564723fd90ba2b388d7f3ec4a0a5f33be20e03a7494d8a56dce058386821f25d

General

Target
jaffacakes118_not-a-virus.HEUR.RiskTool.AndroidOS.SMSreg.pf.apk
Size 1.7MB
Sample261012-3d5jtab19n
SHA256 564723fd90ba2b388d7f3ec4a0a5f33be20e03a7494d8a56dce058386821f25d
MD5 9745c79be7be33996f61fb5972cac762
SHA1 47542b2e1c0ef22c269e112bb02db850bb144523
SHA512 0df4eb8627b8e380ef81d0a4bf52c91444a7291d4b2347e262bb27acb6aeef2aecda26fbb60c93efd0328ea70e158dd309c7cb3e60b272b936063bdfc53c1f02
SSDEEP 24576:jS4AEwAkISIQ1uBnLsYQFu3OE1OK5qQN45zDpqbR+CDj54mwRXMWp4pW1qPUN:jrwp1uyQlLAQu5qBDumwRXt54Py
TLSH
T18185232BE548CA6BC1A7B238B517608773325D44A366221B2738F23877F79DD5B23748
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection defense_evasion discovery evasion impact persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.liy.lpeboe/files/dai/MGwIxBbC.jar	4326	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.liy.lpeboe/files/dai/MGwIxBbC.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.liy.lpeboe/files/dai/oat/x86/MGwIxBbC.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.liy.lpeboe/files/dai/MGwIxBbC.jar	4301	com.liy.lpeboe

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery defense_evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.liy.lpeboe

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.liy.lpeboe

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.liy.lpeboe

Requests dangerous framework permissions 10 IoCs

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Required to be able to access the camera device.	android.permission.CAMERA

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.liy.lpeboe

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.liy.lpeboe

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.liy.lpeboe

com.liy.lpeboe
1⤵
- Loads dropped Dex/Jar
- Requests cell location
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:4301
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.liy.lpeboe/files/dai/MGwIxBbC.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.liy.lpeboe/files/dai/oat/x86/MGwIxBbC.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4326

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Execution Guardrails

1

T1627

Geofencing

1

T1627.001

Virtualization/Sandbox Evasion

1

T1633

System Checks

1

T1633.001

Credential Access

Discovery

Location Tracking

1

T1430

System Information Discovery

1

T1426

System Network Configuration Discovery

1

T1422

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Location Tracking

1

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

740410100062013

Path /data/data/com.liy.lpeboe/databases/740410100062013
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
TLSH
T1CD810441534000F1D05407F354D1130C1F47D1D5D5410F03351100C5DC415C40C70FC5
MD5 SHA1 SHA512 TLSH

Submit Download

740410100062013-journal

Path /data/data/com.liy.lpeboe/databases/740410100062013-journal
Size 512B
SHA256 d875548b7585884f51e30d20d255ec0d74b1a0377fb8019faafe21e05bf7f3c4
MD5 c69ec6af98151d392c76d63a480c0668
SHA1 e9d1717e7c157cec45fef2b37aeaedd6691cda7c
SHA512 9aab105d2c797dfd0cdcafc27d927c30896c139c7efd4044c7241d6aa89d9215181ab571b2732197aaf7f49e4fa55b6b061be3e03b0ff2a681aaf908b93b2f12
MD5 SHA1 SHA512

Submit Download

740410100062013-shm

Path /data/data/com.liy.lpeboe/databases/740410100062013-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

740410100062013-wal

Path /data/data/com.liy.lpeboe/databases/740410100062013-wal
Size 140KB
SHA256 2d7f783be3967e69fa34f542ff0bdf0d05ce957aa01f9289dc49812bbe44bfc0
MD5 8a2b57b0597a3d99318cb191b5e26000
SHA1 84fe1c74fe607525b8dd717b07769ad6d10d0a41
SHA512 cd32d168b253f4ae5beecf14facd63dcc520b863f69a8b8cb05a23475c9924c968a56185bb835ea59925d291ed169a38b93e52bdd7b9845568e2349f3bbb7b74
SSDEEP 192:wo9qa8t91hmOeW18OttyPcFlWLzJUut8vU1:NYvt91h1rRwUua
TLSH
T167E352D72A0C3B11CB0C8EB64482C245897CF79D6DC39BE7E5B19E359ED2D80A429C6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Plugin2.apk

Path /data/data/com.liy.lpeboe/files/Plugin2.apk
Size 99KB
SHA256 de7bf40574754a5144fa5cf3bc5e97f7adc7f5abebb18c41e8f0631917db4c0c
MD5 3d216f8fddb9705a6720a285475837f1
SHA1 f053d23b284bfe2faf6e76d353ff052471e2de2c
SHA512 38be39da8f96abc87109cfd57b2d63ddfa72971f023024a5b4ce1f97cd905a96a94e19eea19ae9b745f28d02c6689a4473627ce57ec85dce2018a77e699620cb
SSDEEP 3072:O/hr91fY/9tdWXLqQRClwYJ4sAAq4/IZn8NxQNRmDJS:2B9NMDGLqofsAAbNI8g
TLSH
T130A302021B29DD42D537903648558B26B23AB62BEDF6F32A1E63D36D3083DC8CB33549
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MGwIxBbC.jar

Path /data/data/com.liy.lpeboe/files/dai/MGwIxBbC.jar
Size 774KB
SHA256 6a8c4d6c6dc1ab5ae1d9338d852d2e3e512c9066bcafc5be55e8de08d47964cb
MD5 ab3af065e7337dce7289bedc76ea3ab7
SHA1 0392608300b4c55f98dd1f35b96847718913801e
SHA512 bf0d26dbe135dd3787524713d1ba3635e0199775ccdf3f543384beba86517c9eb2eb7da44cdec9b897a153408bb41bee8fc4cd8342dcb1c00e64fef82a457a12
SSDEEP 24576:x0mP0IXVJgdStxYuwEs2oDG7BONkMhIKFjTs3QYar:xnP0IFJMyxgn2o48BhIejIQrr
TLSH
T147F4231F9D2E7C33827C6168BE66D759B3035274D7F024B6F7AF929832E8C894A24057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MGwIxBbC.jar

Path /data/user/0/com.liy.lpeboe/files/dai/MGwIxBbC.jar
Size 1.8MB
SHA256 6374928e1d6d1e953de613fc39ed8b0633b9709663a621a3bfab15a52739782e
MD5 826183baf47eb9637c154d45ac7bcf23
SHA1 036e53f6930e1da2adf7b58dde9344773cf130ed
SHA512 93a45d51a6e0ce2e5a25b3c76a5107923f840b4aaba64a9b624882e1f51ba6c1e5e96bf180cf7508df588ec744f3ba6a89ce8386379405fead1a91393eef2c25
SSDEEP 24576:/j6R+e4zIhz1nUUJKABAUXxB1jzZHsfLWqrA2X4+RwlnOHC:WV4zIF1nnVxB1jzZ8TrA2rRwlngC
TLSH
T193953902E6521A37D69DAB3744B74BE56332A50D7F83D7171048A278FCD32C49E6B2AC
MD5 SHA1 SHA512 SSDEEP TLSH

Download

MGwIxBbC.jar

Path /data/user/0/com.liy.lpeboe/files/dai/MGwIxBbC.jar
Size 1.8MB
SHA256 feb16ea6a9c7af998d389b1702d961deda982a7b1866efb541113a45669a009d
MD5 8e424d81225e58e3505c4b24a4336517
SHA1 a6f41220d710c4b233631ac190bd15fd535e82fa
SHA512 106cb3f8376ddd83fb88e66e06b96f843dd6ae15c8c6eaba642229161395d424c15a36003de243451fd0f64a022152bb70107fc05f72564d8e1cd2b6b434ee2e
SSDEEP 24576:/j6R+e4zIhz1nUUJKABAcngLlQLRdfyWm0zrA2X4+RwlnOHC:WV4zIF1nndgLlQL9VzrA2rRwlngC
TLSH
T1B4956B02E7520E76C5DDA77A25F78B607731AA0CBF8383171049E6746DF32E09E9629C
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads