Analysis
-
max time kernel
149s -
max time network
130s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
16/10/2024, 13:59
General
-
Target
4d378b4fbf06a8d5065b4014a5be500e_JaffaCakes118.apk
-
Size
3.1MB
-
MD5
4d378b4fbf06a8d5065b4014a5be500e
-
SHA1
8bbf8e73a24da31a640566ed5c54ae3803c32c4c
-
SHA256
71c5bd9ef412ea0602a910f63f4baa556719cb901dc6c8b952e7d513cb9061e1
-
SHA512
50e70ce7f1df95adffe897982488185e78a5e8b7ed78bccb41e991cdd987d431e88b7cbcabf92e87d54fc7604f3ac106eb8f4e299a0d8f011bd1c7ad94ca7599
-
SSDEEP
49152:NzjEqZRVabFZ50iXeo7+QM7L8d1WqWjkztOGQUZMbNCTSzEJlD5CWJOlh:NzjEcRVaxZ5reU+ROw0ZOH2Mbg2aJM
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes
-
com.vtzwnmsy.tnfvuqs1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.vtzwnmsy.tnfvuqs/code_cache/secondary-dexes/base.apk.classes1.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.vtzwnmsy.tnfvuqs/code_cache/secondary-dexes/oat/x86/base.apk.classes1.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
378KB
MD513fe824b034f033c8b1bbce59c148061
SHA1f64ddf99a307194a97096e2a19b69c2e4873e39f
SHA256dcbadb2b0fc4beec3fc2f4e35353b11f4fa655353fd5a3bd373a924aa4b6b148
SHA512006a92abbc2d6ead2079d6289ae03a6b340ab032525de1ba984289605df4eb1c34201b71100fa1a964a79342deb6416fcf47a0a90b35f804c440c1f5570427ab
-
Filesize
902KB
MD51f6adcec6138bc84d587fb52c2dab579
SHA15703a91551233137d7c102ba092a03b647efdf3f
SHA256438dd1e72eb8c8eae59ef9e873e73c80cc05cc4027395b165645a99c819dbf98
SHA512a8d93cafdb4f2770a3427b7ab098167696c9441e9bd8d8e57a58b9b38ab17ef29ad5ab45ade7053ad43d2e4cf77ac5009fc28456c0b0e8cd11d9fb1cbe424481
-
Filesize
902KB
MD59a483ca96df2aea94a76e3c19fb9d411
SHA19c9ebbc27ce96ff633cae691354d3d9be7e5a4b1
SHA256f152903e9205a206f7508688522536e84f0624ce63435100fcaeb0cb761d2092
SHA51267c2f06298ae776c199a232f0d5759a3d18b77acedcc2ef623a08383be3300145738a224a40b5684d2548084043f17a68b2a4ec664d0d42025c4f242ddf0c737