728f09da3cf0dc9cb04ad949aecd65d2a2d8358bc1727743af929f7cabe86f6e

General

Target
4ebb4e668fe6ed19ab39b38465f44312_JaffaCakes118.apk
Size 2.0MB
Sample241016-yn56watapp
SHA256 728f09da3cf0dc9cb04ad949aecd65d2a2d8358bc1727743af929f7cabe86f6e
MD5 4ebb4e668fe6ed19ab39b38465f44312
SHA1 67228b59b4cffb2a7ff444aca0ab3acc0c30e27c
SHA512 868b56ea6ce4e7ca3b8c4d6fbb9048cc1c1141a42c15b39a58d48ba7b6c6f6b361357ecc07b687b4979dcb7d11e14b7e831d478ccd62e0b6164b30cd6d3e3d16
SSDEEP 49152:gkCdymkaK2E6uXU6hTDWGSWx4vOvlTMxV+JR:tj157XUMS44vONX
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection discovery evasion impact privilege_escalation stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4257	com.zhdfkohn.hgiruy

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.zhdfkohn.hgiruy/app_xdgwkq/ajhxnerehf.jar	4284	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.zhdfkohn.hgiruy/app_xdgwkq/ajhxnerehf.jar --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.zhdfkohn.hgiruy/app_xdgwkq/oat/x86/ajhxnerehf.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.zhdfkohn.hgiruy/app_xdgwkq/ajhxnerehf.jar	4257	com.zhdfkohn.hgiruy

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.zhdfkohn.hgiruy

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Reads the content of SMS inbox messages. 1 TTPs 1 IoCs

collection

SMS Messages

T1636.004

description	ioc	Process
URI accessed for read	content://sms/inbox	com.zhdfkohn.hgiruy

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Tries to add a device administrator. 2 TTPs 1 IoCs

privilege_escalation impact

Device Administrator Permissions

T1626.001

Account Access Removal

T1640

description	ioc	Process
Intent action	android.app.action.ADD_DEVICE_ADMIN	com.zhdfkohn.hgiruy

com.zhdfkohn.hgiruy
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Reads the content of SMS inbox messages.
- Tries to add a device administrator.
PID:4257
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.zhdfkohn.hgiruy/app_xdgwkq/ajhxnerehf.jar --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.zhdfkohn.hgiruy/app_xdgwkq/oat/x86/ajhxnerehf.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4284

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1626

Device Administrator Permissions

1

T1626.001

Defense Evasion

Download New Code at Runtime

1

T1407

Hide Artifacts

1

T1628

Suppress Application Icon

1

T1628.001

Credential Access

Discovery

Process Discovery

1

T1424

Software Discovery

1

T1418

Security Software Discovery

1

T1418.001

System Network Configuration Discovery

2

T1422

Lateral Movement

Collection

Protected User Data

1

T1636

SMS Messages

1

T1636.004

Command and Control

Exfiltration

Impact

Account Access Removal

1

T1640

Replay Monitor

Loading Replay Monitor...

Downloads

ajhxnerehf.jar

Path /data/data/com.zhdfkohn.hgiruy/app_xdgwkq/ajhxnerehf.jar
Size 765KB
SHA256 04c3ba91ea7bdc41704accfdb53883a0b20b402d09f1a1e47909ca36452fcf9a
MD5 9aff985bd58021620f1e8fa81e8ee439
SHA1 b59b6648842e467ccfa834b34200d91dc42badf7
SHA512 193d662cd332f83513743d229ade75a19bdd3f4e15bea4def98f5f22774c22eb3095edf56f139c3b8205614326607d8b29137a2045f214dc1e63348f6d4f039f
SSDEEP 12288:XebfMzFHczTKwJKvxcu1WxcvnzjZwBHF9KEDZvUVRg3NnaQHme7pMuZxju3DlM:+fMR8jKva8vzOP9KoiV0NFjMuZJ2Du
MD5 SHA1 SHA512 SSDEEP

Submit Download

ajhxnerehf.jar.cur.prof

Path /data/data/com.zhdfkohn.hgiruy/app_xdgwkq/oat/ajhxnerehf.jar.cur.prof
Size 226B
SHA256 53ace0e16b8dc0b853c1ea547a31fe6d111d219a507aea1821410060d69148d8
MD5 9517e064d6fe93b632c91c1bf9adac05
SHA1 3034c535cbd0252e19480aa3c89c1491be458814
SHA512 42e6a591b998ff1b7de959e17e4b7f471ce4cd29ec6e4c3a52d8b8366407d31d70cb37a8aa06207a6cf74b172ea47a6581f8d778c5f21e050be89169014c81e4
MD5 SHA1 SHA512

Submit Download

ajhxnerehf.jar

Path /data/user/0/com.zhdfkohn.hgiruy/app_xdgwkq/ajhxnerehf.jar
Size 1.8MB
SHA256 e298dcb145ecffdf9541111a2f30d2362a130c974afbbb84739a4c6c79651fdf
MD5 ad9bea362d899ab1c53af94f746b290c
SHA1 f9001f4fd2f0206f49872b26a9391423a4409612
SHA512 f3000e11ef6b264ddef9a39026534e234463b8c3e69c33230ff885dec63620f7bf3630126297f8e926c4146d36a9188467c13b7dd6eebc39ec17804bfcdeff99
SSDEEP 24576:AoSoxf6ysXRAbaaseYlDpjuiQJPrz2fuY1fm0td9pHxFdTXkWxPn:A9hBuSGYs0tPpHxTTB
MD5 SHA1 SHA512 SSDEEP

Download

ajhxnerehf.jar

Path /data/user/0/com.zhdfkohn.hgiruy/app_xdgwkq/ajhxnerehf.jar
Size 1.8MB
SHA256 c010bf1ee992f3beb04998f1804a53a4a94b353039dacab936cfe2e09f3274ed
MD5 4fae462233d6c669868104a3af68c50d
SHA1 b0e25601573244ee16c593e8236fce98fcb71f46
SHA512 033b3c2c67ba4a86aab59848a4d4686c10d002a6d5bd804e7802c0756c43caa85d58007f322c390d83ee5dcaf14ff2110036f5bf072528e5e9515ac1e93e8675
SSDEEP 24576:AoSoxf6ysXRAbaaseYlDpjuiQJPrz2fuY1fm0td9pHxFA6WM4171tYvSxPn:A9hBuSGYs0tPpHxq6T417z3
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads