Analysis
-
max time kernel
149s -
max time network
136s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
19-10-2024 23:11
General
-
Target
5f2a21c5569b01486fb791784aff7005_JaffaCakes118.apk
-
Size
3.1MB
-
MD5
5f2a21c5569b01486fb791784aff7005
-
SHA1
5c674b4543573ddc6008e9d013fbf5001fd3b923
-
SHA256
9afaa372d732d9a920e8dc68ccc243a248f839f52dac33da41f69f2ba0941906
-
SHA512
155a1b34bc78cd55fe4bb10dc8b5bafa65e23e6be4ee01a6139fc5bfb4b4ae9008fe2960b2ad4c5c9faa4ae4a8805c1e07edd790d745d5ede5ca766729ee653a
-
SSDEEP
98304:ozQtjfDm3PO06zgBr3XlEY2P/nfyF3wBlAVI:oMhm/6z6T1EYWfyy
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes
-
com.lxqbcgkl.uzkzdvx1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
378KB
MD55c3f18fabc8a15521d28e2593cc9398a
SHA1b645b9a66a492bc8ffab125c3b16ff0d8e3f27ee
SHA25608278db78ac09ffbfe5d0c13f09055d32ce449fcf1e4a8de11c45586fbebb73b
SHA512d521589acdc996ac546fe9065eeada58af775659712d9937a832025bad7582751817b7121b6a774625ffcba4c0a3cd9903fb67d3cdf88e9abefec34f39efcef7
-
Filesize
902KB
MD570dea65e5b97b54ee38d507bc3832747
SHA18b5db2666a7c5317989c441e0819c988c76ad0ae
SHA2566e8d99f6dfbb9b7eff88dea1a3ecbb1a71c0a15e80f345516f1f9071b9be1def
SHA512cfa330cd7f8945fe78a477787e058d2cf50313e5af8a60aec735c2314e27c6c1cb275f0d5fb9c3fbe11d1aa8b2b25ed42c69ba5a3e3a17813436511750bccbb4