f02f9b3a9abd8913886f6632e9a2342cca30003b3a6e66d9463f728cf77018e3

General

Target
5002fb5f1daff7468f480004fb81c4d6_JaffaCakes118.apk
Size 1.3MB
Sample241017-bdqbcaxann
SHA256 f02f9b3a9abd8913886f6632e9a2342cca30003b3a6e66d9463f728cf77018e3
MD5 5002fb5f1daff7468f480004fb81c4d6
SHA1 a783a51d6b5a8e46a1dcf4ada014443754d61f06
SHA512 abc2d4c05d353c2a30b3b859000e1bca52d66932bba9f14bf1b078a6baf4d33a7315a91c83804f6cb9ce161d9c30010aeeb113b2651cf372762e0bd0b0cb20ba
SSDEEP 24576:tzMCZwn/LWnzfUZ7c8WLxIaWCJRYTaymovinFlKgKi1LcleUV9:eCSnzWnz8Kx5WE+aHrFogKiNclee
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

banker collection discovery evasion impact persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.cool.mytaskkiller

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.cool.mytaskkiller

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.cool.mytaskkiller

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.cool.mytaskkiller

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.cool.mytaskkiller

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.cool.mytaskkiller

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.cool.mytaskkiller

com.cool.mytaskkiller
1⤵
- Queries information about running processes on the device
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:4995

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Execution Guardrails

1

T1627

Geofencing

1

T1627.001

Virtualization/Sandbox Evasion

1

T1633

System Checks

1

T1633.001

Credential Access

Discovery

Location Tracking

Process Discovery

Software Discovery

T1418

Security Software Discovery

1

T1418.001

System Information Discovery

1

T1426

System Network Configuration Discovery

3

T1422

System Network Connections Discovery

2

T1421

Lateral Movement

Collection

Location Tracking

1

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

vdownloads

Path /data/data/com.cool.mytaskkiller/databases/vdownloads
Size 16KB
SHA256 819dc857f87812e465bd3f14cc8238edfaa4ca9831d33751552d518f6ae846a6
MD5 9b189529fa9f46f1f64a0c4832be6e8f
SHA1 e8226c2e92047586e7510212afad35c1b6d18be7
SHA512 c86fdd0f19cd3a0d05cebb1ddbbcfe5bb3a55730700a91cda75334fd14f3be22117868b86cdbfb7762bb6b68f272afe721c6ad42f662328283f58eaaf1f0f388
SSDEEP 12:TLpqqwn2oX6eWQ6XJ6IVIvlqeRmBEyPbBvOw:TL1wlSQ6XpIvAGSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

vdownloads-journal

Path /data/data/com.cool.mytaskkiller/databases/vdownloads-journal
Size 512B
SHA256 cd28312adc7151a43d1220207c5ad646a81c41e3437d98ec482dc38a83dcc817
MD5 6c2c0cfc440a0f984baae78893d60023
SHA1 bcf81d63fb764b919babb8bcc896caf89203e1d5
SHA512 22a989d12c154cf186c877f40deb8a92bdc951c15192d313d72ad005b433ef5a8a36939571d0a6c9265457d792230f80735a39e2a49d64198c92eb1bb46301c2
MD5 SHA1 SHA512

Submit Download

vdownloads-journal

Path /data/data/com.cool.mytaskkiller/databases/vdownloads-journal
Size 8KB
SHA256 466ffeac88650980024d37620450790b9b4674fccafebc91c6cb11e81f50ec70
MD5 0b37838c61656c29f8fb4ba0f03ead82
SHA1 88c4fa91817004137baedfaf059d6462234d2fad
SHA512 b22ad4c7e9bc592e2554b9f222cf0e4af277f93c75298a362eeb3d403b8d7b8a02ca68f188561b85f1388eb6b094a58508d3c9c646ef5b8696a1a87b2ffd3454
SSDEEP 6:7+/l9hmn1cUfg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuK6v:7+tsfqLiuWdwRmBEyPbLv
MD5 SHA1 SHA512 SSDEEP

Submit Download

vdownloads-journal

Path /data/data/com.cool.mytaskkiller/databases/vdownloads-journal
Size 8KB
SHA256 7ad613841398087ed54b35063dc3ebcbe15e6303e4add25df10da4fb2b330bc4
MD5 86a7fbd2ffebe9c3ed1361bac872b659
SHA1 ce4a239266c8fa14d58ecf2830f7a1a01653ee84
SHA512 aa6e9242c0721df034a85ea238882a9fc9cad31acf81947a9f97c82bf16aec0239f0f8da9a5231bddba19da6e4585ae7b4cb773fb1519d9dc1471558909a6da3
SSDEEP 6:7+/l9qPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKEM/zn:7+tEqLJdTRmBEyPbTsz
MD5 SHA1 SHA512 SSDEEP

Submit Download

.vapp.dat

Path /storage/emulated/0/Android/data/code/.vapp.dat
Size 820B
SHA256 4367c5f61cd96e32bd014b24d23e4d720308150d9c101cb711fd8479f39ccbe1
MD5 87e6d328014546e0270d63d9d145e27a
SHA1 3718a1b4035a37f461e070e40559d981826c30df
SHA512 4ff2284d97866a4704b3c382034f45e9ed1c29f838982baa85f3bf99e8a918773c17cac409fe870a87440c56ab7b17dbef1b38a20394aed758332b8119b36684
MD5 SHA1 SHA512

Submit Download

clearT.dat

Path /storage/emulated/0/Download/vgp/clearT.dat
Size 51B
SHA256 13490eb9a97b802009eeda505b5907a95704eb90adabfcdcf4db73a16673872f
MD5 76dc1c37414d15df0805970269c2d01a
SHA1 b88985647aa28642bc83104e5b0aa3f30170f27e
SHA512 00914b2d0d56c80794c7dbd1ccc2a8e375c69a457315de177f5ca4c9030597d6cbcc663e9ccdfe5e7457173282da830f56f134c63db21303327391b033b7bf21
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads