7080e58f1a02b1d2e8083ef01e2ae9b11de1fb1467d7e53fbc8f37730ff478c5

Analysis

max time kernel
146s
max time network
137s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
23/10/2024, 01:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6c95f4dca1564e434fd22c175b492fe0_JaffaCakes118.apk
Size 679KB
Sample241023-bfvc3stbmg
SHA256 7080e58f1a02b1d2e8083ef01e2ae9b11de1fb1467d7e53fbc8f37730ff478c5
MD5 6c95f4dca1564e434fd22c175b492fe0
SHA1 a975cca4010a592c4c450b16f564a7eb38e421ae
SHA512 238168a3d6775a975505231c65cf013c2adcf212617455d18bfa26743f93de7aa3063e2497589987575078867b32986da5cfb18ed01542336152b6d844963b74
SSDEEP 12288:g/CKljQulqSbzcPZI+YcHy1X2rCjhbewXC26PZI+YcHy1X2rbZ5qo:sCKlJqu6++pHIXOAhawk++pHIXOl5qo
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection credential_access discovery evasion impact persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4963	com.main.haha

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.main.haha/app_ttmp/t.jar	4963	com.main.haha

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.main.haha

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.main.haha

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.main.haha

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.main.haha

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.main.haha

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.main.haha

com.main.haha
1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:4963

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

t.jar.cur.prof

Path /data/data/com.main.haha/app_ttmp/oat/t.jar.cur.prof
Size 471B
SHA256 055027ad66c311b6618ed263e728c927245a3697a940f67ef01655a0cf877e04
MD5 f1f7a6c07f8192131c693105cff52ceb
SHA1 739ee37ea7e8d8d70479f3bc13ac4118e7a95748
SHA512 70a0f2a0018910c6c790c791b7b2fd59ffb40b4cd69540f89ab4cd15ee32bb04763f7a3e740ef968e7581082b7307934f005da5f418a6acd59d27e45217ab986
MD5 SHA1 SHA512

Submit Download

t.jar

Path /data/data/com.main.haha/app_ttmp/t.jar
Size 166KB
SHA256 1cb5236da9cb6e4609c60ffefaac9fce9d862cae98ec1c810984f89b16434488
MD5 726393f7ab0b83048af0eabda50b2003
SHA1 a98455e3e35e80b61dfb5b6252799ccf3577e33a
SHA512 9cc46130bb4f5a7e23d244d93de239180c0385af0b37d5b123f77b2e91968857d45e4acb3989b08f724da95cb4e76c1e2ee27666ee5790b83c2c4001e9203e1a
SSDEEP 3072:WFXijmp2fnvhu1sYpMu1dgpjEq119LyYf0Ftrd8ko8CjhnpBVJt:Wkju2D0MG+lEcLyPXe8IBR
MD5 SHA1 SHA512 SSDEEP

Submit Download

t.jar

Path /data/data/com.main.haha/app_ttmp/t.jar
Size 166KB
SHA256 f7b08ddefb2eab0884f5be8aad5a4aae71b010f9d54ea43e6fa0a6c514693f03
MD5 041106895d7f98ba2a3cda7df5195ee8
SHA1 e939e8449d79c8630ede5c7216cdd8d92bccb4cf
SHA512 d4586604cce1ca799906899d58dce963a8893fd68641541c699fa3391f38f163d4d07a5aa33e5f137ff69b20f1c2ed26d70295f10264cb71a9a245c195d7216d
SSDEEP 3072:ILfxCMobkDoXv3fTcX3Uc3xTQO98ypdM4jJQm5F7fJDEQ/m5fatgllO33:653rycX3XR9jVjmm5VJDE42Cg3O33
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.main.hahab

Path /data/data/com.main.haha/databases/com.main.hahab
Size 64KB
SHA256 7ef9746d7c7885b317545325e9ed30f0e81b8764531e3764af1f4b21dae096a7
MD5 84bdb77f934e339914f8d58f2a313f58
SHA1 9b54ad3b2865c7242d22ebae39b1e1c67a3da5fa
SHA512 3d9e363fb3150255da6e3029d0a26d1c2ad3159b7e492ed632da6d0e3e0b5bd9d1b603450c9a3fc1f42e315999621f92bda4af5ae72b2eb509d88b0c3acd4b6c
SSDEEP 48:TT2MbmX9MJbUKZb9pMJbc6sNd7UMJbEyAsInlnIH2bmX9MJb8O18OHEEASsD0:bmtqb9brqborIqb5cQsmtqbxU0
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.main.hahab-journal

Path /data/data/com.main.haha/databases/com.main.hahab-journal
Size 512B
SHA256 a300d59050d4bdc139e7923d248e24fa229fc1817a641deb6cd285ab8dc03f1a
MD5 91c33997af328573190e3e487b40fdce
SHA1 aa2f5b16ce5b1614ad686e6ac3feb4de55c65274
SHA512 16aad325be2afdfcb1edf22121fd516e27f2e06638b89f325b7f75ed76d809da30a1e99553c812913823380f0934980cd9f4f3d4d81450760c63280615bc9ecd
MD5 SHA1 SHA512

Submit Download

com.main.hahab-journal

Path /data/data/com.main.haha/databases/com.main.hahab-journal
Size 8KB
SHA256 242356858684f5ef339cae5ff17a2067e79e3617c15456121f2a41463e447902
MD5 a3cad554d4db8c1a011b34a8d919d0c5
SHA1 a1eadb28c46068b74477cb5d332da74cdf760efa
SHA512 0d74ed8578a2fb8d7f1a02d591da967fe56beb01de9f003a03449628f77f2285c08dbafaadc08f7c474c5b1bfda183ef66bd3a3d0fc388b20e0dc015325dff91
SSDEEP 6:7+/l9m4n1Sg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuK84:7+tIPqLiuWdwRmBEyPbw
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.main.hahab-journal

Path /data/data/com.main.haha/databases/com.main.hahab-journal
Size 8KB
SHA256 82ec6f71c982a38e63e125dde1c50f030b735aec8bde71f8f13bca6f5f51b688
MD5 5f934ef8fb6564cb3dc7f502259c0287
SHA1 d6e033a30ecb927b78f0ead1b77779c437cc0769
SHA512 77066c83dfded63ffab7819d93544f8150063004fb62b8b9495e2c7fc1c094cbc76aa7bb981e9852e7aab240d2e601b43894477dbed5fdb792bbd8536d1d6aa9
SSDEEP 6:7+/l9YPg9bNFlLdrlOERX4PBX4ogLugMBX4suuK1//F:7+tKqLJdTRmBEyPbqXF
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.main.hahab-journal

Path /data/data/com.main.haha/databases/com.main.hahab-journal
Size 12KB
SHA256 5aabdeab320e0d80f15a4e4d1d5663541bb350692168004d659e5a104f1fb955
MD5 c963d8e9c4fe94fe675ba6411e7cbc4f
SHA1 4ecb98d00bdd8c332f514cc08d5a6220ce29cd2a
SHA512 8f1ba1efcd9f7988133d835f1aa44c954c0106b370e8b3bca7ff4f87975e32e68fc80f1cb448df64cedcc508634c56f12fbb6007a3996a25728011a037923596
SSDEEP 48:7MUMqz2MbmX9MJbUKZb9pMJbc6sNd7UMJbEyAsInlnIH2bmX9MJb8O18OHEEASkX:7mEmtqb9brqborIqb5cQsmtqbxkX
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.main.hahab-journal

Path /data/data/com.main.haha/databases/com.main.hahab-journal
Size 12KB
SHA256 a648eea8faeb88da00faef6c4b62278790cf69a315db9fb3dc384d3d5221e537
MD5 e208773616cdf0d706d9f35de3fdbb36
SHA1 17a74d41b536f723737e15c52531170f74e177e4
SHA512 19246756327979f9f6c34cf81ef8984d723d262834203b373dfe1167f24d4deb748168bd05e13389c10b51bbab2088adcc4c933b311bac3de06fcfdb7f0250f3
SSDEEP 48:7MDKqOC2MbmX9MJbUKZb9pMJbc6sNd7UMJbEyAsInlnIH2bmX9MJb8O18OHEEASJ:7zrAmtqb9brqborIqb5cQsmtqbxJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

t.jar

Path /data/user/0/com.main.haha/app_ttmp/t.jar
Size 353KB
SHA256 8881fc118b17bb10d54fa7348673b88497c57600fbc4fcf409e118ccbff7ebc3
MD5 47562ecae00f3b2d091b3d2aaf283ae6
SHA1 362c299ad1516338be5886b04d786b1a2b7a5624
SHA512 6e8f811046e08b753010e563cebda1540d7fe56eb4c3af5655758a1bd5423565aba29533c0a64afefe259b2da79e0294080bda0213aa116b272e71701c8ad177
SSDEEP 6144:uydx+7UW0jm3i2+6lHF9nLcwaO0klCRKbmrUasTJOswoa6hdLDys:Yzihg0k5irUZJfRdL+s
MD5 SHA1 SHA512 SSDEEP

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads