33b59cb04a227fc9ff532be9558ee53dd4cd298084c86d47ef002cab09012518

Analysis

max time kernel
149s
max time network
158s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
17/10/2024, 12:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
52150bd2ffc205df1fba690bdfb993c8_JaffaCakes118.apk
Size 1.9MB
Sample241017-pvsdxsxfla
SHA256 33b59cb04a227fc9ff532be9558ee53dd4cd298084c86d47ef002cab09012518
MD5 52150bd2ffc205df1fba690bdfb993c8
SHA1 5a29c86ac00cd4bcffd33dda9ef75af55a713c6b
SHA512 defc63529b40ba814d03902b4e38f408dc15c635288fa9b33e9b6c053b09f8eb5c89dfb14e676064541a17131bd83ab25a8f69fbf22d655042ffffcdd45e1d36
SSDEEP 49152:O9fmd9oi38LzMPOm/LXFAoqPcplVsbFF9VsbH:Olq9og8LzMPOm/LqoqPcqbF2bH
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection credential_access discovery evasion impact persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4980	com.snow.system

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.snow.system/app_ttmp/t.jar	4980	com.snow.system

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.snow.system

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.snow.system

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.snow.system

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.snow.system

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.snow.system

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.snow.system

com.snow.system
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:4980

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

t.jar.cur.prof

Path /data/data/com.snow.system/app_ttmp/oat/t.jar.cur.prof
Size 540B
SHA256 84dd5cd5cd611885a41533bfc854ff9700374cd22226122290ffb3fdec16bcfa
MD5 f47094e670c17ab91872c33b47d8b383
SHA1 8ab310c081378c25efce446319d443f86f2b19e1
SHA512 c846e361f438895b7698523cde4ca079e19c53ec94cc0825969e9d36d9decaa6a6171f19bd74eee1fe617ce1dcc51e3e5cda8b35b6cfc9a6cd0a7ee79bad3b4a
MD5 SHA1 SHA512

Submit Download

t.jar

Path /data/data/com.snow.system/app_ttmp/t.jar
Size 204KB
SHA256 f6d61651b9d98903a4f98527c8a9b29eeba0669b5863d318dfb1c136a251522a
MD5 ced97d7f67335f8cc79951ad24a7afb1
SHA1 f90489478ae0908c508fdcfd11c7a423fb52705f
SHA512 b15e5641abaafee45b3aa4b0d7967e6590167c920fa7104dee896ec66633b2bafcb378886af0df68536f4b7d2fd1d1387889d7f1ec779dbd00b19bdfe1c62848
SSDEEP 6144:s4TIsts5T85gUQstLzttU1h9M3w4jigs6B:6scoFNEPIwMs6B
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.snow.systemb

Path /data/data/com.snow.system/databases/com.snow.systemb
Size 72KB
SHA256 886c2b5841c2962cc59a42e603d1e2b8715cb98c1dcad1af0bb1af8bf8110d0c
MD5 0a0c7e975a5a1c6e493362d0830382ff
SHA1 7ea172be9d5ae27f0970e2882e5fb99df31f9da5
SHA512 83a6ab417d2f4ac50b71ce8ab8feca74dbdef5fca2bb8f8becdfd92d693dacd031f0b7edac47b429920a6fd83cff10824f016dc20b12a0cdcdfeced54433040b
SSDEEP 48:TV22dti3Hi6MbmX9MJbUKZb9pMJbc6sNd7UMJbEyAsInlnIH2bmX9MJb8O18OHE1:Hti3H4mtqb9brqborIqb5cQsmtqbx
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.snow.systemb-journal

Path /data/data/com.snow.system/databases/com.snow.systemb-journal
Size 512B
SHA256 9b6d29311491a07fa83dcb18b096997da0c0eae0df140a085ee973547956dea3
MD5 6293198f9de124a4de9854692e9b85cc
SHA1 f50f89bd2ff59b8bc2c07a1d5c76cbb7065af1aa
SHA512 9ca8b0578c213201007813f457883d0075b17df0395a443344d0ed97bd2e718e4c96b1bb2ac9fdc841fdfa7093dd2bc708ee436e6b657f8236ca15b881f2fe95
MD5 SHA1 SHA512

Submit Download

com.snow.systemb-journal

Path /data/data/com.snow.system/databases/com.snow.systemb-journal
Size 8KB
SHA256 b8fd38985794761f98f2d2cf471af1019bd0469301e743595f1ad3f2ffe54850
MD5 5ca57b09ba431b3fbafac25d9ba975cb
SHA1 ab74d6fc18384eb81f8ba8bf0de101d93c47fccb
SHA512 69c02b2aa2a74c63fd3b6a51cb45ab914d86903a65bd9d9734982a385f59449d87d4df76beae12d1bc3db322c4d55fa26d6c9f4a0ba5645fe4a88cdbf7fe22af
SSDEEP 6:7+/l9qrn1yYg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKs:7+tsRqLiuWdwRmBEyPbr
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.snow.systemb-journal

Path /data/data/com.snow.system/databases/com.snow.systemb-journal
Size 8KB
SHA256 54a0cd0f25c9e4c21d667ffbe43d4cbda5996138dd56ec8dfa0ea5e549ece834
MD5 e842e7efc983220ee804c72f7eee7c29
SHA1 acae5bf926491111432ed989c6395c7cf18e9df3
SHA512 f7aab3d4cd6f41c33d9a1bcaf16a25c01152c4b7d988145de3e517a8accce6f71a99d6933c15107dc9ccb05c8b0db63400f651442b7e9079b4344575040e2c70
SSDEEP 6:7+/l9T7Pg9bNFlLdrlOERX4PBX4ogLugMBX4suuK4/k:7+txzqLJdTRmBEyPbLk
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.snow.systemb-journal

Path /data/data/com.snow.system/databases/com.snow.systemb-journal
Size 12KB
SHA256 b54bba44c5dfd49519d63b1adfe420823265188a8aa874cc41249ba673762387
MD5 76d6ed39b3df9da0445d7f1e7d16c2bf
SHA1 83d95bbb148f7f3d35544018a29864cad2e2468a
SHA512 ee0d26cf17c3458354d4da4ee9e318197ade180d2b0e86291c4f34f6b5030de7204e4b76b2ce69d814b925356db8eb691eec0c8a310860dcf37435e671ad7f7e
SSDEEP 48:7MGyq122dti3Hi6MbmX9MJbUKZb9pMJbc6sNd7UMJbEyAsInlnIH2bmX9MJb8O1x:7mCti3H4mtqb9brqborIqb5cQsmtqbxj
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.snow.systemb-journal

Path /data/data/com.snow.system/databases/com.snow.systemb-journal
Size 12KB
SHA256 30714842e6a6c9e08a41ac71a523e892d9fdc46cd8eae6eaa5e75207c133de97
MD5 4223fe13f27190292fd2bc2993af8237
SHA1 8d7cd15a6ec0c4edcd1c0c7999988e20f5a8538a
SHA512 92ddac090da6f4236c68135594bcda47089cfcf182cfd649c703abc143e9b8222901d3e7eea750434a317bbafcef7279541b03676306849b05158e272141fe97
SSDEEP 96:7ahoti3H4mtqb9brqborIqb5cQsmtqbxT:7aSaokN
MD5 SHA1 SHA512 SSDEEP

Submit Download

t.jar

Path /data/user/0/com.snow.system/app_ttmp/t.jar
Size 430KB
SHA256 f2fc43ab889a884238f93766693fe57050457252b0b4aef63330b1b672a3ed69
MD5 a2008b3fdabd5bbe056b6b152d07d4df
SHA1 ba1c50523db4390d811653734cb8cf93a2afc008
SHA512 adb1f1ff2ad53df14b86ffa000ff744e52e2dedf39eb3f0cf2969fe56635a8dfb13fb7be7bbf265d7646baf104d1bbf902968682aef55ab971dd40fa180733e7
SSDEEP 12288:HBsV4ORw7I9Wz7rX58S+t16nkFP6SWaNElHRr:hst2Z
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads