0b8864054b8bd58b7e42440dd9736392c015959841232ea044998d877b7c743f

General

Target
50fbf3ab78b4d360d866d035b2928b5b_JaffaCakes118.apk
Size 1.7MB
Sample241017-gs73laydln
SHA256 0b8864054b8bd58b7e42440dd9736392c015959841232ea044998d877b7c743f
MD5 50fbf3ab78b4d360d866d035b2928b5b
SHA1 59352838ff4ca751b8aa4b6b5ac7e79b042d760f
SHA512 24664144a9dfa240807195739d2267dc781a06b6507279dca3436414bc65e90b1c45d44c2f544a3da975db458c4145f1c5809a1daf0e76f8a4e795c44991ad0c
SSDEEP 49152:/y9PIPzWch8sRtJbYVx2FpJIXsK2DLLbH:/y9GzWk8sRtJbYVxMJI8K2DLP
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection credential_access discovery evasion impact persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
5144	com.ggbbhh.kknnmm

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.ggbbhh.kknnmm/app_ttmp/t.jar	5144	com.ggbbhh.kknnmm

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.ggbbhh.kknnmm

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.ggbbhh.kknnmm

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.ggbbhh.kknnmm

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.ggbbhh.kknnmm

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.ggbbhh.kknnmm

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.ggbbhh.kknnmm

com.ggbbhh.kknnmm
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:5144

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Hide Artifacts

1

T1628

Suppress Application Icon

1

T1628.001

Virtualization/Sandbox Evasion

1

T1633

System Checks

1

T1633.001

Credential Access

Clipboard Data

1

T1414

Discovery

Process Discovery

1

T1424

Software Discovery

1

T1418

Security Software Discovery

1

T1418.001

System Information Discovery

1

T1426

System Network Configuration Discovery

2

T1422

Lateral Movement

Collection

Clipboard Data

1

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1

T1471

Data Manipulation

1

T1641

Transmitted Data Manipulation

1

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

t.jar.cur.prof

Path /data/data/com.ggbbhh.kknnmm/app_ttmp/oat/t.jar.cur.prof
Size 661B
SHA256 50ddcbb927860453579d3ae414134fe948a4f0606a9cd3ad8c3deee89aba9b2a
MD5 a977e65e73e41fe912bf040412297481
SHA1 964168bdb820c2aecb98e0eda4c0577d2d4009a0
SHA512 be887708103c135f30f376a9491a2e2d2d53f6e85ab7091d85932f0a35cb31902e6fca69bfbd341808ee4ec6f8d54af92c04c53f0d8e9516c47c129a8c9cf833
MD5 SHA1 SHA512

Submit Download

t.jar

Path /data/data/com.ggbbhh.kknnmm/app_ttmp/t.jar
Size 204KB
SHA256 f3d75c6714fdea7a87d23b5b9ad9f59af657c46ed0455945591d01144221f785
MD5 b5b834b9aa743224e0e2c54a498027a6
SHA1 0aa139461bb9cf413c0b319eadb0181e9f0e6e72
SHA512 4279ec5a528624682116c0b3010af359f5bcc44d00b593784bfb0680ee79a3b5115c0c70f296c4747fde0157947ceb944ece71bf4be1e440a53d6f418082dae4
SSDEEP 3072:ELk1PafnXuD4wCoP914DUWyomxPMMGcizYaDKkMPzOUd3SEs7ev/NPRKQ:EgkWDZOuoaNiXKkOznv/tT
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.ggbbhh.kknnmmb

Path /data/data/com.ggbbhh.kknnmm/databases/com.ggbbhh.kknnmmb
Size 72KB
SHA256 56e6b963548009bce01933faa241ff8581d2668b2724701c90c1e263daf2a4b1
MD5 3c909c3295cc2f2ee5e051f856e8ccc2
SHA1 35fe5d9defe43ea19a0af2a6663435d56250280f
SHA512 d551966ab8d37ada3c79de2a6cd110313408321407d0823f8dccce3c622116eea9a5ddaf2b0fabed523863a588520d10e5175ac2866e7a9c97031540e8941c96
SSDEEP 48:TAi22dti3Hi6MbmX9MJbUKZb9pMJbc6sNd7UMJbEyAsInlnIH2bmX9MJb8O18OHL:soti3H4mtqb9brqborIqb5cQsmtqbx
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.ggbbhh.kknnmmb-journal

Path /data/data/com.ggbbhh.kknnmm/databases/com.ggbbhh.kknnmmb-journal
Size 512B
SHA256 6576fc2ac4df57c82a02e453d46d7f7f046b36f37e5a794bee7af99c219152de
MD5 178f09593f2e51a79722ca1e45ef092e
SHA1 65cb82c5691e1a4c42b09f3aa7d7559298ccb0b2
SHA512 6f16bd6c305947d83aebba0eda0d68e75011d6f66f76b633816b767d669b41786d9b0383a52d9f085c28d36a28a28f9b3d5ff02ba9c257f96d3ad1730070e70e
MD5 SHA1 SHA512

Submit Download

com.ggbbhh.kknnmmb-journal

Path /data/data/com.ggbbhh.kknnmm/databases/com.ggbbhh.kknnmmb-journal
Size 8KB
SHA256 86619f53a4fcd95a73964c3465574f0f5b45390c6b4ee06121258b89d8299eab
MD5 a8a6c2cb6e841dcb93b9aab9521d1017
SHA1 d131cbd34ba7122b70459e4967ab9ba9f2e4b7cc
SHA512 678415b310712ba532a50ff1a3cc6423277922b0771b1cef6621da5a3fd79c2c42b0efa6891b9a6f7dc2f5d1a9e42a2a13bd3b873e30833bf1da389fc39a7861
SSDEEP 6:7+/l9punHn1YkRg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKy5n:7+tzEqLiuWdwRmBEyPbD5
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.ggbbhh.kknnmmb-journal

Path /data/data/com.ggbbhh.kknnmm/databases/com.ggbbhh.kknnmmb-journal
Size 8KB
SHA256 8b8a96b2bbb2b8d4b13ec8d4deeb614f27b0c7e57a3784d1de6f0a553ac13db8
MD5 71114fd3962aebfc8bdd1ce4825e4f47
SHA1 6beef26d7699154e321919fd599afda87578d0b0
SHA512 559f8ced33f8262b4889df8febd73e8b8d78d907e9ce8777fd82ac11b4d86be500a39cabf50ced823f2d2ada0edd8cc27163de6c2ce8f955e1732cce4f2c8cde
SSDEEP 6:7+/l9lmOPg9bNFlLdrlOERX4PBX4ogLugMBX4suuK+7L/U:7+t5qLJdTRmBEyPbP7DU
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.ggbbhh.kknnmmb-journal

Path /data/data/com.ggbbhh.kknnmm/databases/com.ggbbhh.kknnmmb-journal
Size 12KB
SHA256 17095c67057710a676bea2af03bfa5fefa3d8786c03697e0d02774366f7331e9
MD5 b3e8e679d3872cc420b373c8ae3861b6
SHA1 b5c4205e8b6465d510bcd5bc75a97390f99d8f2a
SHA512 a44bb3b2f7e00add23b554908553cc36a4ef2f405b0a23870e33374c69c15a430f6fa628d6b24bae8e9433f628469660f9b31b050e8b5a32bc797ab316014719
SSDEEP 48:7M6aq122dti3Hi6MbmX9MJbUKZb9pMJbc6sNd7UMJbEyAsInlnIH2bmX9MJb8O1V:7CCti3H4mtqb9brqborIqb5cQsmtqbxP
MD5 SHA1 SHA512 SSDEEP

Submit Download

t.jar

Path /data/user/0/com.ggbbhh.kknnmm/app_ttmp/t.jar
Size 429KB
SHA256 5ddbb135ec94ce685aa77fbcc2bf55baa302352412f1aa6dab65e5b106d58b37
MD5 5c378feb2c7ca01c5c732c29224e0988
SHA1 df37762244c06461d9a6855230a769472b0cd9bd
SHA512 eccac7c73ed0bdd00e1188e4856db1b147d38ffa6fc09aa10597089bd73ccdaeceb64d9d529f321663fcdf15f992146df81ad03d2d4f7c6abcc4fb02d314b861
SSDEEP 12288:VvI/d3B+i41n3ys4U7zt6TUx7q8pBNvAK2Qq:Vw3EoT
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads