3cae06ec8a7224cbdea6093d499bda7a1df1de8fec029bc63e82e7559d6c69b2

Analysis

max time kernel
4s
max time network
139s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
20/10/2024, 05:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6089b4994b42a0630b37a2beb445e9ac_JaffaCakes118.apk
Size 1.7MB
Sample241020-fxb1aashrn
SHA256 3cae06ec8a7224cbdea6093d499bda7a1df1de8fec029bc63e82e7559d6c69b2
MD5 6089b4994b42a0630b37a2beb445e9ac
SHA1 03b9df87de2657a97a3d797a9dba88c5e0b2fd47
SHA512 39d544fbde8d849d5cc48798cfab2c422d327ab2126e89a28e900b730b8b818d34118d11412fe93d9b5c0539dc05a69ea00445d621fed1d9e78fe4efa6c95fb5
SSDEEP 49152:3jEnRR3KqlG49pkTjJev8EHW01YCNcRR3Qc:zEnm09pGjMvjW0rNcMc
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

banker collection credential_access discovery evasion impact persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.nativedroid.xgirl/files/xpg/xpg.jar	4971	com.nativedroid.xgirl

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.nativedroid.xgirl

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.nativedroid.xgirl

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.nativedroid.xgirl

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.nativedroid.xgirl

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.nativedroid.xgirl

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.nativedroid.xgirl

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.nativedroid.xgirl

com.nativedroid.xgirl
1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4971

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

com.amplitude.api

Path /data/data/com.nativedroid.xgirl/databases/com.amplitude.api
Size 12KB
SHA256 885e337c2156e4dbf2176a9677ade50418740532d222ccae5ad4aa371b54c6a4
MD5 ea628e04765adaf4238a5dcdff4bbd51
SHA1 a801947619ea8c368efe9c006a324dc6339ac60b
SHA512 c0287b0e7b690a7231a37d1745c49f3d861b22aa65dd769ba6a8b5ab9da55443f749957781ee05a405019c39e1be45d37a971b821bffd62a1d5620bc39119abe
SSDEEP 6:l9bNFlLdrlOERX4PBX4ogLugMBX4suuKTqiOw2:TLJdTRmBEyPbsOw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.amplitude.api-journal

Path /data/data/com.nativedroid.xgirl/databases/com.amplitude.api-journal
Size 8KB
SHA256 776e087196fb278173373fec2c70eac4229cd5063e9a120622c10000f9b4bd92
MD5 476e400ee2e9f957b1f05ef91254752a
SHA1 8270510271e360482500b3306767dc98490d91bd
SHA512 b3ea4e3f79ce87fa21f0623253a5b8e80dfbe498218b1b9a9a261e135e2a39a8758b9db06682d0a195c505d045d2b63ccfca4ba7bb0831348a2b637398b83c1e
SSDEEP 6:7+/l9sn17g9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKFW:7+tQqLiuWdwRmBEyPbQW
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.amplitude.api-journal

Path /data/data/com.nativedroid.xgirl/databases/com.amplitude.api-journal
Size 8KB
SHA256 35b48418ee47eddd83375a7e345cff7cb3ecd95e38b51717d54f55860e9d6b0c
MD5 8ff2fe87be33c21271fe7a6b1338fe56
SHA1 f90b48aaf4975710d74c4f45a23eed8cabb3eccb
SHA512 abb2292aff5f19c51815b3c0651777c22306593e7771ce67fa1c19cfd3ac4236ff722ee9cefb08b03323b8a7e03710929ba6f6dc3eae65209c0a8078247cbd4e
SSDEEP 6:AGPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKDU/:A6qLJdTRmBEyPbm0
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.amplitude.api-journal

Path /data/data/com.nativedroid.xgirl/databases/com.amplitude.api-journal
Size 512B
SHA256 69db4cd9c2a8eee2156562751d5744f2faa4f1187a0402a4cc66c53cd64a5ce6
MD5 07c1b93d70669d00a4d738a3ada15860
SHA1 fce7e05be70efa334132478538e19cdc9bda0082
SHA512 aa9e9172789497ebe48a92e42cbf8e9109a49a0e94d76fcb3c48405c7b9e278c3fc0c07eb432cdd6b82fb89165622620905b6e43b11e4c690d0680c317eccfcb
MD5 SHA1 SHA512

Submit Download

daemon

Path /data/data/com.nativedroid.xgirl/files/daemon
Size 17KB
SHA256 054a1272e4c0e6272878e6068d7944b0962d8ab79d68bcda8e28a65fc1f5a340
MD5 a094f7f9077482cfd462073dccd0628c
SHA1 2c31ea529559aee3857f2f97a3b19267c1c660de
SHA512 64fd5e2546d5ab60305ba8b82544146f238539509e24fda579ee9518218252521270128ae288f32200e445223e259c148e4fc2f1b17f0b819a72aa80c8ef2dad
SSDEEP 384:CSFAsJl/+JnnnnnnnnnzawMXUvNaobkO9SeFCMsG:BFAsJ2w6pbNSe
MD5 SHA1 SHA512 SSDEEP

Submit Download

lib.so

Path /data/data/com.nativedroid.xgirl/files/lib.so
Size 21KB
SHA256 1da225729f332d3cfcd277161b00c04e768771acdc328192e72e4f6b80543477
MD5 9d952c7af9d40e254289e565ef9702e9
SHA1 665e9060d47517562af9aeea567f7dc879354897
SHA512 c6378f6bde03cb7e85c165aa69518c50b0c7dc4b5a3878dc2789808a313bbc39adbb55c6166330c145af08bbcfdaaeae3dde3f2e946421e23b0f3e885505bad7
SSDEEP 384:86/kgZytQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ4bI2vaewpe:9/kgZcQQQQQQQQQQQQQQQQQQQQQQQQQM
MD5 SHA1 SHA512 SSDEEP

Submit Download

tem.jar

Path /data/data/com.nativedroid.xgirl/files/xpg/tem.jar
Size 213KB
SHA256 840448fdc1785cbbf2de82a455ff76366968278795b9f134f98f03de37c73701
MD5 e7e33cd90f2e50ee4b6753458bb1017d
SHA1 b5a804bbb238d4d7b93972ccaa7ef4b250056fcb
SHA512 c27b0b4a9db017da24aab67296b8145d8abd188ca9ffe65f6e0761a63e9414d2ae98c9cc47fe5143b67b48d3ed3a18951fb0486ea9e117f09c9fa24b40d175a4
SSDEEP 6144:XBHx+oUDiZCBfGAtzxsWprPyyGk4TM9MxstfTSaDFyz:xHx+orcBx9sWprPynxTo2aDFyz
MD5 SHA1 SHA512 SSDEEP

Submit Download

xpg.jar

Path /data/data/com.nativedroid.xgirl/files/xpg/xpg.jar
Size 213KB
SHA256 f5f91673e9c1eabe872694e1546203a2c50652a68cf65ee1db9aac3e7bde7e15
MD5 24653ebc43b7934908f3aaa44c965478
SHA1 7b114ef77f2bbef0ce95f1683c559caeaa0c373d
SHA512 175d6da1cf6e3cd7f94419fca5c0a70937a3813a977f5f02511fb0ad310f3048d381e7efe1e58572046a74b1576edc2976bde18dfa75cd6b04e341f42fa9d50b
SSDEEP 3072:k2MOwTOEDamNiI67Qwj9Yv3jU4u64D1v2mZFGcxNue119t1udVDQ+Ys4KBCmNlNd:rwTRDamNi30S9v4u64G0YeNWuGzOtpEx
MD5 SHA1 SHA512 SSDEEP

Submit Download

xpg.jar

Path /data/user/0/com.nativedroid.xgirl/files/xpg/xpg.jar
Size 420KB
SHA256 a1ce51ad603a7be3f63a8f722bcd47543faeb2b8269fcf8d9bb4ccf5d08625c2
MD5 3a842b02dd231038d4a17354f104ab63
SHA1 20d07d04f84cff9494fb8f49de6cb83932b38e36
SHA512 5a092e2176c499aaea3296a966bfb9e67d41ff9e2f1aabda0a48cb621240f1443466bae43ffcf6e6b5a938b78541d457a93289f24cbde8071d242eb6057dcf34
SSDEEP 6144:Ms9g+j9YX6ZQHsWw+kKcDwv9lgXyAsDp7Wr3Fr:p9YX6MsWWG4VSpIr
MD5 SHA1 SHA512 SSDEEP

Download

track_id.bin

Path /storage/emulated/0/.a/track_id.bin
Size 36B
SHA256 125ad9a4377eb75ebe10be4f6651acb959fb54f27b4cbe30eab8206cd0ba07ad
MD5 01718d3b1e43016a02a98cbf8c397065
SHA1 63461d7b2e12b37eb30871362aea000733e00fbf
SHA512 8d702fef07eb5dd9e1578060e80bfdbee040ec6b9cd58cb89230caca02759d2cb2c136247bc54aac6e2bafda784d4b2c561ee989832770f51be2a3f78b281d87
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads