Overview

overview

8

Static

static

6

48ac5d0547...18.apk

android-9-x86

8

Analysis

  • max time kernel
    19s
  • max time network
    130s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    15/10/2024, 15:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    48ac5d054764c76c815b5982c866bf65_JaffaCakes118.apk
  • Size 3.0MB
  • Sample241015-s96rmssgrc
  • SHA256 70e5fc454d81d0bff99001a75ad416cb8d430155716636bf3cdaf0561dbf00b3
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
bankercollectioncredential_accessdiscoveryevasionpersistence

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 4 IoCs
    evasion
  • Checks known Qemu files. 1 TTPs 1 IoCs

    Checks for known Qemu files that exist on Android virtual device images.

    evasion
  • Checks known Qemu pipes. 1 TTPs 1 IoCs

    Checks for known pipes used by the Android emulator to communicate with the host.

    evasion
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectionevasioncredential_access
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
    discovery
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
    persistence
  • Checks CPU information 2 TTPs 3 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • app.android.ninestore
    1⤵
    • Checks if the Android device is rooted.
    • Checks known Qemu files.
    • Checks known Qemu pipes.
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4255
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/app.android.ninestore/app_SGLib/libsgmain_1505404302000.zip --output-vdex-fd=70 --oat-fd=72 --oat-location=/data/user/0/app.android.ninestore/app_SGLib/oat/x86/libsgmain_1505404302000.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4295
    • sh
      2⤵
        PID:4360
        • chmod 777 /data/user/0/app.android.ninestore/files/daemon
          3⤵
            PID:4390
        • ls -l /system/xbin/su
          2⤵
          • Checks if the Android device is rooted.
          PID:4408
        • /system/bin/ndk_translation_program_runner_binfmt_misc /data/user/0/app.android.ninestore/files/daemon /data/user/0/app.android.ninestore/files/daemon /data/data/app.android.ninestore/ am startservice -n app.android.ninestore/com.mobile.indiapp.service.NineAppsService --user 0 api.9apps.com /client.log?t=uninstall&p=logtype=10010`platformId=1`app=802`ch_code=5`ver=3.5.34`versionCode=306`imei=358240051014041`imsi=310260001014047`sid=00009d46fa65-5835-4be2-ae0c-cc1fc2aa78f51729007443200`f=94_2_0_0_0
          2⤵
            PID:4360
          • cat /proc/cpuinfo | grep Serial
            2⤵
            • Checks CPU information
            PID:4440
          • ls -l /system/xbin/su
            2⤵
            • Checks if the Android device is rooted.
            PID:4482
          • cat /proc/cpuinfo | grep Serial
            2⤵
            • Checks CPU information
            PID:4504

        Network

              MITRE ATT&CK Mobile v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              libsgmainso-6.1.33.so.tmp
              • Path /data/data/app.android.ninestore/app_SGLib/libsgmainso-6.1.33.so.tmp
              • Size 539KB
              • SHA256 7905cb71cf014fe9b8d220cd134f47ac27c51bcf1e6523355b590d77c1e4f15c
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              1729007452874
              • Path /data/data/app.android.ninestore/app_stat_log2/1729007452874
              • Size 1KB
              • SHA256 a4a00d26e63d4f0a9d46ea239af919fc5dbfb7ea911515fd21800f7241d8ee34
              • MD5 SHA1 SHA512
              Submit Download

              11gpsdfe_1729007450853004255.wa
              • Path /data/data/app.android.ninestore/app_wa/wa/sv/11gpsdfe_1729007450853004255.wa
              • Size 1KB
              • SHA256 c687aa7579a3797d4b635c4f191e1cd394ef500a5a1a5717f3f7de92674374a7
              • MD5 SHA1 SHA512
              Submit Download

              journal.tmp
              • Path /data/data/app.android.ninestore/cache/httpCache/journal.tmp
              • Size 36B
              • SHA256 7080cb592d5149c858b206d3fd0d5e3e7d601f120af00b2616bee928ee1291ca
              • MD5 SHA1 SHA512
              Submit Download

              unique
              • Path /data/data/app.android.ninestore/crashsdk/tags/unique
              • Size 36B
              • SHA256 6da72abe9062fb3b7c9117b1d18ba668fc0907106dfae52e964cc993dfdc135c
              • MD5 SHA1 SHA512
              Submit Download

              WaSession.db-journal
              • Path /data/data/app.android.ninestore/databases/WaSession.db-journal
              • Size 512B
              • SHA256 ab98cddae906730fb7bbf41c2914b413f5ce18d0b90759c887baa0410aa0fc48
              • MD5 SHA1 SHA512
              Submit Download

              WaSession.db-wal
              • Path /data/data/app.android.ninestore/databases/WaSession.db-wal
              • Size 36KB
              • SHA256 2f22ee5ab8c4bd236eddee009199d66ac03c181a94a89e3698b8c23062bbaf41
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              WaValue.db-journal
              • Path /data/data/app.android.ninestore/databases/WaValue.db-journal
              • Size 512B
              • SHA256 71302763bb005bbbf64df97c27bc81131f243754d51f1aba800c930f5c0abbe7
              • MD5 SHA1 SHA512
              Submit Download

              WaValue.db-wal
              • Path /data/data/app.android.ninestore/databases/WaValue.db-wal
              • Size 64KB
              • SHA256 23eca8903866e048f7819ac945142443fde5b1c19132985cd19b95b14eb19f8e
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              downloader-journal
              • Path /data/data/app.android.ninestore/databases/downloader-journal
              • Size 512B
              • SHA256 bcc5e01c15ece99453d2dfaf27b7a9b4947f17b0eee2a507bbec61b4701e49e4
              • MD5 SHA1 SHA512
              Submit Download

              downloader-wal
              • Path /data/data/app.android.ninestore/databases/downloader-wal
              • Size 36KB
              • SHA256 15a8da0caa559ca69e1510722e2bdc7de989cff628a7140f0025938c51c23ced
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              pushmessage
              • Path /data/data/app.android.ninestore/databases/pushmessage
              • Size 4KB
              • SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
              • MD5 SHA1 SHA512
              Submit Download

              pushmessage-journal
              • Path /data/data/app.android.ninestore/databases/pushmessage-journal
              • Size 512B
              • SHA256 ed74a76bd8743beaf19603f7c688e9d07f15f736034afedfcd929501f6fa1f92
              • MD5 SHA1 SHA512
              Submit Download

              pushmessage-shm
              • Path /data/data/app.android.ninestore/databases/pushmessage-shm
              • Size 32KB
              • SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              pushmessage-wal
              • Path /data/data/app.android.ninestore/databases/pushmessage-wal
              • Size 28KB
              • SHA256 0e209c956009d29d799ce4918c7ccc200243726975ea805db4666a448b0aeb39
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              SGMANAGER_DATA2.tmp
              • Path /data/data/app.android.ninestore/files/SGMANAGER_DATA2.tmp
              • Size 200B
              • SHA256 b9362f3ce1de0870cb83d48fffb243c5e715ec21b217bc47016c36ba4a98cdbf
              • MD5 SHA1 SHA512
              Submit Download

              SGMANAGER_DATA2.tmp
              • Path /data/data/app.android.ninestore/files/SGMANAGER_DATA2.tmp
              • Size 246B
              • SHA256 3cedf0ee588712582977536da20666c0d1fe400568eb04b8d7f696348d12b4ca
              • MD5 SHA1 SHA512
              Submit Download

              SGMANAGER_DATA2.tmp
              • Path /data/data/app.android.ninestore/files/SGMANAGER_DATA2.tmp
              • Size 297B
              • SHA256 e77966f118deae9061535d8a74e586d98e0fc2412f937a7ac65946637edcfd50
              • MD5 SHA1 SHA512
              Submit Download

              SGMANAGER_DATA2.tmp
              • Path /data/data/app.android.ninestore/files/SGMANAGER_DATA2.tmp
              • Size 341B
              • SHA256 bcfb9ec07eacd599c01c8241cadc73b8a6831900772f24eeb8c0650f458c9ae1
              • MD5 SHA1 SHA512
              Submit Download

              SGMANAGER_DATA2.tmp
              • Path /data/data/app.android.ninestore/files/SGMANAGER_DATA2.tmp
              • Size 385B
              • SHA256 a9eedda250c4a508230be8da2fb15985d0ab863288ad69a7a76e30201e1a6722
              • MD5 SHA1 SHA512
              Submit Download

              daemon
              • Path /data/data/app.android.ninestore/files/daemon
              • Size 13KB
              • SHA256 8fa4c27529ddd36b19323cb156d8f186974e8b85e02ea6ee6167808508198d13
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              idis031s3331ddsn.lock
              • Path /data/data/app.android.ninestore/files/idis031s3331ddsn.lock
              • Size 17B
              • SHA256 3e29c20157e047b7b1e76047fbd42448f1ab90f04ba0e758c6dcc5731a217cd4
              • MD5 SHA1 SHA512
              Submit Download

              libsgmain_1505404302000.zip
              • Path /data/user/0/app.android.ninestore/app_SGLib/libsgmain_1505404302000.zip
              • Size 109KB
              • SHA256 0e80e2a10be28aae371f7e18915d0554b8b42980d00feafb387fe40fa38e6549
              • MD5 SHA1 SHA512 SSDEEP
              Download

              libsgmain_1505404302000.zip
              • Path /data/user/0/app.android.ninestore/app_SGLib/libsgmain_1505404302000.zip
              • Size 109KB
              • SHA256 b5bf87acdd1a3ffe4831eddf7ec77f22922b1ea84c37ea674283fcfcafd1c6a5
              • MD5 SHA1 SHA512 SSDEEP
              Download