Analysis
-
max time kernel
126s -
max time network
149s -
platform
android_x86 -
resource
android-x86-arm-20240221-en -
resource tags
-
submitted
01/05/2024, 09:44
General
-
Target
0b79cef4ef45d0dceb2787bbda73d67c_JaffaCakes118.apk
-
Size
8.0MB
-
MD5
0b79cef4ef45d0dceb2787bbda73d67c
-
SHA1
60ad47a506af11799ef700315cf0fe7203d30588
-
SHA256
bc015a02e3a0486a7c226a3948a4c5794756041044f5c2f381ca5a85dbf58369
-
SHA512
4e65601daa32624a9052f305189438ac2835c619898e195652f22f1bc2fbb09e6f7ad520342b6fbd863e1f01b97602b9f04bc297a3b9f939d658b25b52486a37
-
SSDEEP
196608:WRsCRqweE/MniEB4uJAeh0m0hROONkPwLPacPDoHJVCLF:y0wSnibuJVWm0rZkPwrrMHJVCh
Malware Config
Signatures
-
Requests cell location 1 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
-
Checks known Qemu files. 1 TTPs 3 IoCs
Checks for known Qemu files that exist on Android virtual device images.
-
Checks known Qemu pipes. 1 TTPs 2 IoCs
Checks for known pipes used by the Android emulator to communicate with the host.
-
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks if the internet connection is available 1 TTPs 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.snmi.ninecut1⤵
- Requests cell location
- Checks CPU information
- Checks known Qemu files.
- Checks known Qemu pipes.
- Checks memory information
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries information about the current nearby Wi-Fi networks
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Listens for changes in the sensor environment (might be used to detect emulation)
- Uses Crypto APIs (Might try to encrypt user data)
-
/system/bin/sh -c getprop2⤵
-
-
getprop2⤵
-
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Hide Artifacts
1User Evasion
1Virtualization/Sandbox Evasion
4System Checks
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224B
MD5b2ad323410cc9840e2d2bcff4e628db3
SHA11fd804735ec987291aba489aa68ba40245d4ac7d
SHA2569ff8721c65766d159c36d9deda5ecd6a0158ab7f6731d9c436ba5d0e31e208e7
SHA512eda3b1b51d1b68558441a8db11cdb1a3c86816748de7eb538819ec21ec1813cc85976ae0616caf3c261bf2de1b17097ac719641bc357726d1fe9966bfae010a8
-
Filesize
224B
MD5a860f3bfa1465683df86d678751946ad
SHA1c6674441c2c955cd20eadd6758b724dd8ec44195
SHA256a7c1aba1666cf7024353ae989c94f4a192d0a3c2c46468c5200d8388941b454f
SHA512d18a1a8ed50a013eeebfeb1a0136a5cd4ab2d4d1e09538e02d8b4d9cd32ab2b2b599291ba92a9b6fab3ef678bcc1b31aae5bfa20d543f72b997ec18b1a5dafba
-
Filesize
58B
MD50d210bfb2a0e1f1b4c082a6a0f79de07
SHA1bb8ed9e364db79d1d9f2fcde3f15091893222faa
SHA256988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
SHA512536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD56268329403dcb29ae617884d75e72700
SHA1d7787c1315a95e8f44658146a19f5de6c2f9e0e5
SHA25677a8a1b9c9879a2c1570155fea23aae4937f63d015740e3e3b203a0b092c0b8b
SHA512fc13cf35e298aa2aba127c99635cafbe80a0eb2685ba983e296fd2a3ff667a108fe13a845638346fb0da412c2b1b72298e442565f835f2565dc38a7bc545e923
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
76KB
MD55a87bf328073f3fd6e60b5c0422441c4
SHA108f974f3fd3557e64df35ca65aaa6c022740f3bb
SHA2564acfb0b5f71e0043567eccef5ea310e9ea422e06ef3cb87e3159c8a3b723ac1b
SHA5125299d004094cdd7e8334c3d2e579c7d940288209e633bd38d2542568543f9b96b050da244009fd4cd01b93b4eeff802411702735cb00d2366a5d9794a9f4eb42
-
Filesize
1KB
MD5e4cce0623387e7784bfe5de69ae92023
SHA13bb0fd11c21300c998918729e79a95f361fb916d
SHA25665564a200cae0283210aba72a360582d81684e3b8763084f411783f613f5df76
SHA51211390904a81dd42d3713ee58518c5434fa51c36dec437429614ee121e2fe1a154619b88d48e91706ad8519ea6d84815c9f2c464ec402679a0b6b3824e71c0dc4
-
Filesize
415B
MD5f92b95e21ac000efd8e52a097da52546
SHA11dcc47048daee7a56844b303ce72a0ec4f951f53
SHA256fbbdf78544e61ddcc649bd08510c6e3ca36b332ea7c4aa74d409bc0457ad95e9
SHA512350b3b3eef1ddff0973844a049bec48011a647ac89a0fd9b349324d362d33378a3ff452df338a1fe6e040d8eb6758c84ebf40e2a0d6c3b21b5a85159af0b1000