/emulated/0/Android/data/ci/oat/x86/ci.odex --compiler-filter=quicken --class-loader-context=&
/storage/emulated/0/Android/data/ci/ci.zip	4278	com.android.dijici

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

com.android.dijici
1⤵
- Loads dropped Dex/Jar
PID:4278
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/storage/emulated/0/Android/data/ci/ci.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/storage/emulated/0/Android/data/ci/oat/x86/ci.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4336

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/Android/data/ci/ci.zip

Filesize
4.4MB

MD5
a9d4c1becbcee647f3c0e43c4ddfd3c0

SHA1
4402454e79e12b4a09e830c0effb0668b11589b2

SHA256
f016ae54991b524e9baef1c749300d916a09f810b2f116ead8f5400497d94b8f

SHA512
a971835414753f87f8259e1b34085f2fc6bbc8e0c6a3bf83389bbb3b3fb9af834d4d511e55080af2c89f9654dac8bb94bae9307afb7a3e2b562b83c97b6f3757

Download Submit
/storage/emulated/0/Android/data/ci/ci.zip

Filesize
2.1MB

MD5
387fc2e9af47294730c513ccd9cf34e0

SHA1
3eaf01be21ecd75ac535b05e134bca7b75155ef0

SHA256
177c9665aef8b3ad0a74b9c20497ef63a8f1aa8c18493011e2c0357c464ea8a8

SHA512
5ac300dc9124b5219cfe96a45759b25bf948bc3ea94ebf37bbb3edf1cbbefb6ca6072b4478ae183c9c3fda4f11f02fa8719eb86b1bf59d8ed82dc2123920c0f1

Download Submit