Analysis

  • max time kernel
    151s
  • max time network
    162s
  • platform
    android_x64
  • resource
    android-x64-20240221-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
  • submitted
    20/04/2024, 05:48

General

  • Target
    fc0f20db5f8098e42d845492fcf3fca4_JaffaCakes118.apk
  • Size 4.9MB
  • Sample240420-ghg4esaa69
  • SHA256 81d22a908f7989dbafa747a6cc3ce42a1068d5bed9f34cc69fa86672b4d57e19
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Signatures

  • SMSFactory

    SMSFactory is an Android SMS trojan malware first seen in Jun 2022.

  • Checks memory information 2 TTPs 1 IoCs

    Checks memory information which indicate if the system is an emulator.

  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
  • Acquires the wake lock 2 IoCs
  • Checks if the internet connection is available 1 TTPs 2 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.kongregate.mobile.bitheroes.google.hack
    1⤵
    • Checks memory information
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Acquires the wake lock
    • Checks if the internet connection is available
    PID:5031
  • com.kongregate.mobile.bitheroes.google.hack:Metrica
    1⤵
    • Queries information about the current Wi-Fi connection
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Acquires the wake lock
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5076

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        OneSignal.db

        • Path /data/data/com.kongregate.mobile.bitheroes.google.hack/databases/OneSignal.db
        • Size 52KB
        • SHA256 c17b0ff6f351266dfc375282c9ee02b8263348390207cec71835d7e0956419e3
        • MD5 SHA1 SHA512 SSDEEP

        OneSignal.db-journal

        • Path /data/data/com.kongregate.mobile.bitheroes.google.hack/databases/OneSignal.db-journal
        • Size 8KB
        • SHA256 433ee70370bf79bb1120da5d068d8fea878a44074fcefe1cf8b76f7c9860469c
        • MD5 SHA1 SHA512 SSDEEP

        OneSignal.db-journal

        • Path /data/data/com.kongregate.mobile.bitheroes.google.hack/databases/OneSignal.db-journal
        • Size 512B
        • SHA256 c35c8e84b55c90589311d703b60594d3d392cd2bff5d3f2b2405e5d8f4ea213d
        • MD5 SHA1 SHA512

        OneSignal.db-journal

        • Path /data/data/com.kongregate.mobile.bitheroes.google.hack/databases/OneSignal.db-journal
        • Size 44KB
        • SHA256 b588493203abae831f9c67ea881ab6f4c2240d85e4aa972c978f692b8b54069d
        • MD5 SHA1 SHA512 SSDEEP

        Mint-lastsavedfile

        • Path /data/data/com.kongregate.mobile.bitheroes.google.hack/files/Mint-lastsavedfile
        • Size 12KB
        • SHA256 1375c266a7e5eb1ca50c9fea8007b40a4ad385b54c9c9acef1b974c08d523738
        • MD5 SHA1 SHA512 SSDEEP

        MintSavedData-1-1713592107484.json

        • Path /data/data/com.kongregate.mobile.bitheroes.google.hack/files/MintSavedData-1-1713592107484.json
        • Size 8KB
        • SHA256 37cd6252475ea0dfab69a36f7409328c7fbe327ef3e3182e1eedc6f6e65a45f9
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb

        • Path /data/data/com.kongregate.mobile.bitheroes.google.hack/no_backup/androidx.work.workdb
        • Size 12KB
        • SHA256 1789484c5526cd03250e7dbd335bb7bfc702e6b39204ed8140b58a7a12e26a33
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-journal

        • Path /data/data/com.kongregate.mobile.bitheroes.google.hack/no_backup/androidx.work.workdb-journal
        • Size 116KB
        • SHA256 9890c453ce5521fcbcc1ff251891365bdef473dbc93cf8cc90b7c4d360c14839
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-shm

        • Path /data/data/com.kongregate.mobile.bitheroes.google.hack/no_backup/androidx.work.workdb-shm
        • Size 32KB
        • SHA256 a70a565881fb886eaf93622f6954bd57f793bfa3ec11a5ddfe329bbd551f0302
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.kongregate.mobile.bitheroes.google.hack/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 6c5520484d1e72c410665ed939ac97d3b9de0facfc40abdf0bfe00f1473f18b8
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.kongregate.mobile.bitheroes.google.hack/no_backup/androidx.work.workdb-wal
        • Size 108KB
        • SHA256 4cfb67f7d87d8894f201b813b3b7dcbad98519771bcd4693d939a502d140e935
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.kongregate.mobile.bitheroes.google.hack/no_backup/androidx.work.workdb-wal
        • Size 253KB
        • SHA256 77daab22176a3091003f86358461f605e98bf304274720c1bc8297c54ed18a60
        • MD5 SHA1 SHA512 SSDEEP

        com.google.InstanceId.properties

        • Path /data/data/com.kongregate.mobile.bitheroes.google.hack/no_backup/com.google.InstanceId.properties
        • Size 2KB
        • SHA256 8bea9a5d2f60278a7b931468d07623469de2d46df52aed42a6b09c0357bb6f15
        • MD5 SHA1 SHA512

        credentials.dat

        • Path /data/data/com.kongregate.mobile.bitheroes.google.hack/no_backup/credentials.dat
        • Size 226B
        • SHA256 104957a241d580845ce38f29006eeb4c21bbbf030be52f136d8d99dae8524332
        • MD5 SHA1 SHA512

        db_metrica_com.kongregate.mobile.bitheroes.google.hack-journal

        • Path /data/data/com.kongregate.mobile.bitheroes.google.hack/no_backup/db_metrica_com.kongregate.mobile.bitheroes.google.hack-journal
        • Size 8KB
        • SHA256 c9f754226a8cc98da68dbb3565c7eb2ddaa1b01f89bddf0a83056deadc5143f2
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.kongregate.mobile.bitheroes.google.hack-journal

        • Path /data/data/com.kongregate.mobile.bitheroes.google.hack/no_backup/db_metrica_com.kongregate.mobile.bitheroes.google.hack-journal
        • Size 12KB
        • SHA256 3d405e72d09621f582bbc68a11eca6ac979ddbec3ab5609d262d4f6f466bbb82
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.kongregate.mobile.bitheroes.google.hack-journal

        • Path /data/data/com.kongregate.mobile.bitheroes.google.hack/no_backup/db_metrica_com.kongregate.mobile.bitheroes.google.hack-journal
        • Size 277KB
        • SHA256 472ce87b69309cecf62fcd2fc28655f65e45ab46792e1feda58efc11ae7064a6
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.kongregate.mobile.bitheroes.google.hack_20799a27-fa80-4b36-b2db-0f8141f24180

        • Path /data/data/com.kongregate.mobile.bitheroes.google.hack/no_backup/db_metrica_com.kongregate.mobile.bitheroes.google.hack_20799a27-fa80-4b36-b2db-0f8141f24180
        • Size 36KB
        • SHA256 9a9810a4c20e4fd2c52757fba93fc490982f7e201a9357f4b8e26f61cedd8510
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.kongregate.mobile.bitheroes.google.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal

        • Path /data/data/com.kongregate.mobile.bitheroes.google.hack/no_backup/db_metrica_com.kongregate.mobile.bitheroes.google.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal
        • Size 12KB
        • SHA256 dd53946e5e80100756988995f35dec4146fd499d9fae0bd847aaa7de25834c23
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.kongregate.mobile.bitheroes.google.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal

        • Path /data/data/com.kongregate.mobile.bitheroes.google.hack/no_backup/db_metrica_com.kongregate.mobile.bitheroes.google.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal
        • Size 20KB
        • SHA256 9b6356265ca95bed6afeaa6d828f3ff1568ed8844542c0388aca321a5ad66bb5
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.kongregate.mobile.bitheroes.google.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal

        • Path /data/data/com.kongregate.mobile.bitheroes.google.hack/no_backup/db_metrica_com.kongregate.mobile.bitheroes.google.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal
        • Size 20KB
        • SHA256 aefa43c63f5b31fdebdb9f4f2ac7e25cdd7d1461cf900a55518166ce223969ae
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.kongregate.mobile.bitheroes.google.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal

        • Path /data/data/com.kongregate.mobile.bitheroes.google.hack/no_backup/db_metrica_com.kongregate.mobile.bitheroes.google.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal
        • Size 12KB
        • SHA256 7c521d60e286c646d484711236d472b53ed88d5adbeec44c3b819569fa9d7557
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.kongregate.mobile.bitheroes.google.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal

        • Path /data/data/com.kongregate.mobile.bitheroes.google.hack/no_backup/db_metrica_com.kongregate.mobile.bitheroes.google.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal
        • Size 12KB
        • SHA256 f2c8a51dd30df01a49fbfe1846539de6a335701b578f2e9c36d2eb3c92968bab
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.kongregate.mobile.bitheroes.google.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal

        • Path /data/data/com.kongregate.mobile.bitheroes.google.hack/no_backup/db_metrica_com.kongregate.mobile.bitheroes.google.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal
        • Size 12KB
        • SHA256 5ef5e7a03be9bd3c1a3b198e83a9f88bf41999714b39fd9792cc23df2ac83024
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db

        • Path /data/data/com.kongregate.mobile.bitheroes.google.hack/no_backup/metrica_client_data.db
        • Size 20KB
        • SHA256 e86ba3041e9c1a5d545d468dbe6df3dafad7095e4b7c500b39d0dad281cfffdd
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db

        • Path /data/data/com.kongregate.mobile.bitheroes.google.hack/no_backup/metrica_client_data.db
        • Size 48KB
        • SHA256 9fbe301ce393513fbc59da8db97591a8b7e41d9a65eea48f7e034fc67062fed6
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db

        • Path /data/data/com.kongregate.mobile.bitheroes.google.hack/no_backup/metrica_client_data.db
        • Size 20KB
        • SHA256 4564ec31a51694e8349f462d5ada137b3f37b7c42515a7fe34ea8ef33b5063c5
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db

        • Path /data/data/com.kongregate.mobile.bitheroes.google.hack/no_backup/metrica_client_data.db
        • Size 20KB
        • SHA256 2aaa20efba2e9306e0f9c59658fa9a3d9c5c6849903f78435badf577bb5f258c
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db-journal

        • Path /data/data/com.kongregate.mobile.bitheroes.google.hack/no_backup/metrica_client_data.db-journal
        • Size 12KB
        • SHA256 3c510f272afbfe33681b1cb0642cfe7d65bcfbe785a0aaf7229ece9a001e479c
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db-journal

        • Path /data/data/com.kongregate.mobile.bitheroes.google.hack/no_backup/metrica_client_data.db-journal
        • Size 512B
        • SHA256 84fa3d078ab955acf9df28f05a14b0b0b24e2e45ae30e344b19410d7323e93c9
        • MD5 SHA1 SHA512

        metrica_client_data.db-journal

        • Path /data/data/com.kongregate.mobile.bitheroes.google.hack/no_backup/metrica_client_data.db-journal
        • Size 12KB
        • SHA256 2abc6c1991fc66552e0be82f80c28b3142b04405c556fd8edad721357b740e09
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db-journal

        • Path /data/data/com.kongregate.mobile.bitheroes.google.hack/no_backup/metrica_client_data.db-journal
        • Size 12KB
        • SHA256 1f9cd44e3b5a1693ace799a14fc187ff41e356fae1f1ead32cc04b75b7eb1313
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db-journal

        • Path /data/data/com.kongregate.mobile.bitheroes.google.hack/no_backup/metrica_client_data.db-journal
        • Size 20KB
        • SHA256 241d509f6874e4f2840983c03cae9d821b00b3c91564c5ad8fcac34d0effdabd
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db-journal

        • Path /data/data/com.kongregate.mobile.bitheroes.google.hack/no_backup/metrica_client_data.db-journal
        • Size 12KB
        • SHA256 d7062df926475ef4bbab59c439984276410e8036dea6c2234aec421dbcd1f370
        • MD5 SHA1 SHA512 SSDEEP