0b8864054b8bd58b7e42440dd9736392c015959841232ea044998d877b7c743f

General

Target
50fbf3ab78b4d360d866d035b2928b5b_JaffaCakes118.apk
Size 1.7MB
Sample241017-gs73laydln
SHA256 0b8864054b8bd58b7e42440dd9736392c015959841232ea044998d877b7c743f
MD5 50fbf3ab78b4d360d866d035b2928b5b
SHA1 59352838ff4ca751b8aa4b6b5ac7e79b042d760f
SHA512 24664144a9dfa240807195739d2267dc781a06b6507279dca3436414bc65e90b1c45d44c2f544a3da975db458c4145f1c5809a1daf0e76f8a4e795c44991ad0c
SSDEEP 49152:/y9PIPzWch8sRtJbYVx2FpJIXsK2DLLbH:/y9GzWk8sRtJbYVxMJI8K2DLP
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker discovery evasion impact persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4277	com.ggbbhh.kknnmm

Checks Android system properties for emulator presence. 1 TTPs 1 IoCs

evasion

System Checks

T1633.001

description	ioc	Process
Accessed system property	key: ro.product.model	com.ggbbhh.kknnmm

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.ggbbhh.kknnmm/app_ttmp/t.jar	4344	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.ggbbhh.kknnmm/app_ttmp/t.jar --output-vdex-fd=49 --oat-fd=51 --oat-location=/data/user/0/com.ggbbhh.kknnmm/app_ttmp/oat/x86/t.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.ggbbhh.kknnmm/app_ttmp/t.jar	4277	com.ggbbhh.kknnmm

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.ggbbhh.kknnmm

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.ggbbhh.kknnmm

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.ggbbhh.kknnmm

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.ggbbhh.kknnmm

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.ggbbhh.kknnmm

com.ggbbhh.kknnmm
1⤵
- Removes its main activity from the application launcher
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:4277
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.ggbbhh.kknnmm/app_ttmp/t.jar --output-vdex-fd=49 --oat-fd=51 --oat-location=/data/user/0/com.ggbbhh.kknnmm/app_ttmp/oat/x86/t.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4344

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Hide Artifacts

1

T1628

Suppress Application Icon

1

T1628.001

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Discovery

Process Discovery

1

T1424

Software Discovery

1

T1418

Security Software Discovery

1

T1418.001

System Information Discovery

1

T1426

System Network Configuration Discovery

1

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

t.jar.cur.prof

Path /data/data/com.ggbbhh.kknnmm/app_ttmp/oat/t.jar.cur.prof
Size 487B
SHA256 4bd07de04d1b34b759a0914b454bf3f27c5e6745fc116e315948c2dcdd23573e
MD5 5763650c880b376b5fe33a42c5fe55b6
SHA1 a34efe6acb4eb3345aeb52ab820f86d13a8da203
SHA512 95c491fc1f579dfe73a3671244eb21b1a92ef1be031efffb5751b63cca865e3f2b9d615fc786ad87bf929a0c2360013680938ddd6324c6b4384e77772a836fc6
MD5 SHA1 SHA512

Submit Download

t.jar

Path /data/data/com.ggbbhh.kknnmm/app_ttmp/t.jar
Size 204KB
SHA256 f3d75c6714fdea7a87d23b5b9ad9f59af657c46ed0455945591d01144221f785
MD5 b5b834b9aa743224e0e2c54a498027a6
SHA1 0aa139461bb9cf413c0b319eadb0181e9f0e6e72
SHA512 4279ec5a528624682116c0b3010af359f5bcc44d00b593784bfb0680ee79a3b5115c0c70f296c4747fde0157947ceb944ece71bf4be1e440a53d6f418082dae4
SSDEEP 3072:ELk1PafnXuD4wCoP914DUWyomxPMMGcizYaDKkMPzOUd3SEs7ev/NPRKQ:EgkWDZOuoaNiXKkOznv/tT
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.ggbbhh.kknnmmb

Path /data/data/com.ggbbhh.kknnmm/databases/com.ggbbhh.kknnmmb
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

com.ggbbhh.kknnmmb-journal

Path /data/data/com.ggbbhh.kknnmm/databases/com.ggbbhh.kknnmmb-journal
Size 512B
SHA256 b98b074d7362a6368b17a84f5ea809851c3f3d3c715c8587dbafffcb1a49f47b
MD5 7dd9aacf1f71361b9aa3b79ef9b4f783
SHA1 9eae1c8a3418b6b6279e9180462559428e59ce34
SHA512 f1d5b2c7c90b3be83381d82c0fb0ef0fe2510a372c005179ffc56bce565ca316c70c75c6719e0c7caf458e8842f9103cd0bf002b76b85cfd4a15afb18fd5a22f
MD5 SHA1 SHA512

Submit Download

com.ggbbhh.kknnmmb-shm

Path /data/data/com.ggbbhh.kknnmm/databases/com.ggbbhh.kknnmmb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.ggbbhh.kknnmmb-wal

Path /data/data/com.ggbbhh.kknnmm/databases/com.ggbbhh.kknnmmb-wal
Size 92KB
SHA256 d1b0f998c5cd59c3925a0e271cf160e7d29a502812f5c0a4e8d8d2d85fc84223
MD5 561fd8b614bb4374105135c1173becd7
SHA1 c988fa828e2cd9878badc41c63b55c944a4ef56b
SHA512 23d37544127d73d6c1e5515e6dc06e727f19477c56ddea1dbd9ecb957b478796fb6c49e9d193bb3bf048d1a81798c0925c9a86bf7dbc239a466f3287c47cd6fb
SSDEEP 96:b0Pcti3H4mtqb9brqborIqb5cQsmtqbxPZ0kV:UcaokRZ0e
MD5 SHA1 SHA512 SSDEEP

Submit Download

t.jar

Path /data/user/0/com.ggbbhh.kknnmm/app_ttmp/t.jar
Size 429KB
SHA256 c3b1a63ad6bdf0604d15d73c8c89d8d05bb07da9721d0c0ccf88125a6f1e51aa
MD5 f37be42713190ffbd8faae2ded7aa174
SHA1 5318510e9b3f412f15ccdc34b671b6dd60022a49
SHA512 f0ca83abc680b8f4332e81b621d2a67888750ae0d5849766762d5af9e6022933f68e721aaa10e333fb681f7eaa041a161e240d398d7def4e3552bc2deccd0fe0
SSDEEP 12288:VvI/dzqf4rlAjuWSthcy8kNM9BbNvAK2Qq:VwsfC8oT
MD5 SHA1 SHA512 SSDEEP

Download

t.jar

Path /data/user/0/com.ggbbhh.kknnmm/app_ttmp/t.jar
Size 429KB
SHA256 5ddbb135ec94ce685aa77fbcc2bf55baa302352412f1aa6dab65e5b106d58b37
MD5 5c378feb2c7ca01c5c732c29224e0988
SHA1 df37762244c06461d9a6855230a769472b0cd9bd
SHA512 eccac7c73ed0bdd00e1188e4856db1b147d38ffa6fc09aa10597089bd73ccdaeceb64d9d529f321663fcdf15f992146df81ad03d2d4f7c6abcc4fb02d314b861
SSDEEP 12288:VvI/d3B+i41n3ys4U7zt6TUx7q8pBNvAK2Qq:Vw3EoT
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads