c8a482e199e36c47950b1061995550e6811429fbf2e4afe713c577cbd39bea43

General

Target
jaffacakes118_c8a482e199e36c47950b1061995550e6811429fbf2e4afe713c577cbd39bea43.apk
Size 29.8MB
Sample260910-xdjdpavama
SHA256 c8a482e199e36c47950b1061995550e6811429fbf2e4afe713c577cbd39bea43
MD5 4d3c0f1b8efef255d239834e2af4de12
SHA1 bdfe9f82efdb2d7c3bff01a2f9f976061aa9a4d5
SHA512 be35798df28e8216b42752b34216c08be02688a65bdeb39ad737d6c7f0d51fea2812cfb9910c8c615c82a2ad761af908d72bca0a64c4ebecbf64074ab8705bb5
SSDEEP 393216:qDuF7Hwj3Uoe2H7OfglzBJmlB2Jrps8xDF56trxSXKMIRLcnsFfaN:qDKsTUoe2CuBJmD2Jletx5JpFyN
TLSH
T11067F129DCC0EE31D0F604FF0514C5B2A22A0D5DAEEF87825712BF3E24775DAA761986
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery evasion persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.xauvugnzl.yzmgjjhni/app_dex/classes.dex	4210	com.xauvugnzl.yzmgjjhni
/data/user/0/com.xauvugnzl.yzmgjjhni/app_dex/classes.dex	4237	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.xauvugnzl.yzmgjjhni/app_dex/classes.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.xauvugnzl.yzmgjjhni/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.xauvugnzl.yzmgjjhni/app_dex/classes.dex	4210	com.xauvugnzl.yzmgjjhni

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.xauvugnzl.yzmgjjhni

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.xauvugnzl.yzmgjjhni

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.xauvugnzl.yzmgjjhni

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.xauvugnzl.yzmgjjhni

com.xauvugnzl.yzmgjjhni
1⤵
- Loads dropped Dex/Jar
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4210
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.xauvugnzl.yzmgjjhni/app_dex/classes.dex --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.xauvugnzl.yzmgjjhni/app_dex/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4237

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Discovery

System Information Discovery

2

T1426

System Network Configuration Discovery

1

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

classes.dex

Path /data/data/com.xauvugnzl.yzmgjjhni/app_dex/classes.dex
Size 1.8MB
SHA256 1777ee3deee70f36d3e77e9cadea9d6ed93d0dee63f624dba056850431b91f9e
MD5 bbca0525b5a9a5736083e51a5ee156d4
SHA1 6e163edf9404826747c541abb031441405909889
SHA512 d5a1a3d6cebc8294a41ad9a1e84a0dfed0740c19d9d4d9eed560f14df935f5f5278d9d14c07da2d74aefce05935b4f6f8fd2a4c2bb09cb06eeedcea17eca66b3
SSDEEP 24576:YxhNIsBnoU9tMn1dQO8pi2x4nf4kLM5/NCSdEwUJie:2oemHQO8pi2x4nmlE
TLSH
T10C855A42F6924F73C8AD833DA4E207603335A651BF8B8B07354DD6B4BD832D65B99B84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

classes.dex

Path /data/data/com.xauvugnzl.yzmgjjhni/cache/classes.dex
Size 859KB
SHA256 ec5ae0db4d6dc1c2f484993b3f0221be0131c85fbe9f7560ec225af231f0d3b4
MD5 92fede3223a07a335272c9584576fbc0
SHA1 9ae98dcec80f8d35ca8272879cd5497de525dd5a
SHA512 2e9fa776b6e9a931f8bec082fc67b81cf1af38add4d7fa3079329a5846cb0ef06b7d4e96f05f4652aa385208dfba81505c6dd3d43f519b1f69365e448be4a04e
SSDEEP 24576:e6pCJq9lryk9jjJCGIohTsRSbprEKRl7tF1DGjywEvjBE:DI0Ik9RCrolFNEKRptnxjBE
TLSH
T15D15235E6EED8FD380B5F95350297C5168D923E8F88B618A01AA1379DC1CFC6F262473
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

classes.zip

Path /data/data/com.xauvugnzl.yzmgjjhni/cache/classes.zip
Size 860KB
SHA256 7365b7fae3fe55df738c39332608b21eb10afcb6d732b7a2849de646dcb49ae0
MD5 c875b0b6740b32c1792a4a5e41b0bae5
SHA1 bf9ddb223783e305460abe268be81e3a99913135
SHA512 a24538f0e17666958ec9592f407881d7dc4c96ca350ec6d9a0c3204411a340b53372a39c532e3286d26874a663e02793618965337f8d3354f7cdf638f0adab36
SSDEEP 24576:r6VCZqdJrIS9xzVYIIUHtsf0xljgKVl7BFnD0jKegnjBz:uMiSS9bYRUN9HgKVpBlZjBz
TLSH
T12A15235E6EED8FD380B5F95350297C5164D923E8F88B618A00AA2379DC1CFC6F262477
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

classes.dex

Path /data/user/0/com.xauvugnzl.yzmgjjhni/app_dex/classes.dex
Size 1.8MB
SHA256 fa31a4d58ab712b66c80b3210f463811be12023ace7388197c21ccdf2a78586f
MD5 28e457111ec1b4df99d3a49eea8d4b90
SHA1 0c1aafcbbcbed10d156779a25627a8865782d61a
SHA512 7475bef593e64a515fb32772f792a8c031c6ada3466c0c160c9cd36673dd33c5f664125bb0c597de3f2facb8939e9b9c6f11f11e87fb6808b49eace2e530e052
SSDEEP 24576:YxhNIsBnoU9tMn1dQO8piFHVD3BUKLY6z+if1LRe:2oemHQO8piZzpi
TLSH
T1FD854942A6820F33D87D4B3684E74BA4B336A1023F57CB5736085278FDCB6C55B6AB58
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads