ffddef5f1b6d3e9d2fa6da987fbc78c53adb21b91528b0bd2490b7ef29f0bca7

Analysis

max time kernel
147s
max time network
137s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
23-10-2024 16:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6fdf34d17f3a3775b82c1dd5fdf01db7_JaffaCakes118.apk
Size

2.2MB
MD5

6fdf34d17f3a3775b82c1dd5fdf01db7
SHA1

38fe5652102703168d23ed58db9f9f9846df6214
SHA256

ffddef5f1b6d3e9d2fa6da987fbc78c53adb21b91528b0bd2490b7ef29f0bca7
SHA512

790bb21b90a530437c3f758dc82b255cfeaa9c0242f5c7d9d6609e9057ce7ff9f0145933fc979ae01cb956547a20147ba81d3905d26484918bebbe2c49dd70bb
SSDEEP

49152:APoTtBnmh+HpT7E7WkTcTJLTna1YiYNK4ziBBnmPJ:APatBmh+HpTYpTuLTMHYNKkeBmPJ

Score

8^/10

banker discovery evasion impact persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

Suppress Application Icon
T1628.001

Processes:

com.main.haha

pid process

4218 com.main.haha
Checks Android system properties for emulator presence. 1 TTPs 1 IoCs
evasion

System Checks
T1633.001

Processes:

com.main.haha

description ioc process

Accessed system property key: ro.product.model com.main.haha

pid	process
4218	com.main.haha

description	ioc	process
Accessed system property	key: ro.product.model	com.main.haha

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.main.haha/app_ttmp/t.jar --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.main.haha/app_ttmp/oat/x86/t.odex --compiler-filter=quicken --class-loader-context=&com.main.haha

ioc	pid	process
/data/user/0/com.main.haha/app_ttmp/t.jar	4250	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.main.haha/app_ttmp/t.jar --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.main.haha/app_ttmp/oat/x86/t.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.main.haha/app_ttmp/t.jar	4218	com.main.haha

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

Process Discovery
T1424

Processes:

com.main.haha

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.main.haha
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

System Network Configuration Discovery
T1422

Processes:

com.main.haha

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.main.haha
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

com.main.haha

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.main.haha
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

com.main.haha

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.main.haha
Checks memory information 2 TTPs 1 IoCs

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.main.haha

description ioc process

File opened for read /proc/meminfo com.main.haha

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.main.haha

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.main.haha

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.main.haha

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.main.haha

description	ioc	process
File opened for read	/proc/meminfo	com.main.haha

com.main.haha
1⤵
- Removes its main activity from the application launcher
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:4218

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.main.haha/app_ttmp/t.jar --output-vdex-fd=45 --oat-fd=46 --oat-location=/data/user/0/com.main.haha/app_ttmp/oat/x86/t.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:4250

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.main.haha/app_ttmp/oat/t.jar.cur.prof

Filesize
466B

MD5
6f35b9ae09784a6372802b9253073e39

SHA1
667f8f1075985399fb40bc88113cb0b3a572835a

SHA256
4d6f38aa4fb5b50ec2ddb748239e17ebe258bfa8c867e7b627714521f327fc93

SHA512
309f06f74d6e847745dc0a3a8293aebb1e0d5c4dc7e5b358fd73ac3d8c0b49563b85bfb9d8ad631dedeec92a31e383f5f0834f74d93aecc192da651543cc367f

Download Submit
/data/data/com.main.haha/app_ttmp/t.jar

Filesize
187KB

MD5
8b2fab499ed1ae4e6a65b81db8843644

SHA1
75e1d393281ff9b62af50bd2ad51a3bb01641517

SHA256
17106cb4686d5eeac9246cb1d219b202f2b1f3958eac1551b205c599924a971a

SHA512
ba3d57a0df75f9fe069994e755f8057dbd5895cdf157900390a9a7e2bf51f9f77b04a4a24a68186c9afd2af278158b9733d29e966cec82db447acf4db7be432c

Download Submit
/data/data/com.main.haha/app_ttmp/t.jar

Filesize
187KB

MD5
205fe9ba67b46c4c369adc1e689f05bc

SHA1
8a6d40ee4e6fd890d6ba79e38a2265cbe3363ef2

SHA256
76bf2a99ee9ffbd6d424ce55243e06ead91725832b543778215dd1e2dcaaecd6

SHA512
3c5703da2be0c9d401c118e9a6576e8cf18cd05d726f8b5087ee1aebc9f234e1bcfd12bb3453a3b4cdc9de78f6a9be476e4bc32baa9591cad9492afc80619be5

Download Submit
/data/data/com.main.haha/databases/com.main.hahab

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.main.haha/databases/com.main.hahab-journal

Filesize
512B

MD5
927f09300b2d645781bb8ff8df7e9ad7

SHA1
5a34f2c553dbf388be6da0859616a8157f7a0d5b

SHA256
e266fa6b19d17194875a149a91379933cb9d4219fa924e01eea271266e8c8ecb

SHA512
1727a5b06726cf5224a7210f040a4635ac5bff99814cdec51d94a10e8207670bb8df510a4acb4151475c8d4a6aff1eb319d57f92bf13ff300d965f3cd5302c06

Download Submit
/data/data/com.main.haha/databases/com.main.hahab-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.main.haha/databases/com.main.hahab-wal

Filesize
92KB

MD5
7de1d00905ac633bacc8c654997e1d3e

SHA1
c8f76e3c84a3c651af35399f1238b60742935b16

SHA256
524df47827e0a3ce71970c6206964cef7624b5f2b5a772ce5dfff8d1045de47a

SHA512
4affbb10be34ef17263c4a29446f6c2d15779d245e713b49f4d03281c13448e6bd85e303f6c1bb509f7f4f3ecdf8aadfb54561cac0391e3e870a87f4a8fef7bd

Download Submit
/data/user/0/com.main.haha/app_ttmp/t.jar

Filesize
398KB

MD5
75e41662394825d89abe87bd725da2f1

SHA1
3f0c597eb3ab177cb9e4a36fcf1137dd6e6d0463

SHA256
1de76362d031563d84d332bb98f9a503d9f9055e7476ffb9c11a2503a6925a40

SHA512
dcaaeccbb7158f06232dc732805625dd30ae5e58551d15735f33f78d610e2285e207471d3d74724bfa63acae25d59640814bd522ddf3141e49a0d8edc572d178

Download Submit
/data/user/0/com.main.haha/app_ttmp/t.jar

Filesize
398KB

MD5
6433e446614644586fe9259d11acb08a

SHA1
a456afdd1fa81c878d0d2b69ec609baa1f29265a

SHA256
7b67244da231d8d026aeb4a877dbafa0915b6afc96ee36d1d1f2da49007360f8

SHA512
3362ffcc1838d7b3d282473abee63e653b6705901719cf03fba75f9e9f375d64895b7469dbc8928fd519febedf1b1a767515cbc474fdf2055c44ec63a41ff08c

Download Submit