674493ea1edec9246e0cce984fab002ea0002dabe2f1f9356d9ee0f60b927e38

General

Target
jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.pf.apk
Size 1.7MB
Sample261012-3czbeafb59
SHA256 674493ea1edec9246e0cce984fab002ea0002dabe2f1f9356d9ee0f60b927e38
MD5 929a427d2980a72741bf7dd76d2e93e6
SHA1 d4ed3c8f57ced939c50c780318035850a630ea78
SHA512 5215778d0b4b80e65a6fc55d722594ac2d673e0d5a9bdc3c08a4e371c78676c68360ab7d404f702a4450994b7c7db28be7bb53a5348f8c09baed47b3e468c101
SSDEEP 49152:ob4D/q0Ui85J8qfymQuRFstAoAahXgWNoBnkUT:dLq0U95mAECoA+XgNkO
TLSH
T1D585237BFA49AAABC0E56334F44B40CF33354E4D6F66531A1928E23837F764A5B13684
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery evasion

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.lle.trrdxo/files/xu/kRHhBdbIN.jar	4244	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.lle.trrdxo/files/xu/kRHhBdbIN.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.lle.trrdxo/files/xu/oat/x86/kRHhBdbIN.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.lle.trrdxo/files/xu/kRHhBdbIN.jar	4217	com.lle.trrdxo

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.lle.trrdxo

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.lle.trrdxo

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests dangerous framework permissions 10 IoCs

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Required to be able to access the camera device.	android.permission.CAMERA

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.lle.trrdxo

com.lle.trrdxo
1⤵
- Loads dropped Dex/Jar
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Checks CPU information
PID:4217
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.lle.trrdxo/files/xu/kRHhBdbIN.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.lle.trrdxo/files/xu/oat/x86/kRHhBdbIN.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4244

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Virtualization/Sandbox Evasion

1

T1633

System Checks

1

T1633.001

Credential Access

Discovery

System Information Discovery

1

T1426

System Network Configuration Discovery

2

T1422

System Network Connections Discovery

2

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Plugin2.apk

Path /data/data/com.lle.trrdxo/files/Plugin2.apk
Size 99KB
SHA256 de7bf40574754a5144fa5cf3bc5e97f7adc7f5abebb18c41e8f0631917db4c0c
MD5 3d216f8fddb9705a6720a285475837f1
SHA1 f053d23b284bfe2faf6e76d353ff052471e2de2c
SHA512 38be39da8f96abc87109cfd57b2d63ddfa72971f023024a5b4ce1f97cd905a96a94e19eea19ae9b745f28d02c6689a4473627ce57ec85dce2018a77e699620cb
SSDEEP 3072:O/hr91fY/9tdWXLqQRClwYJ4sAAq4/IZn8NxQNRmDJS:2B9NMDGLqofsAAbNI8g
TLSH
T130A302021B29DD42D537903648558B26B23AB62BEDF6F32A1E63D36D3083DC8CB33549
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

umeng_it.cache

Path /data/data/com.lle.trrdxo/files/umeng_it.cache
Size 310B
SHA256 9254c5de26f28d42779b58f7f003d9aeec240946ad09eba1662e0cdf76b64cb5
MD5 bf47dfca3d2306f95c6b34654aad49ce
SHA1 be019e07a550a812f1b7ab1075365e4bb52b07bd
SHA512 6dfafc9e5e440284c3334a16571ec8ecf44a58460b0b415974823f32dab8592a03f012eb602659d4b7a3eff079d1ceae5a302c07030100b082166fdfc546e6e7
TLSH
T1EBE08CFC42380896F65460E39DD577C3FB02DC731CE08691B02CA0C86022AC5DEC4603
MD5 SHA1 SHA512 TLSH

Submit Download

kRHhBdbIN.jar

Path /data/data/com.lle.trrdxo/files/xu/kRHhBdbIN.jar
Size 789KB
SHA256 04ba3baa1f38c27a8b76ef99da554882c6ac1eadb5c1a8fc64815bfca6c460d9
MD5 8dedb5ba149ea4e0e8d802c7c991eca6
SHA1 834e9e0d9f36dea1bf261da83923838e8f9bfd1e
SHA512 0ed5161b86343e803438c488c16bfdcba73197ce245694813e68af292f608cd9796620b59d688fe6ca2b53eb04707248adaf1d57c0aad1b0d3a360f2398a073e
SSDEEP 24576:Qr2vhTtxRB/FrlNypwY/oYRBhrCimgW4U:TvfT3ZN+/oYRrnmgY
TLSH
T1B60533D5ED1F3DF78EF637E014A115261A4BCEE4A2BB736C981F0E831102ED21E952A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kRHhBdbIN.jar

Path /data/user/0/com.lle.trrdxo/files/xu/kRHhBdbIN.jar
Size 1.9MB
SHA256 9878427fda5efc263bdfc652a90a4e1a1a2437fa5d7fea6b3429c8336b1f48d6
MD5 1e04a654a986ff4638adc2c268fc71dd
SHA1 9c12d8e43a012cd7559b64b711a8df514ad6cae2
SHA512 ff7234b64d57ebfa100548c28a5483cd46adf20db11ce334db38134eb650f44e50701af612cee67104ab6bb423d04770a8a2fd98f45bb1951a9f3524d3e197a1
SSDEEP 24576:MdgPrQ61iDN8Mue5FH3Jxcqv59Pmczl41JYvyLhOA2:pjQ6AFjm1JYvahOb
TLSH
T12D956B02EA521E37C96E8B3684F38BE5633655492F83C71714089179FCE72C5AF6E29C
MD5 SHA1 SHA512 SSDEEP TLSH

Download

kRHhBdbIN.jar

Path /data/user/0/com.lle.trrdxo/files/xu/kRHhBdbIN.jar
Size 1.9MB
SHA256 ccdc485f41bbab77be1b04ce9406a2fac304bc2b1097167d1ff0f0b50eb69769
MD5 07ed85d8e6cd21dc38cfa93bf68dcb6c
SHA1 996cca89cb2a794ec0e7705c8c3a7852c8b2c26f
SHA512 451444bbe1d6ea1e020fdeb59bbdae1c97b1cb31805a7b3ad0384163cda5bd753e9f1cc6d5e7653c423fcbda3970cdbe614e51cf6c44b0928887225c124ac8e4
SSDEEP 24576:MdgPrQ61iDN85uex1t2pF1Bty+tG8Y80H1JYvyLhOA2:pjQ6/271e+tGqw1JYvahOb
TLSH
T130955A02FA524DB6C89EC73A65F2CBB07731994C6B878327100ED6746DB32D5DE9928C
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads