3ad4887b25638027b05579e080038a8e6bd8f024cf52eab50337111c48544fe8

Analysis

max time kernel
11s
max time network
137s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
28-04-2024 22:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

062e8d28b19420043445f07269099448_JaffaCakes118.apk
Size

1.6MB
MD5

062e8d28b19420043445f07269099448
SHA1

d194d9681036c43b46c0efa45ae4853af93e3ac5
SHA256

3ad4887b25638027b05579e080038a8e6bd8f024cf52eab50337111c48544fe8
SHA512

9504f6e4d5dc4ec7cd6d924baf045dfb9d210906d17a3c36d7c06ad24569240293537c3f161779a0f69b4708bfa1e3113490124d2893366cf4ef24403628bcca
SSDEEP

24576:pKwITYz71EeBU0dG6PPVntqyPGq01fyK7WNRIIfFas+kTO9xKEGF6g9IOiAR:pKwaYKZizPVm65PIIfBk9sEuFX

Score

7^/10

collection discovery evasion impact persistence

Malware Config

Signatures

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.auk.ygm

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.auk.ygm

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.auk.ygm

Reads the content of SMS inbox messages. 1 TTPs 1 IoCs

collection

SMS Messages

T1636.004

description	ioc	Process
URI accessed for read	content://sms/inbox	com.auk.ygm

Reads the content of the SMS messages. 1 TTPs 1 IoCs

collection

SMS Messages

T1636.004

description	ioc	Process
URI accessed for read	content://sms/	com.auk.ygm

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.auk.ygm

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.auk.ygm

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.auk.ygm

com.auk.ygm
1⤵
- Checks CPU information
- Checks memory information
- Queries the mobile country code (MCC)
- Reads the content of SMS inbox messages.
- Reads the content of the SMS messages.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4229
- sh
  2⤵
  PID:4408
- - chmod 777 /data/user/0/com.auk.ygm/files/syHello
    3⤵
    PID:4481

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Protected User Data

T1636

SMS Messages

T1636.004

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.auk.ygm/databases/app_download_record

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.auk.ygm/databases/app_download_record-journal

Filesize
512B

MD5
211e774fe71d7a127606f6a299bb2c31

SHA1
503080f7b29089118c15935dd0059f1581bde878

SHA256
3be64820fa00e5094e436fba66477fe4b085a29dbc436a1178fb4d769c4d5884

SHA512
bec6d34f27760a249076f99729f1d7fe7d9389df52c9c4c0e5a6b18f4abc2c630bac04e784a3019b96a58631530787e26df58b7ad65f77eb71f5d364d5e582a5

Download Submit
/data/data/com.auk.ygm/databases/app_download_record-shm

Filesize
28KB

MD5
cf845a781c107ec1346e849c9dd1b7e8

SHA1
b44ccc7f7d519352422e59ee8b0bdbac881768a7

SHA256
18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

SHA512
4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

Download Submit
/data/data/com.auk.ygm/databases/app_download_record-wal

Filesize
44KB

MD5
5f6de301678cab5c361e9ba231dcf0ba

SHA1
746fddd9d877fab9a16c170161ef4b4e13f5d87d

SHA256
778ef65cf62606cf229b3f358e74e9ebb9009f6269c64c4dd0afe55c9f233177

SHA512
48e7a1c39caa047278d481b367a129f5f8b20c09fa37807b0c0ac9c77575aa5f2dc69cae2eefd5bdb8b4b563b6b08dae4a19f533683757023d2e8bf077c39a40

Download Submit
/data/data/com.auk.ygm/databases/sy_pay_record-journal

Filesize
512B

MD5
8add11b2522010e97feac7dfc9107186

SHA1
ef55cf064c51dd87d1d06ae5bb7ca2d980b27eb6

SHA256
ebc42bb6fad16ac31737a53af06fd1e17e5c0e2cf3a67a4d4a8a731bb514953c

SHA512
ce158a7767c7ccf42f02db8f5a40f5b3c717a113dcbe8d997defd7b8c0f825a8f72de70f3c55571b357c0fcde18c5566beddf2ee12b907897280c8b079673ed2

Download Submit
/data/data/com.auk.ygm/databases/sy_pay_record-wal

Filesize
44KB

MD5
ef7df5c5051d0cbe403cb20dc0d8d533

SHA1
25bf0833fb9a5bce2d06644342966719c96789fb

SHA256
0fd7bdfaf1e5cc80ec318d06956a5093d0f3d9a8938c5cf6a070bfc1299ebb81

SHA512
c5577afab30317367a87c1a7bd8d73c1c739af81d63587649c716366349a85f5394304e31b10b428a7e0b427249bbcdffe8fd1c5d892870aac3ecb1ec0a3675a

Download Submit
/data/data/com.auk.ygm/databases/video_record

Filesize
88KB

MD5
eb6a07c02a4503a237a35d449de23e45

SHA1
c8dfa2dea667659ec567dd111cb1ee47903f6e49

SHA256
d76989d5c52ee0bdb508b1a6217fdabba45873e2d832538c9a407850c845da77

SHA512
ff3f8acebe881b8dac8c41f3a0d2ea5ffb6a936e9fa88e279aecef25470ed95693921ec1bc2ea618e06189893bdbd62f73a49e4bc847819dc4a216727db7be86

Download Submit
/data/data/com.auk.ygm/databases/video_record-journal

Filesize
512B

MD5
5f4b24999537ca083e62ae85bec5aa0d

SHA1
811ee3917866f4d20527f88e68af8f49eed4aeb5

SHA256
9f8134efe8926ccc558151575def26dfdac055bd5036422d55012d624226c632

SHA512
700142dbb7478421e97a68f85f59762716a55d9e6179601095fe0ac074c561e4bb9be20e7f9d0a90ce4b73d056afb07f11186d5ed97d34ceffc2d6e26403845f

Download Submit
/data/data/com.auk.ygm/databases/video_record-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.auk.ygm/databases/video_record-wal

Filesize
100KB

MD5
23ad8ca66485f297da82dbc4b61577e1

SHA1
f2983f8b15030e6ea0006eb5e89fd8ebfb862cb8

SHA256
f030c1225b26c22badcb691d50a11cff1ef6688a70e77811848d45f5488fb742

SHA512
c6c7394d9cdcd2f8f7ef60144c28ad2a22a236cbd39a7a3109c4f873d1f2192914e8c51ade06a9e75df0f0cc78364f12b200408b3a1ab17cd89c882f6058dbc8

Download Submit
/data/data/com.auk.ygm/files/.tmp/busybox

Filesize
177KB

MD5
27690d086104b1ef9f0f951721cda427

SHA1
8a8ca17f0036ae155fc6d969cfb592fc9ea5d203

SHA256
599d001cf24d21b3caec5b823db2ebe750dd15163bbf2b090dc0610d85e48bac

SHA512
d1c07b6b837b78c63188d71a76bcac6663cd560537d2325e4ce28b5feb816c98e24e273be29b5d23742f4e43d3ded8e2e6fcbf29fba35acd528974fb59221c90

Download Submit
/data/data/com.auk.ygm/files/.tmp/libinst.so

Filesize
49KB

MD5
ae939bb7faa9f8762d75f0526eb22d17

SHA1
bafa983f20431ce5176971365b0f6b89e926247f

SHA256
c04cd7b6e78f22c51e99696e09e4332d7ddfd8ebcaeb94251b0314b8faa399f3

SHA512
ce4e7d3af144055064191c355f9904f215e15f9f2330f45c8056dfdbcbb302c515cb85a413bb255ef891bfc0781bb5f1b8c27439143ef0118d846edbf116a657

Download Submit
/data/data/com.auk.ygm/files/.tmp/nail

Filesize
45KB

MD5
1a8bd20c1fcfd24126b61371b653bc8f

SHA1
50b7fffa7e1c765a5da1ac9186d4e5186b6157c3

SHA256
56b6a1ebc4dadf3571d67fc59aaf32c37504d29da1300c742ee013d22e429871

SHA512
d59cff3c9445195aa0511502e2df621aeca1d42e336e37f129abd550cb4a7ab27cfdee3f4b342579f2d9aed54e0a9906696d28d957303586efa3fb033f360fd9

Download Submit
/data/data/com.auk.ygm/files/.tmp/nail

Filesize
45KB

MD5
59dd28935fa6079ac1b8d7c8e28697f3

SHA1
dbb0d7b425c2ce936c5050e1805e8f33d04b32bd

SHA256
d6f7bd5eb05218908b707c08691a47b21f7e92d48a818224e6934648f5667ce4

SHA512
444ceaf17bf2fc6035130dbfce094c80c62f77db0462fb1f2dc1c6081d69620fe0d45a5b3ebf2f2381a2a5f4e23d54e92feacc81367cd041b4ca76b55aa0e791

Download Submit
/data/data/com.auk.ygm/files/.tmp/sub_nail

Filesize
45KB

MD5
79b331731bb21633b50f3d32a9d823d5

SHA1
af43c7b799313e1516f6a114fcb70075b241c810

SHA256
f517ab558652edcb8d1dd59ddc9ef42612c60394ab745f4790a114bc0f376f28

SHA512
62f236a8246475cb29b605923f707fda367c3e9b0e8d5d03e6652425f45294346a11bf28a13e4a91a98a1d8f25b42610aaf125063eb883872c16e21f66330b78

Download Submit
/data/data/com.auk.ygm/files/syHello

Filesize
9KB

MD5
ab3aec529c0a0d751f43cf6de904809a

SHA1
a7ad041ad68cb887d74a4454475693d06dbc3d10

SHA256
3604015d5d2a3d8a7c3b06fa5c9d2302bbcd0e7ea5ccaf24dd98f99f89b0e8ba

SHA512
7950c3df10a8941a690e83a7e7829bf744f9a64ca7b0863af625c10a15975cfb9d8876dd9918a0cb9d852c631f811db742f0b69ef031dc7a2d093a98f4b4439c

Download Submit
/storage/emulated/0/Android/data/com.auk.ygm/cache/crash-2024-04-28.txt

Filesize
454B

MD5
c34a33d9ae0d9108a1310bab98957a69

SHA1
b9ddb5e5db196227e0c47b1f84872de956263806

SHA256
8221966b04f82e482aa0390db8ba42119a20ca5716ab4f254cf43c93320df355

SHA512
13e20a3c89cfe50e4419592663ef19fd44f348c994bdbdd71d053f0df2ffe6ef152b18d92687ae8b52a23c480f7a846780b139027920111a7cc850bede3e687d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads