71889c345cca568a61a48b4e08c32c283e035d7ec0baab00dad9df667a556f08

Analysis

max time kernel
134s
max time network
139s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
25-11-2024 23:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9e76805e97bf9ddb9a75a027504f220c_JaffaCakes118.apk
Size

207KB
MD5

9e76805e97bf9ddb9a75a027504f220c
SHA1

a9c9dee0954a974bc80e4ffdb2fdaaa56e4246e1
SHA256

71889c345cca568a61a48b4e08c32c283e035d7ec0baab00dad9df667a556f08
SHA512

f6eec75402d1eb52e68c4ccb1dc55afef2904f47c6ec17134bd8487bd2e35201cbe4c37b09f0adbef683c2c5be5f5b8b2ce48ec5180059deeb9cb9b7f04673fd
SSDEEP

6144:EINzBgqnwc7CYLr2KHZ/yyOr+GQFTYYov2A+:RtSnc2YL16yc+MOl

Score

8^/10

collection evasion impact privilege_escalation stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

Suppress Application Icon
T1628.001

Processes:

com.iekjdx

pid process

4486 com.iekjdx
Reads the contacts stored on the device. 1 TTPs 1 IoCs
collection

Contact List
T1636.003

Processes:

com.iekjdx

description ioc process

URI accessed for read content://com.android.contacts/contacts com.iekjdx
Reads the content of SMS inbox messages. 1 TTPs 1 IoCs
collection

SMS Messages
T1636.004

Processes:

com.iekjdx

description ioc process

URI accessed for read content://sms/inbox com.iekjdx
Tries to add a device administrator. 2 TTPs 1 IoCs
privilege_escalation impact

Device Administrator Permissions
T1626.001

Account Access Removal
T1640

Processes:

com.iekjdx

description ioc process

Intent action android.app.action.ADD_DEVICE_ADMIN com.iekjdx

pid	process
4486	com.iekjdx

description	ioc	process
URI accessed for read	content://com.android.contacts/contacts	com.iekjdx

description	ioc	process
URI accessed for read	content://sms/inbox	com.iekjdx

description	ioc	process
Intent action	android.app.action.ADD_DEVICE_ADMIN	com.iekjdx

com.iekjdx
1⤵
- Removes its main activity from the application launcher
- Reads the contacts stored on the device.
- Reads the content of SMS inbox messages.
- Tries to add a device administrator.
PID:4486

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1626

Device Administrator Permissions

T1626.001

Defense Evasion

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

Lateral Movement

Collection

Protected User Data

T1636

Contact List

T1636.003

SMS Messages

T1636.004

Command and Control

Exfiltration

Impact

Account Access Removal

T1640

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads