efe9a312cca9f2581932cf2a3b53b278435ce4aebe57be5281c9b1bf8e84f373

Analysis

max time kernel
52s
max time network
142s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
16/10/2024, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4b61749e9f76b1161c87200a079ff3c1_JaffaCakes118.apk
Size 901KB
Sample241016-e1dslswgkp
SHA256 efe9a312cca9f2581932cf2a3b53b278435ce4aebe57be5281c9b1bf8e84f373
MD5 4b61749e9f76b1161c87200a079ff3c1
SHA1 1355b7d361023cde77654c80bc49f2d672bb374d
SHA512 9013d13c8b0a2c3532efc0b132a81308fd650c70ab162aefb6fe22fe3873967de16cf72fdcb30b251c752529c9ab2c0402e1301ace24e9517a36f73120a64c5a
SSDEEP 12288:bGWzszq7SWaGRcVb7AXh2oRjyOifSiRZ/sY1PK9g5n/y+86qarlkyLpMvEqucbtm:qzpGwAx2oRjF5i4TYlxJmgHwl52j
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection credential_access discovery evasion impact persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4980	blue.kygz.xyzlc

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/blue.kygz.xyzlc/app_ttmp/t.jar	4980	blue.kygz.xyzlc
/data/data/blue.kygz.xyzlc/108classes.dex	4980	blue.kygz.xyzlc
/data/data/blue.kygz.xyzlc/108classes.dex	4980	blue.kygz.xyzlc

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	blue.kygz.xyzlc

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	blue.kygz.xyzlc

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	blue.kygz.xyzlc

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests dangerous framework permissions 4 IoCs

description	ioc
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	blue.kygz.xyzlc

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	blue.kygz.xyzlc

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	blue.kygz.xyzlc

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	blue.kygz.xyzlc

blue.kygz.xyzlc
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4980

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

108classes.dex

Path /data/data/blue.kygz.xyzlc/108classes.dex
Size 40KB
SHA256 f9cc117bb6368307eac084e06c726db5b0100248573cff014ec09319a243045a
MD5 da60aa3b5c68f3487a9d10df182b5248
SHA1 3e5894725f064a324cbafe48d6e45bb8faa3ae1e
SHA512 83baf5fa8a534c918cfc417f871d01c0dd3c8866011719b120bec16471ccac11baeacd9d97ae1ce40c62807af109394691cb9eaab798a4d505a06d826bc308bc
SSDEEP 768:lgDH1H1T1RZNchBNFCYcKjZY6aCKKNEtlx:kVVR2LCYc2nKSE
MD5 SHA1 SHA512 SSDEEP

Submit Download

t.jar.cur.prof

Path /data/data/blue.kygz.xyzlc/app_ttmp/oat/t.jar.cur.prof
Size 398B
SHA256 21b91f063c593cdb26a237a8dcf96a64f1d148ebac0590132e6c103560cd288c
MD5 a3d7902f242ee2ffbe345a31333925b0
SHA1 8fe8eb763d78c04620cf9e169fde56645d9ec9c3
SHA512 f9e8ad5e8181e70848055d436c353084b25830de417d0076315065ad4bf5b24dd075acef7b9266d22f5c71529afebfff7d4e1e9537199a8f1546e131a67c784a
MD5 SHA1 SHA512

Submit Download

t.jar

Path /data/data/blue.kygz.xyzlc/app_ttmp/t.jar
Size 245KB
SHA256 5e68f3531088064093d2f7db6b910e5d2c1c1d36af8a41c6e3f5d33b5497ba40
MD5 a4fa004c442c1b1f9d03c680472abea9
SHA1 150906f8721b781c828ff829b898be19b860bc9c
SHA512 121c8a160aab88245322ed4359dcf4fb666fceaa3ed815a968e294ac6fe990ae850221efad413acbbc741f433e2db3e905b6176594200c435754efbdc48bbfca
SSDEEP 6144:oFp0pdjLSFzyXkg02kTU0wAEY5Qhc1sK1735O:oFpodjS28USEYa+k
MD5 SHA1 SHA512 SSDEEP

Submit Download

blue.kygz.xyzlcb

Path /data/data/blue.kygz.xyzlc/databases/blue.kygz.xyzlcb
Size 72KB
SHA256 cd1edc95a767f442656b52828b20b76cf611b3cfa7b77a7e0c3459376caf969b
MD5 98fb9a33c320cc2a7d3bec5f3637b5a4
SHA1 dc4cacdfac7d6b4addb6e2d992178b0d954d9b81
SHA512 fd44734232de8d74bbf6e87fd6af7eae7ec038d23a57777ec37e4d06bff05b799771d74a99587d9a286992c8b19f1a5eb40b29fc97f38352ce91bc54d0971a1e
SSDEEP 48:TAi22dti3Hi6MbmX9MJbUKZb9pMJbc6sNd7UMJbEyAsInlnIH2bmX9MJb8O18OHY:soti3H4mtqb9brqborIqb5cQsmtqbxK
MD5 SHA1 SHA512 SSDEEP

Submit Download

blue.kygz.xyzlcb-journal

Path /data/data/blue.kygz.xyzlc/databases/blue.kygz.xyzlcb-journal
Size 12KB
SHA256 3d16f20f7ec1713e81a08f1e3601e85f636dc049d88513a60644b44cd47e440a
MD5 c8c99c08ac2ee850f7e2fdcfe7ec1740
SHA1 3ab851c84c1c72109d907056b0d8c22b07449565
SHA512 177bda88de13f4679fd463e7fd551725263526cc180938b196603588fda8aea1c3150ffcbba7ad3a6ea87c47b35495cd681df6170f6e006996727fec9ec2527d
SSDEEP 48:7Mjerq122dti3Hi6MbmX9MJbUKZb9pMJbc6sNd7UMJbEyAsInlnIH2bmX9MJb8Ow:7DCti3H4mtqb9brqborIqb5cQsmtqbx8
MD5 SHA1 SHA512 SSDEEP

Submit Download

blue.kygz.xyzlcb-journal

Path /data/data/blue.kygz.xyzlc/databases/blue.kygz.xyzlcb-journal
Size 512B
SHA256 7a1a0c25c2352673e6f8bdb84b7175b35d56ffea705db69a9416faa9fec549ca
MD5 da76d25452d8d9e576aa3fe93892ac63
SHA1 d6daf3a963bc1502fc1fb301f04747fc46dd33ce
SHA512 694848355b51ef934e7e75e1d16d4c54c6de6519d828d5a7010c91b96fea3b6a782e0e1e98b4afe4db91775af036d677f2b5b34bd2787db336b0837ecc596778
MD5 SHA1 SHA512

Submit Download

blue.kygz.xyzlcb-journal

Path /data/data/blue.kygz.xyzlc/databases/blue.kygz.xyzlcb-journal
Size 8KB
SHA256 db123d357a4a365ffec3611c393802528f86248cac3c54b36eca546d6ad74f9d
MD5 b8497df1b88d19f4c9f6f2c9d31cdbd5
SHA1 e4db600ec0a68a65b8a7310b77dbb1f86070c3e9
SHA512 b84e9eb1faf36d7d40963996577af59c0288e5b8f51fadccbbe0d90c4433b6d04201a40e4afd90d4bf29b5998bddbd86cf3ff1a2ed79efdba97fe2dde951a2de
SSDEEP 6:7+/l9JOn1bg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKWkwn:7+tzUqLiuWdwRmBEyPbJkwn
MD5 SHA1 SHA512 SSDEEP

Submit Download

blue.kygz.xyzlcb-journal

Path /data/data/blue.kygz.xyzlc/databases/blue.kygz.xyzlcb-journal
Size 8KB
SHA256 f1106f67349311add43c4fb7dbf7d403e87b42083bf9cd465da149dd22ec8a83
MD5 2afc04b9e3e39df0045079dd73fb9ba1
SHA1 ad7a20cb2b50cd476564e016e815d80b3c8fe305
SHA512 d88fad85ed28df12e0b16671b8a065aecbbbb47de3a2360929b7fd1f1b67e325f4ac992422d410b9b907b1be7e9949f2c3b5c6b6e109134cfe9ab6e7f80e17b6
SSDEEP 6:7+/l9UDHPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKCC/cA:7+tmvqLJdTRmBEyPb1ScA
MD5 SHA1 SHA512 SSDEEP

Submit Download

t.jar

Path /data/user/0/blue.kygz.xyzlc/app_ttmp/t.jar
Size 520KB
SHA256 a79da805fb30cf928952881382e90990411dbdf3d798689b8f11bdff30431def
MD5 b12e59de2d05abb2e1fab5888aa622ce
SHA1 3314d766a8b1b8abc671651a709ace1fc412d90f
SHA512 398bbfb55895db3a9282aef307ed2600b01d5d141a8405773076f617ad2f9ce8aa2d904f30eb41fbefff736fe0f82b85eddfd9ded3086188ba8db82429e08444
SSDEEP 6144:GzI9aCVFUzYHoIQkERklmKRflznOmkuscHgUqRwcJn9Ny6bWPHg85k1A9REwNok7:kKbZ6RfWdamtsHUkwcJi5k2HZNgZS5
MD5 SHA1 SHA512 SSDEEP

Download

main.apk

Path /storage/emulated/0/Download/main.apk
Size 545KB
SHA256 23329aeb0775c7b8d8faa275e17d211155c004289b7692509f82ab15996a42fb
MD5 0bb49620423a34a3dc4dd68639c9598a
SHA1 c9501a05eba9cec781f362f689319fc328de1abf
SHA512 eb56156e4e406b0a9036ca7187eb0dd64e61d8250845489218eccd0a2c6fe13af79cff5377b84809b0b2a9ef955e31046bc3c40f79ca5b4e19922473a5a34ac7
SSDEEP 12288:4bZzIDlHLd6QJIlbyxZWF82lolp47bxi6Oa9Sxazz:WZzIDlrAUja82lolpiQ6Hn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads