69dd656c1889aaaef8a521b9cd77b5418cfb485d998dc99c228c2e971fe0849c

Analysis

max time kernel
7s
max time network
136s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
13/10/2024, 19:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41af6c34060cd6cf4e5d8709fec9fb61_JaffaCakes118.apk
Size

10.9MB
MD5

41af6c34060cd6cf4e5d8709fec9fb61
SHA1

f4173fd1296c2c5eff3285e4323ece59f726330f
SHA256

69dd656c1889aaaef8a521b9cd77b5418cfb485d998dc99c228c2e971fe0849c
SHA512

407a0e40bb972e2e027c5be935b9a462454a0915945f8809334830327de07fe29aa26181c1cd71d6545b716cd6308d0c4f90a786b1c728bfcc8b2da961067d35
SSDEEP

196608:UdF15a06qKTIHmHhz/pZjjEfKRuWIuL3L959TE1zGGNieUSutyW480z:ST5PmtRcy5I3NP8yW45z

Score

8^/10

banker discovery evasion persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 3 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/bin/su	com.storm.smart
/system/xbin/su	com.storm.smart
/system/app/Superuser.apk	com.storm.smart

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.storm.smart

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.storm.smart

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.storm.smart

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.storm.smart

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.storm.smart

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.storm.smart

com.storm.smart
1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4256

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.storm.smart/bhd_server_config.cgi

Filesize
235B

MD5
7a53df4523a06011373d15e64d8f1b1d

SHA1
2bf4eb4b0cd35861bd2b09979ed50298fcc26dd7

SHA256
ac5a46f8cacd22704dcf9191cb38eb93ff381d17d52c947ff4a4e17e88c7480f

SHA512
99c65a973f1082513ab03b0bbb1af6c8018d27877bdfac89bc9330bf8d02ec014c66143ed3ca7959a5ee3f3c6b597335b31ecf4324b857e21982b1e3d5684025

Download Submit
/data/data/com.storm.smart/databases/Storm.db

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.storm.smart/databases/Storm.db-journal

Filesize
512B

MD5
f03e89c4cfa0a98ed6b1b300e5c8bc83

SHA1
b8e62a06caaed163508b9a3dfc441dd2993e545f

SHA256
e634e5af26071985c1453973e27d5b64e83b9f0174eb092dd68d8852b84d0c7c

SHA512
07a76100974813f6820453ee1885d96e34dcee371b2bab864a19a08d17affbe63abc4db2f0b4389bef1b203e03cbf9faf3e6dea43bca47607b1f7437274591be

Download Submit
/data/data/com.storm.smart/databases/Storm.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.storm.smart/databases/Storm.db-wal

Filesize
169KB

MD5
1932c1e2ea66dcaf153393d9c6385735

SHA1
65b5ddd26329bd6fb16568a56f547fcb63878217

SHA256
e811337d6eeb795505009ec494da8fe1bbc6c9b18e4f890a011f74564d526288

SHA512
49ad91eb8f524104eaaa27c42c45c902c0f9b35a197ecbb1b96726f4fff30d8c2e71f8eae55f50313de21859bca6588d5da6c14ee9f1c19666af0e2a65971080

Download Submit
/data/data/com.storm.smart/databases/Storm.db-wal

Filesize
164KB

MD5
4eb3e1aae6384aec0e8ecee031c93f8c

SHA1
df86ced1e289bf6596ba75c90dbaf002ae910517

SHA256
cba195fe4bca223f449233e498e3617a30856fead31652ecd726ecebd7877f77

SHA512
f228d93181c02f7b51bbec98689844ddf0939314bee42aa6c2fce3f50502ca433da1e318abdfb2ad025389b76cfb4ef8cf7b2d94173383caa6c8c0fb0ce9249e

Download Submit
/data/data/com.storm.smart/files/shuzilm.db

Filesize
133KB

MD5
8edc31e70300d59a20b23cad0c214814

SHA1
6e61cb2f1838bcfaf6be530027d51e9461e7ac0c

SHA256
31dc11656dcc541ae85bbfea8adc7bcea33ae4c2bfca4e86320e3223412bb2ff

SHA512
a2794d60896b2b3273844659bf2939499efef99d5501f72861d1e43dbe843277d5c7bc0abd55a5fef018613cf5180e98dbd3d351d4e57c3652005b51fb38ef1c

Download Submit
/data/data/com.storm.smart/lang_chs.txt

Filesize
11KB

MD5
4fe9cab1212a440fb668ac8bf06ac36d

SHA1
431132622fb737da903d490602b94815fa0b9225

SHA256
7ab94cb175247b7de4d4ab6c0cacbd652f7b426d2e8128e4829dc028b6f33a93

SHA512
b49cd139222c872e75baf036da73338d82125181cbdb7fb9c912dc761cb1cf914d0abe22ff6ccd85163eb1c2c17adc311922f45d9362fa042c7fa3159abd4c45

Download Submit
/data/data/com.storm.smart/lang_en.txt

Filesize
15KB

MD5
1dffd3895283a33539a7c71611d559a8

SHA1
39359486633f9a666b1fe4ebd0217266cc5616fd

SHA256
42f4010bcf7400c4179a616050253422133a217c0dc31c38b2add6dd0da1659b

SHA512
5068329b2c609c8358ac2009c81efc6396c642fe99c1071bf0b824fd65fc0e6be65185c13ce74ba082c5aad57b8515d31aee8a75de0f246a041645ec50d8c60a

Download Submit
/data/data/com.storm.smart/lang_std.txt

Filesize
11KB

MD5
2e7df1d44fb63fe439275d505b59cee5

SHA1
d2fc120331000af3dc776c9248c6a348cad0de4c

SHA256
b91841cfc4afe66d8d421f54670fbbe89ecfcf0f0d28d7636e9ddb6c3fe38e4b

SHA512
4de90aa16195f2d197175ad971f0f748c6d06ee30e54b4eea6bfc759c8ecdbdb786f8bc1ea9340b857cb9d9e03a7263fb4ab3c0d1ea61326e5bedb8460c86a72

Download Submit
/data/data/com.storm.smart/language.tgz

Filesize
93KB

MD5
d6a0b0fc7863eeb97b394ce5d41a0834

SHA1
7df8250d2f0a9971a0276b9ce1d8d22a4cb99381

SHA256
a5c0dffdeb5008ead27da034625d927994ecc268f5520680f90440aebd2c4737

SHA512
a61f906c9976766f0e7d43145295aa66e94c29af94f50b01e943519c5e19ec81f6231e34793ba022c3f7ed648052c7749cda0914c369e57ceca615298c99d5d6

Download Submit
/data/data/com.storm.smart/libs/libstp.so

Filesize
261KB

MD5
2851b007e5988660b10ed15d0c8dd679

SHA1
05b00d68198f2756a9525e013eea299c38500249

SHA256
1bbeb9828ffb68856d584e6b92fa22476601795f0d40db7af6ad7d414840cd4b

SHA512
d4c255122ca8dddaefac3a8ea79af65baa90ae06a4e7a2fe17bcc98c0e5dd1d88841ca66e4e615482e15589b7c2558b02bed8fed8ff693ec013e7bb84be913e8

Download Submit
/data/data/com.storm.smart/player.ini

Filesize
49B

MD5
0161131bae61c57b67c08ab98097f7ee

SHA1
84e3bc29aa00d2d842149033c3f37bbf4fb0ab44

SHA256
a374959003bc829bcf77c1a08cd96a146aafaa2c6bef8a2548c85985ecac1a54

SHA512
38cfb20815dd64ef40601593bd8942a0b40f727973777d311789c174154d16bdb2f6c72622e5c393f12a0e65bb15dfda121f0bfacd09ab759c89e0b366922613

Download Submit
/storage/emulated/0/Android/data/system/local/_system.dat

Filesize
48B

MD5
fd8c393e124a375a7fd42cbfea6ae9ce

SHA1
90b1278e57b992d57f1a36542a93a1394470b0ea

SHA256
115ccc07a620308d3640d53a5a6f06a7b8ed17a5374416d4ab2349ed219a73c8

SHA512
433a7e84a62123d6db15bf0291b9ccef58c205d24f39427c55081d42e267bb42084f8238fb3d2537c470dec05eb6a436cb9d927c44dcfb7b10876f916d170957

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads