1e70d1f1efb4619d7763210a634b882d3b442fd3eb9e389810b949017c2760e3

Analysis

max time kernel
149s
max time network
134s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
10-10-2024 18:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

314985092f13d343678ddbbfac9f33b0_JaffaCakes118.apk
Size

2.2MB
MD5

314985092f13d343678ddbbfac9f33b0
SHA1

db17dd599b08fdce0ef702289b58b2058fd3ca14
SHA256

1e70d1f1efb4619d7763210a634b882d3b442fd3eb9e389810b949017c2760e3
SHA512

19cc5ef1da27ed0c3baab0deee341c00a5cb3093b071cdd952e822f476ba0fcd346a7e92b8609f8cfae1dffc314b9c8e69f46c817bd1174bc2f6ed0bb9961103
SSDEEP

49152:YXqWrBnmSHH7fhRocjepNTY2Rz5uFrI6P7EsnBnmiW:YXZBmSHH7fLocj+TY2buFrBBmiW

Score

8^/10

banker collection credential_access discovery evasion impact stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4483	com.main.haha

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.main.haha/app_ttmp/t.jar	4483	com.main.haha

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.main.haha

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.main.haha

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.main.haha

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.main.haha

com.main.haha
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:4483

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.main.haha/app_ttmp/t.jar

Filesize
187KB

MD5
8b2fab499ed1ae4e6a65b81db8843644

SHA1
75e1d393281ff9b62af50bd2ad51a3bb01641517

SHA256
17106cb4686d5eeac9246cb1d219b202f2b1f3958eac1551b205c599924a971a

SHA512
ba3d57a0df75f9fe069994e755f8057dbd5895cdf157900390a9a7e2bf51f9f77b04a4a24a68186c9afd2af278158b9733d29e966cec82db447acf4db7be432c

Download Submit
/data/user/0/com.main.haha/app_ttmp/t.jar

Filesize
187KB

MD5
205fe9ba67b46c4c369adc1e689f05bc

SHA1
8a6d40ee4e6fd890d6ba79e38a2265cbe3363ef2

SHA256
76bf2a99ee9ffbd6d424ce55243e06ead91725832b543778215dd1e2dcaaecd6

SHA512
3c5703da2be0c9d401c118e9a6576e8cf18cd05d726f8b5087ee1aebc9f234e1bcfd12bb3453a3b4cdc9de78f6a9be476e4bc32baa9591cad9492afc80619be5

Download Submit
/data/user/0/com.main.haha/app_ttmp/t.jar

Filesize
398KB

MD5
6433e446614644586fe9259d11acb08a

SHA1
a456afdd1fa81c878d0d2b69ec609baa1f29265a

SHA256
7b67244da231d8d026aeb4a877dbafa0915b6afc96ee36d1d1f2da49007360f8

SHA512
3362ffcc1838d7b3d282473abee63e653b6705901719cf03fba75f9e9f375d64895b7469dbc8928fd519febedf1b1a767515cbc474fdf2055c44ec63a41ff08c

Download Submit
/data/user/0/com.main.haha/databases/com.main.hahab

Filesize
72KB

MD5
a8df7b9a51c589cbe83d19051ffaa6ab

SHA1
82a18ddfeca02347a87525c9b1447804ea4242f8

SHA256
6bd51b68fa5b417124bffd726339c0521fea7cdf1b8f00eec46c071c791164ea

SHA512
f3683b923fe739ad1a88ad5746b93e4bd755e6cc06779ce43bb95dac14137185adb41e44beaf21b30e472f3b7fbbd187359904cb190e40f5c2c03c8e7de30370

Download Submit
/data/user/0/com.main.haha/databases/com.main.hahab-journal

Filesize
512B

MD5
340a51a166cd5e69823417658d0ed3be

SHA1
2a4ed2a33d09ea1ab4c51d2b1b056844d9fc72f9

SHA256
73034838ad87bd76486ed307a0b0533232eb92f63896a1e0fb789f9a4655d716

SHA512
a8dd81bee9af2e3839861d5e55cbdef256b7a9c5cff3702b6b33864bd1a03e9499da3c07955c4db6b20fc0e8b4535e1b342c327e5109425be670417abe5f35d5

Download Submit
/data/user/0/com.main.haha/databases/com.main.hahab-journal

Filesize
8KB

MD5
4c75109a315a4a90fc1ec002f423b70f

SHA1
b3c171898556c70eaee9a490053f1b3d5e0c6fb0

SHA256
58a3b8878ca0f8ac02ed67834a8634e8c2b299dbc1259b458b4379e16acd010a

SHA512
d1e7d00ef9863910115eb3f9bdb7f9585bf838e3e11c84d0ad29e5441c928d3613e6d56233570b2de71163747bbe55e2a4d1f09e874ec4ff2578f842d02cdaa8

Download Submit
/data/user/0/com.main.haha/databases/com.main.hahab-journal

Filesize
8KB

MD5
fb21acfc646265c8653248f1995da170

SHA1
a7cf74283b66190bb42ef8f3171058e33a18a2ae

SHA256
31e62359bea6ba9e28ba49144fe07190667316c38b238da42097e20b62f43de0

SHA512
2155a01a05779fc8ac40cdb9e7224f31c68b780ccdafcce56c4768131d7283c699b768b39cdf24203c7d3a668b3cfd8689ab7f26d10b6c793eea7b0992b87304

Download Submit
/data/user/0/com.main.haha/databases/com.main.hahab-journal

Filesize
12KB

MD5
f07ad5f967ea85b662aa906b1749ff9e

SHA1
73472c96f3360849680d0b1b796ea3bf536ef3ec

SHA256
f151c10fec0455864b3ee8c62e5686e3e247d7e98908c15d87f1b295f3d573c3

SHA512
bcf00622dabcd65fc9bd3ea34b9548ba6eb8ca61145eb67af5ffb01f7318f438a5946354591246894b6e8e1eb56cf4b7407e3517db6a45b59a00026ed63a67c9

Download Submit
/data/user/0/com.main.haha/databases/com.main.hahab-journal

Filesize
12KB

MD5
c30b221f06f8870d61a58ff20e8d8309

SHA1
5cb522a695f0b5f9d8b0f3b52f24515a335dd670

SHA256
fb770bd059d75c5fa45701cae8d09d8a1a9eb737afe275abc6f2f3fa72d6aa20

SHA512
b34534a81769e61104f63b47920531b9a4ba3045f5ea339ce99bf5f9cb092eab31e725b921faa3c0fd977b2823e9a5e412572ca52d1c7efcd801660223584d6f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads