Analysis
-
max time kernel
149s -
max time network
131s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
18-10-2024 08:04
General
-
Target
56520eabdbd97a436868305176e2d1ba_JaffaCakes118.apk
-
Size
3.0MB
-
MD5
56520eabdbd97a436868305176e2d1ba
-
SHA1
08fbc7b29cd3e9b414e81ca65b4c51ef2cf77825
-
SHA256
1c2695d5314b46ab77ff6ea879318161310d792f4e5339926bb0aa5dd5421bf6
-
SHA512
b8d84cded022bf776b9939aa3abd868eca6c4f6f532a9de2ce1e99c35e33445c519b22f0a1ee90674145371d720c67de8430d208811c936b420171ea9bcf74de
-
SSDEEP
49152:8/7yT/hx1qoB+bpbwdXe/w1arsCIauzN5t9PYUMf5MK28V4D9zwfsKt5Mt:8/+/DY++bp8dXe/w4sWCNRPYpHn0zwUF
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes
-
com.drddfwrl.ajwqenv1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.drddfwrl.ajwqenv/code_cache/secondary-dexes/base.apk.classes1.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.drddfwrl.ajwqenv/code_cache/secondary-dexes/oat/x86/base.apk.classes1.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
377KB
MD5feba471a01c75d3b42892801d574979f
SHA110e5da7cafb8f02ca79f49de3b269fba698612a3
SHA25637bef7b3dea0d47ac0373a98c985dd02aa39478c137a436c8f5231b020e7ffcb
SHA512a143f491a1da236c402a83180072357fcd1b61d6fb362ab8969c329816518ca00c2f4bf780199a6ad7bdbe47782335eff3ce25cb7bcaa18c9063580ff258ccba
-
Filesize
902KB
MD53a117d765712335774ef52528f5f5d78
SHA1f024a94897126d52299a993110d3e910dd44b88d
SHA256760b2bbcd9ef64290ef3a2f331426c33cf72c627aa5baec1c215881c2eb6933a
SHA51208dcd9d56c0f2e5965cdcb70c46fc739198fedf0e40f2d74c5c7f22719a5c408f5ca0b00b9ff8575f5550b5024f1325733da32b074aea1401d0d9c0bdc91416e
-
Filesize
902KB
MD5193858a3fddc4d48cde97c5e23067e22
SHA149b752e85fa897a861a0c58f64fd1a5c344edfea
SHA2564685cce104658324c8289cab13703ab8184209a54858cec8ba78d1738ab3a7f1
SHA5123da7831ff1277464f26dcba3fd08c9a2c9e22e7637af8422d8c1c0bf362ae4dea939453761c03d12d9973edd7fb49563e1970ff672b671b7fa39661a32fa312f