Analysis
-
max time kernel
149s -
max time network
130s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
04-12-2024 16:52
General
-
Target
c37ae32cd4bcce93797535082e2080a2_JaffaCakes118.apk
-
Size
3.0MB
-
MD5
c37ae32cd4bcce93797535082e2080a2
-
SHA1
ae84294f83e45c8a9180cb6a0e658181fdee62fc
-
SHA256
2b305310db25d5ac714d4e5df898fa336e0bb3b86039b42ea37762f00956b3ff
-
SHA512
6b1005ce7b3749d94126be73e926bfea988a3961a95a493bb879e3efaea93b62936a13589c063601fda32cc1403b0b9639661dfe7183bb395c6d23c431f6506e
-
SSDEEP
49152:4MZfhiOsnVv0VdpuowM1EqMz3KDH8ZEesJfZhANAZdo5R0fe5Cn5z5Fa/SPxAqw5:4Qf9aVv0Vd8JQMmDcZsfZhu6o5K44rFq
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Hydra family
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Makes use of the framework's Accessibility service 4 TTPs 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes
-
com.wefccxit.cbhxpgr1⤵
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.wefccxit.cbhxpgr/code_cache/secondary-dexes/base.apk.classes1.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.wefccxit.cbhxpgr/code_cache/secondary-dexes/oat/x86/base.apk.classes1.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
378KB
MD5051babff27f407292fe1d8a5976780aa
SHA102f1814a3654684e0bf82abdd5275e1dadb2e3a1
SHA25647cc42df8062022f5576169758085ba166008827cd08a063cd4f6ecd63f6fbf8
SHA512e4e452d30ac6cf215bc2ca157f150547d684d49d27ceda9293387adc420441aac3d3e0a10efe25870328e705a14d7ce55df797c941e694a68194faecea6dcbf9
-
Filesize
902KB
MD599233baebd321ed414d4b9090cad2397
SHA19d3c3abd8a28fe529fc2fc455f7cb5ca4e9d9f3e
SHA256ff4cecdda8c5b9279c871374c6c948af44020bee6c5714b8556ebf9567d9059b
SHA5121ce626e20474f29038aa5b77702fe222fb84e2285672797534ef1778797961d35ed6dba6b0aac9d6a61ce29ea346831d9ff7f79bf9038cf6f1e08e658cb1dc90
-
Filesize
902KB
MD5bfdaf3784d3f7487759eaaed9042907a
SHA184778b47fb7d80253785530b3aaef4a11ddcb8c6
SHA2561eaaf545b99745477d09f03b96a043b885a742c7d850136117337054b9673e2a
SHA5127fba3a01105a55510457e9910af3b7368b36551d1474914e8bc88e39504cfb2fd8ff7ef42c6fc0762aba9cf8bfec3ddf82ef01bc62d7b029a8114f2f4117b646