a9a5f2868b1e1232b5198a3543b5994ad140765c02535ebfaa924bc8dd633a33

Analysis

max time kernel
149s
max time network
137s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
26-11-2024 01:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9effaf24eec799903af6c7b70015a32f_JaffaCakes118.apk
Size

5.7MB
MD5

9effaf24eec799903af6c7b70015a32f
SHA1

66f12da81aae04cae0e0aa8e9c13013b32269070
SHA256

a9a5f2868b1e1232b5198a3543b5994ad140765c02535ebfaa924bc8dd633a33
SHA512

2e812e525cb62871675b467d5eb3ca12c827dfdffca7bdd1e2daf84119d03ffcac7322d919d85b130d0b4ff246260c65aa40ff6ec467a14920f568d9b937c70f
SSDEEP

98304:IffKh9p93s5BAE6BO7XgfIAj5e4tr1LJ6TKdQZ6BktdaMMAoL56SI:79EYE6B7breeQdaMM5Ni

Score

8^/10

banker discovery evasion persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs
evasion

System Information Discovery
T1426

Processes:

com.softwego.crackscreen

ioc process

/system/app/Superuser.apk com.softwego.crackscreen

ioc	process
/system/app/Superuser.apk	com.softwego.crackscreen

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.softwego.crackscreen/cache/1582435991586.jar --output-vdex-fd=88 --oat-fd=89 --oat-location=/data/user/0/com.softwego.crackscreen/cache/oat/x86/1582435991586.odex --compiler-filter=quicken --class-loader-context=&com.softwego.crackscreen

ioc	pid	process
/data/user/0/com.softwego.crackscreen/cache/1582435991586.jar	4370	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.softwego.crackscreen/cache/1582435991586.jar --output-vdex-fd=88 --oat-fd=89 --oat-location=/data/user/0/com.softwego.crackscreen/cache/oat/x86/1582435991586.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.softwego.crackscreen/cache/1582435991586.jar	4248	com.softwego.crackscreen

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

Process Discovery
T1424

Processes:

com.softwego.crackscreen

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.softwego.crackscreen
Queries information about active data network 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

com.softwego.crackscreen

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.softwego.crackscreen
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

System Network Configuration Discovery
T1422

Processes:

com.softwego.crackscreen

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.softwego.crackscreen
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

com.softwego.crackscreen

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.softwego.crackscreen
Checks CPU information 2 TTPs 1 IoCs

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.softwego.crackscreen

description ioc process

File opened for read /proc/cpuinfo com.softwego.crackscreen
Checks memory information 2 TTPs 1 IoCs

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.softwego.crackscreen

description ioc process

File opened for read /proc/meminfo com.softwego.crackscreen

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.softwego.crackscreen

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.softwego.crackscreen

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.softwego.crackscreen

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.softwego.crackscreen

description	ioc	process
File opened for read	/proc/cpuinfo	com.softwego.crackscreen

description	ioc	process
File opened for read	/proc/meminfo	com.softwego.crackscreen

com.softwego.crackscreen
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4248
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.softwego.crackscreen/cache/1582435991586.jar --output-vdex-fd=88 --oat-fd=89 --oat-location=/data/user/0/com.softwego.crackscreen/cache/oat/x86/1582435991586.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4370

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.softwego.crackscreen/cache/1582435991586.jar

Filesize
9KB

MD5
e8e0527a01aefdb89afd2c508f131da1

SHA1
f1103e6b260c657ceb3d95f1b023af3fda8b133a

SHA256
f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce

SHA512
fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34

Download Submit
/data/data/com.softwego.crackscreen/cache/oat/1582435991586.jar.cur.prof

Filesize
148B

MD5
a3b78d197d786c13687c3f0f89703bd8

SHA1
9967f0726b6b1ed3f198904547b81920f8329621

SHA256
c5e6754556dbe01b055066f23c28ddaaf5fe67cee4baed00d59dc993335b3d97

SHA512
9a47c9bb977edec9d29d22f280e0078ca931a722eaecc2b085c6b5aaf6246d17a6ad07c9faca45070bb5b89a3ee6cf896f5e2c7e73fb033e3ac57471df70a8b1

Download Submit
/data/data/com.softwego.crackscreen/files/Roboto-Regular.ttf

Filesize
112KB

MD5
230e0e1a8b7a17d5f3f03de75adea5a2

SHA1
42dd3daecfa9192c08fee4bbd3bea78b14dd6e62

SHA256
00ae3fd7698bec219473edf68171a0f14e6cf68d363eea59373156e0b090de11

SHA512
1fedc2e66c80fde9e093e032e571883221ea57a4e24ded7aba83d11d42c8709128ac98bd6f1f61d0d8bdd3a5b6af6c7cbd45dd1b849075fbf44515de0e586826

Download Submit
/data/data/com.softwego.crackscreen/files/close_button.png

Filesize
1KB

MD5
6d79997d240bf8146886e4bc63f31db3

SHA1
6e033e83a010d249d6e24b9ea8798cfe99b6d778

SHA256
17e1977137c8d19334573c7add2e7ab505ef55e08b5c9e6e8714bd8ad75735a9

SHA512
95f5b92fba0fbb344526a588ea4c16356fd149b84ca5e5c45e3c982d11a7f430d07fdbc181b084d0281c91eec36c0a59207c7bb0157ec7615ab0d682582a01ef

Download Submit
/data/data/com.softwego.crackscreen/files/drawable-mdpi.zip

Filesize
8KB

MD5
a716d6290eaa175b7bf68337e15cf17f

SHA1
893692f7b6319a03e34a1d01db3d3eb3f9aeb97f

SHA256
6e5561d8a9798d40c58edbb47083f399acf7538ff96bf9e4272da31dc684d971

SHA512
68ac0d753ac57dbc67d495966baff44430c86a0a8792fc0db9c69aca0b227cc3f8dd7219796098c657917614e02183061ed844d40a0739a15ac72cd6bbb093ec

Download Submit
/data/data/com.softwego.crackscreen/files/drawable.zip

Filesize
11KB

MD5
55c53d457904480c917ae919026e5919

SHA1
5206401071ae506ed8a730ddad2eea8ea6d45eef

SHA256
9313e65192a108ab22d94239028c5caf4e4e7efb8c1072c0b985f679c7cb82fc

SHA512
8573e6dd4c697e107defb6c98cffef4e6774b420b5fe94695bcd31ba1aafb3914ea68c20b957edc984fa742272fc5bbb497506a7e91ec59f665a2d27aef0324f

Download Submit
/data/data/com.softwego.crackscreen/files/empty_star.png

Filesize
1KB

MD5
73aa466d5176127dcf290f2727eda17a

SHA1
8cbaf9e3ea1f60a11a468a4faf6b183f53f84a25

SHA256
d3159015a641eaa8524d530f4e35fdcc19a8bfa2679c7d25c4247c262babdc4e

SHA512
372a82391121911561e2938095c414b0a156c3c4bc2f30ff3f6b5515172231daf6d699edd2710165f22d324e4419be9f0c55682e53d1d8c9bf013524a092ba82

Download Submit
/data/data/com.softwego.crackscreen/files/filled_star.png

Filesize
1KB

MD5
685f9e06c0990c57fd21bcfe47ce706d

SHA1
6c15fd6142f6e2d081377abbb07e302261859871

SHA256
deea08857a7c4db40ce82f2d129660fc0d4f0537cf8effc8e54b8fb6d07dab6f

SHA512
f4356a940e3ee404ed6895374090bc2cbbb226b49b84ad17dac0a26a42e0e7479c43989c09dc17fd0da2192f2fbb08833b3b46ee561b7dc0047363a49cc4d662

Download Submit
/data/data/com.softwego.crackscreen/files/half_star.png

Filesize
1KB

MD5
b1657a6b1b87d76617fd7db36dcfaa82

SHA1
65bd6dc7c7abb02ae7c5650e65e544d8e060e27a

SHA256
c7e35b796c71ec2b3b2713961a0777a09e261f8056d304550addf39c638f44b8

SHA512
d1dd09840103e98531105b428e374672531ac9d33a652fcd091aa94d38a8699a6e99ac5822e67b293e68513307b28e986412a1a84d55d73791c9be95fe1fc18e

Download Submit
/data/data/com.softwego.crackscreen/files/info_ex_s.png

Filesize
3KB

MD5
f8e42efc5fb6d75ab8e928822c83b535

SHA1
bb2535f79e03481a594ede3acdf1d956fd94b3cb

SHA256
0abf37985d6e83fd45f6f9f854c3d8e2fd0063f71933f1bc07772a9d54e561e8

SHA512
9102e9551f335e7e843932b44274ede4b0f2212a3bd8b0dc509083456799582067966cc70d4694c9c18e369f6863e93ad0f513f938c029ea60be7ce73e8385cc

Download Submit
/data/data/com.softwego.crackscreen/files/info_s.png

Filesize
1KB

MD5
2aa3e72c2f48b2297c27f997c06f5de1

SHA1
e02b540bcbe25cf6a16e2e9108ddb1be745476bc

SHA256
97b5a55d551a037126c25cd939d369881e597ff181072f3e251b7cc739e74354

SHA512
6cbb2ede58606085a3bf07d78aa7e299ba431c5090e258a6cfc798d1fd178a458483b135f8066854b4a7dc2012d83b437779efa81d163c1b0ded00ddc75c9f60

Download Submit
/data/data/com.softwego.crackscreen/files/loading.html

Filesize
3KB

MD5
0ed53979251332a3b26ba5a8b9b8c7be

SHA1
0978878b41d7661d4c9c0e9771c767feec9f21b1

SHA256
9f94a9863a4cac60cb363e3e06f0d6e490edb3704736156e55876922f66b74ec

SHA512
ea5e0cf829cd34d751b8e33a60f2b11b83f606d1b74951ee1675bdbd8590aeb71c95fa8f008961ff39318d3a4892bebaa33903cab011ea026aed298e0007ccf6

Download Submit
/data/data/com.softwego.crackscreen/files/logo.png

Filesize
2KB

MD5
b91dd0791d392ec207619cc1a267e896

SHA1
be8fc6d4e103a4915f10cb1297725ca2abdb4176

SHA256
10fe86e42cb94819cf134a66a458f6b1edd433d196e6bb395cb936cf50dfe20c

SHA512
6ee669a4e1d22b48d101d640f09fbb4ee4879cca025715de5014503f6d1779afe7a9cc677e1404f459e43eb0f5b6c1070714f0e87b454f7a006384da9bcfd90e

Download Submit
/data/data/com.softwego.crackscreen/files/resources.zip

Filesize
58KB

MD5
8c05bc3a2e5ac5adbf539c9b69bed4a9

SHA1
e895081a270472cbaf117afeae925a6a4cb0ac05

SHA256
212e4f070449df3f70d620c83d961d90134f030e548afc674e5d41994b1880fb

SHA512
17e73ef55cb0d1e688682a937d55b7bd8cb5261bcf6105a74d4ef183e9d86906e8942e4556afc2faeafd1434ad89f465d0451a6a8fef027227dfb6bb09e75bcc

Download Submit
/data/data/com.softwego.crackscreen/files/tab_side.png

Filesize
2KB

MD5
7d68d6523a1257de1310bfb7b66cb3d6

SHA1
1a35d821fc51bd627626cfa10d256d647acb88b4

SHA256
6148d3dc89c461a0147a9c4de14caa2a2ad1d36ccce75936433c9736c9eb2996

SHA512
861fda4b4e55d3b6f3158845e64d14453d7ecbeb375070c08920fa0a8a55f32c2ba86b626f02a461f90b4f7cc28b56ddcceef064bf0cdb7096d84017bc40b6e3

Download Submit
/data/user/0/com.softwego.crackscreen/cache/1582435991586.jar

Filesize
20KB

MD5
2048eb6124a452540ee51dae4145aadf

SHA1
d05005b2cd7fe4cd652b0d7fd1bdac2c19d51451

SHA256
105c54b6fe3f25350e92187467761598e4c21d62b1091b77d091f65f3bd98864

SHA512
bb6cb3853dd2a5d0701e20607d4e153ae201268dd2e5e2d06cc2df208b3b4dc50132a4ab428251b1644d2399fcc717662438d082ff14203387bab8794109d44d

Download Submit
/data/user/0/com.softwego.crackscreen/cache/1582435991586.jar

Filesize
20KB

MD5
fde2ee00cbd121cfab5290b078aa3ceb

SHA1
e2b77d5320e155e413d040a8c20020962065b2f8

SHA256
2897b0812077c654a9b3fbb0b6303d5cde681eeba7ad9981de65716c7810d685

SHA512
a9326aff8e454a2b4ac09984ef2a65fddd4dc146b4c44d839035549bff8c9fdaae490326d0b018f76c1ca2e4fb25426d74f550ca0950982fba632a023af99a56

Download Submit