33b59cb04a227fc9ff532be9558ee53dd4cd298084c86d47ef002cab09012518

General

Target
52150bd2ffc205df1fba690bdfb993c8_JaffaCakes118.apk
Size 1.9MB
Sample241017-pvsdxsxfla
SHA256 33b59cb04a227fc9ff532be9558ee53dd4cd298084c86d47ef002cab09012518
MD5 52150bd2ffc205df1fba690bdfb993c8
SHA1 5a29c86ac00cd4bcffd33dda9ef75af55a713c6b
SHA512 defc63529b40ba814d03902b4e38f408dc15c635288fa9b33e9b6c053b09f8eb5c89dfb14e676064541a17131bd83ab25a8f69fbf22d655042ffffcdd45e1d36
SSDEEP 49152:O9fmd9oi38LzMPOm/LXFAoqPcplVsbFF9VsbH:Olq9og8LzMPOm/LqoqPcqbF2bH
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection credential_access discovery evasion impact stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4641	com.snow.system

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.snow.system/app_ttmp/t.jar	4641	com.snow.system

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.snow.system

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.snow.system

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.snow.system

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.snow.system

com.snow.system
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:4641

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Hide Artifacts

1

T1628

Suppress Application Icon

1

T1628.001

Virtualization/Sandbox Evasion

1

T1633

System Checks

1

T1633.001

Credential Access

Clipboard Data

1

T1414

Discovery

Process Discovery

1

T1424

Software Discovery

1

T1418

Security Software Discovery

1

T1418.001

System Information Discovery

1

T1426

Lateral Movement

Collection

Clipboard Data

1

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1

T1471

Data Manipulation

1

T1641

Transmitted Data Manipulation

1

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

t.jar

Path /data/user/0/com.snow.system/app_ttmp/t.jar
Size 204KB
SHA256 f6d61651b9d98903a4f98527c8a9b29eeba0669b5863d318dfb1c136a251522a
MD5 ced97d7f67335f8cc79951ad24a7afb1
SHA1 f90489478ae0908c508fdcfd11c7a423fb52705f
SHA512 b15e5641abaafee45b3aa4b0d7967e6590167c920fa7104dee896ec66633b2bafcb378886af0df68536f4b7d2fd1d1387889d7f1ec779dbd00b19bdfe1c62848
SSDEEP 6144:s4TIsts5T85gUQstLzttU1h9M3w4jigs6B:6scoFNEPIwMs6B
MD5 SHA1 SHA512 SSDEEP

Submit Download

t.jar

Path /data/user/0/com.snow.system/app_ttmp/t.jar
Size 430KB
SHA256 f2fc43ab889a884238f93766693fe57050457252b0b4aef63330b1b672a3ed69
MD5 a2008b3fdabd5bbe056b6b152d07d4df
SHA1 ba1c50523db4390d811653734cb8cf93a2afc008
SHA512 adb1f1ff2ad53df14b86ffa000ff744e52e2dedf39eb3f0cf2969fe56635a8dfb13fb7be7bbf265d7646baf104d1bbf902968682aef55ab971dd40fa180733e7
SSDEEP 12288:HBsV4ORw7I9Wz7rX58S+t16nkFP6SWaNElHRr:hst2Z
MD5 SHA1 SHA512 SSDEEP

Download

com.snow.systemb

Path /data/user/0/com.snow.system/databases/com.snow.systemb
Size 72KB
SHA256 cb89aa2fb4006bb386699ec9e6e1170bae3feb98e6739560d102074679a352b6
MD5 edb535786ec6e8ca100ef0c5d2904e43
SHA1 cdc91f7f5bbaa007f8734abdab080b7c6c1855c3
SHA512 57f86360907efaf92ea005007603539dfda5fb5eab84506522bd09082aa1ffb08efff9a1348534cf18d8abf9e6c1f737b32cb5d8be83e2a07f2fb8080492e02d
SSDEEP 48:Ttj22dti3Hi6MbmX9MJbUKZb9pMJbc6sNd7UMJbEyAsInlnIH2bmX9MJb8O18OHD:vti3H4mtqb9brqborIqb5cQsmtqbxJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.snow.systemb-journal

Path /data/user/0/com.snow.system/databases/com.snow.systemb-journal
Size 512B
SHA256 b928d1e11f8b952eed306a258596a94ff3387454f3e7941eb94a31c8e1afba84
MD5 8ad26bc32edfdb523cd6c533d77de6c9
SHA1 9a0365b78db2ea5dd82cf07af91ba709b2dd5b59
SHA512 912929a18c0f7da479d02dfee629c444eb035925bad07146beab8182d2c831ea1e84748a839ec0fac5a09ccc721d2fec711e3f7c1a18a3cc8b3f1d72204bea2c
MD5 SHA1 SHA512

Submit Download

com.snow.systemb-journal

Path /data/user/0/com.snow.system/databases/com.snow.systemb-journal
Size 8KB
SHA256 8bdc7618fbab8e0b841cbd546a60e9bb6c8ebec15ea488710e50a4bdf75f1912
MD5 78852fd0d7fe19a8bdaebd45692bcea4
SHA1 8d330fbb386622298462d50ad4c4dadd54ba7239
SHA512 ecf478243368126f09738145492ed77a358337ed7050cbc64f4aaadc7db830dcc614a64c64c20a35a4bb744cb5cc5229f8932b00f6d7b470d40503450cf580bb
SSDEEP 6:7+/l9GSlFn1EsWg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKd:7+tcS2qLiuWdYRmBEyPbe
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.snow.systemb-journal

Path /data/user/0/com.snow.system/databases/com.snow.systemb-journal
Size 8KB
SHA256 d53e01c0f1cf38437c2e7ec81f62b459fda0d1c19d33eda767166c3ec792b7a1
MD5 62b78217bbc462c001b95f05b0610d36
SHA1 91b44c856cf97736c40e16fbf2fceb98b1b659e4
SHA512 6f9dbb622e2e1dbf62082a2c80c8cff17ec1dfbd610eadd0cb5f7c6a81aa5aa4404f3c8d0e98d98e9c7137842d981540eeba34a47017f105a1ab72807aa5cc98
SSDEEP 6:7+/l9n2GPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuK4Z//G:7+t46qLJdeWRmBEyPbV/G
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.snow.systemb-journal

Path /data/user/0/com.snow.system/databases/com.snow.systemb-journal
Size 12KB
SHA256 72b71a1fbdb2b4d567e6ea1c58e2b134a7b9d00e6f7a1ec4c905e2db93f957fb
MD5 cfa15638bea8e649e0fdc1dae8896a10
SHA1 e95e81c46981b757b44177bd3108a19506810df7
SHA512 c41963815d901aaca84ffb2fe7d4e9208e1fb95e4f5c86428964d1cf767b82bafcd480fbf557212badbf4f8d15d54da9bbaa7038be51ecbe7765e3b2d5d05e51
SSDEEP 96:7aqqti3H4mtqb9brqborIqb5cQsmtqbx2:7vqaokY
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.snow.systemb-journal

Path /data/user/0/com.snow.system/databases/com.snow.systemb-journal
Size 12KB
SHA256 ad2b2b5cfb8ebfce0f45561bc3403ce3b0e7d89149d3becd46deaec61137c1f5
MD5 908a7e1dabd1becc5c54d76dcf87d9d8
SHA1 e26a4b4478fbf47339e7c0b6d9566773c67f256e
SHA512 011ac7de7d16c493a5579a9b3a08cbc5678b4298b1e9cfc83598f3cd0501f12f192e941c565feef97bbe7b76c8aef9be54f50a964c808236fc35cc012d4c49bb
SSDEEP 48:7M/qd22dti3Hi6MbmX9MJbUKZb9pMJbc6sNd7UMJbEyAsInlnIH2bmX9MJb8O18K:7eati3H4mtqb9brqborIqb5cQsmtqbxp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads