1ceff414d9162d793aa037ebe22e0555e326631c2159ce504c9f9d77780597b2

Analysis

max time kernel
49s
max time network
149s
platform
android_x64
resource
android-x64-20240506-en
resource tags

androidarch:x64arch:x86image:android-x64-20240506-enlocale:en-usos:android-10-x64system
submitted
08/05/2024, 22:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2709b236cc215a63857d63cd76c01cd7_JaffaCakes118.apk
Size 6.2MB
Sample240508-2grxfsde43
SHA256 1ceff414d9162d793aa037ebe22e0555e326631c2159ce504c9f9d77780597b2
MD5 2709b236cc215a63857d63cd76c01cd7
SHA1 1cd8571f5a07834bcd64f2be28066321e1803456
SHA512 c1ab2e4e4d260107762506284e702a92765ea59af27c3870fa8e01563ffdf0ac1330a612906b37e01510e1b47409c992d97cb3e28795c5c9b4e2ec29ce252090
SSDEEP 196608:MWhozeL6JIb7oEZ08pBvI3GxYDWviyf0KQ:MfdIb7zXpFGPyf5Q
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection credential_access discovery evasion execution impact persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
5145	com.longtongcom.monsterfantasyasy.hack

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.longtongcom.monsterfantasyasy.hack

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.longtongcom.monsterfantasyasy.hack

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.longtongcom.monsterfantasyasy.hack

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.longtongcom.monsterfantasyasy.hack

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.longtongcom.monsterfantasyasy.hack

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.longtongcom.monsterfantasyasy.hack

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.longtongcom.monsterfantasyasy.hack

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.longtongcom.monsterfantasyasy.hack

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.longtongcom.monsterfantasyasy.hack

com.longtongcom.monsterfantasyasy.hack
1⤵
- Removes its main activity from the application launcher
- Checks CPU information
- Checks memory information
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
- Schedules tasks to execute at a specified time
PID:5145

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

OneSignal.db

Path /data/data/com.longtongcom.monsterfantasyasy.hack/databases/OneSignal.db
Size 40KB
SHA256 be512b097518bdaba39e6106c143a267f56e98d8f980ed6295773c4082149824
MD5 6ea5817dfb71687d648b0e4763152545
SHA1 b5a1a2a1fb579520ddeb9861c0eba5f7109d0d74
SHA512 cafff4c86b710428753e528aed212096fef264a36cd6d6ff48af487ce1d5cf90065b4be0ad6460e4e7631040f7a28657f31811be1a5cb417c4b2725c51fb5186
SSDEEP 24:TLqCdOvoaTdLtdxShqWkGSe/+X5Eyrz2+xGTrOPjwV+HVMGGSv:TGCd83rvXcrObMoOS
MD5 SHA1 SHA512 SSDEEP

Submit Download

OneSignal.db-journal

Path /data/data/com.longtongcom.monsterfantasyasy.hack/databases/OneSignal.db-journal
Size 512B
SHA256 7287ed308872839a91a52d70ae0f19771f1f46bf6e66728d8292fcd36e3b6191
MD5 ea4658a1c95137e830f6134354dba6ae
SHA1 379a80077528f78d51904626cfa603a887a93706
SHA512 ca84ca37e810c48c711e9f48ca9c5c3f00e0aceec59ba909f8a178e897c3221bdb6c10eb2ff888bd4ddd7b82ffa773250d0b630c56072bfcdce5d739f37130fc
MD5 SHA1 SHA512

Submit Download

OneSignal.db-journal

Path /data/data/com.longtongcom.monsterfantasyasy.hack/databases/OneSignal.db-journal
Size 8KB
SHA256 3e4d215fccd6a7434c0eca37bd03002b2eb92cb2aafb5eb0cf1f5da3b581f678
MD5 757b91cec9426c71ceaa4227257b5153
SHA1 a0d9c017fce4cec6b963db5cd35748e7a0df5ee8
SHA512 eb0f3f7fe38beed432c6e4735f8519be5e4b720b9fde07c753e7eed94200ae1c732a6fdf0883019625311848525095b6309270e059db788ea9f3967a043afd75
SSDEEP 6:7+/l9rn1Qg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKgO:7+t4qLiuWdwRmBEyPbq
MD5 SHA1 SHA512 SSDEEP

Submit Download

OneSignal.db-journal

Path /data/data/com.longtongcom.monsterfantasyasy.hack/databases/OneSignal.db-journal
Size 8KB
SHA256 b96f78a4ba0d4f9d5ab5a3a307826b336d5273798f31077a37ab85977f93c8d6
MD5 3918f243dc0f7f31479f9ab140c776b6
SHA1 4edde87be29a0bfc729bb8fd9df664e2cc7a4816
SHA512 e4b0ba40355147780aac0f9f8ae6dbfdfe3279a371053ab06aa35fb2ec40a0bcb83ea044ec3e5486544156ec04450afab9d04e77ed43129157568b578068076a
SSDEEP 6:7+/l9C8FPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKFtl8t/a:7+tkiqLJdTRmBEyPb8l81a
MD5 SHA1 SHA512 SSDEEP

Submit Download

evernote_jobs.db

Path /data/data/com.longtongcom.monsterfantasyasy.hack/databases/evernote_jobs.db
Size 16KB
SHA256 e826c87ae7fcaf8b600be0c9cdf57e2beba0390f167f679ea3be7d8b3f133777
MD5 d01989587a7bae9eac50aa9f20338254
SHA1 7e87b8477dab8b9f9a476ca14ae282fd1d7fca7a
SHA512 38d9827a649bb26da50480c4be9551752f8196f145dbab56ce155b09cfc6a0babab36ae92fdf54f81986dd616f6cc49a25b527a5a4c054de4f8a268fb1da822a
SSDEEP 12:TL8SzpN0KkYrZASBMAB1G0d/P6dMbWAz9m9W3dOsuA3MTzeRmBEyPbBvOwzOC:TLZzpOKRvTZYAZ3mGSNzOC
MD5 SHA1 SHA512 SSDEEP

Submit Download

evernote_jobs.db-journal

Path /data/data/com.longtongcom.monsterfantasyasy.hack/databases/evernote_jobs.db-journal
Size 8KB
SHA256 d689dc61bc1856c5fb66c6911237ef38fb0af0be1db2d6b8175ad5d612c808b4
MD5 efabebd4028a17fe00092845f3f1e055
SHA1 51d17aafeabd6d1de6c683f7b1f27205132e5aa1
SHA512 8b2d6f65a3d00ad3add4f2a3e7227c15582a9fb39b682a288eb10c067951686baec1c1afb47a115e84031689f814ef6cdf294b3af6e08fd83185b78a3b0a9bb2
SSDEEP 12:7+t5afqLpHpN0KkYrZASBMAB1G0d/P6dMbWAz9m9W3dOsuA3MTzeRmBEyPbf0:7+t5eqLppOKRvTZYAZ3mGSf0
MD5 SHA1 SHA512 SSDEEP

Submit Download

evernote_jobs.db-journal

Path /data/data/com.longtongcom.monsterfantasyasy.hack/databases/evernote_jobs.db-journal
Size 512B
SHA256 147864a1aac30a08a779348d745dfe60802200b5fdde36513433f5af7a639760
MD5 b7be74f56fada796e20cf8382966aafe
SHA1 98d3932c7a942e5acf7b88064a5bdf557876117d
SHA512 dc164204ed6d4972f2a8ebdd6d8537e717574d6fa3b34e54eee44c3df5961a5c306ad4c312e11947fabec3f8b4de83a5f7bc28b374c293a78200f0668bb12871
MD5 SHA1 SHA512

Submit Download

evernote_jobs.db-journal

Path /data/data/com.longtongcom.monsterfantasyasy.hack/databases/evernote_jobs.db-journal
Size 8KB
SHA256 442e029e389653a08bc073a9dd33d46fe738fa90946551ec8a2d9044ad10fd39
MD5 77a6da553119c48473b390631df1e3e3
SHA1 4f1912ebe5abb1fd93e3bfceec401446f7f3b736
SHA512 386691d1cac59a3f9c8c7055c22412964426ef7b01c82cec29d2bafeee3b25ed10aa973a88f32602a87dcc0b532059cc3e620e9864468a4156e882559831ea48
SSDEEP 6:7+/l925gn1C/ng9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKL:7+tM5/nqLiuWdwRmBEyPbE
MD5 SHA1 SHA512 SSDEEP

Submit Download

evernote_jobs.db-journal

Path /data/data/com.longtongcom.monsterfantasyasy.hack/databases/evernote_jobs.db-journal
Size 8KB
SHA256 d2c4352e1832c9cda8cd650d0530b70e95a00d5ebbc21a634cab8f7e3fd608d4
MD5 152b1a11563da3a096b1c2af9bf9cc32
SHA1 85544dcdceb46ce85ff98072270fbbd2c6e96744
SHA512 afafb982572b58e0b4ae39e573d570956af726a959061cfc475b7f2b95e011233346c96051d06168268c84ef65095c96c2ea1015dceb97a3efe03719f7571d17
SSDEEP 6:7+/l9S9kPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKoz//2B:7+tY9MqLJdTRmBEyPbxXm
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.longtongcom.monsterfantasyasy.hack/databases/google_app_measurement_local.db
Size 16KB
SHA256 6971f4267e1a8353e7df4f2def3973686b77d9b550272b49526eeeca9eecaf0d
MD5 33187268592db8e0a4c23f7005b41558
SHA1 ed5409f7be9117edacfc23821b04c4d911b751ae
SHA512 4e3a1595682bfd601c90c4df16e37fbd0561a5e492da0b132ef54e5ec01dfc2f580fb29e9ee7b7883ca03e0a2ba53c5940b2fdf06fb6bd7c5527fdd88846cd48
SSDEEP 6:l9bNFlsls1ylO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/RCM+/lulvl6Ylr:TLiEy9zmzrfRmBEyPbP/P+/0Fl6YlX7
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.longtongcom.monsterfantasyasy.hack/databases/google_app_measurement_local.db
Size 16KB
SHA256 4990ea489bee01021e4d4cfbd589bd749026a20b92ced9493018d62629352864
MD5 b07e093ffca715e559c5d9c17a43da82
SHA1 d7a62c817cdccf56f9c7c1e34db060408f98257b
SHA512 90f03f01de88a441ed62ef1a73036aeff8b1a68195e0e391e9f6fece4affe25778a213228260262f52d9c569e0f418fc6333bf16da64dcc6154cd17261b9ed7b
SSDEEP 12:TL1Ev9zmzrfRmBEyPbP/hr/gW49blqYFlYlW0V+/0Fl6YlX7:TLQpmzr0GSP/h1499FulF9
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.longtongcom.monsterfantasyasy.hack/databases/google_app_measurement_local.db
Size 16KB
SHA256 1e6a5ce33bd3086ecf366501bf4d01c9e387d9d9bb5d925656162922087e6b66
MD5 ed5063158d84977e1f4dca4d6435e04d
SHA1 d9abf08333fe33caf848168153206874ff002e88
SHA512 06c01ab923f55a1c98fb9ee3a246dbfc20b41b97b143a6b10ba195f1d14a4126c1b2edaef8d728e8df81bc53767154c5d30459cc61d41000491efedccb25e7b5
SSDEEP 12:TLIEQv9zmzrfRmBEyPbP/JOLabCAUEWlCuUyWl98a549blqYFlYlW0V+/0Fl6Ylr:TLEvpmzr0GSP/JKabCCbT5499FulF9
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.longtongcom.monsterfantasyasy.hack/databases/google_app_measurement_local.db
Size 16KB
SHA256 60850714976933ca175feafb44cad7a46d702a4a6d61760596e1f6b9d34f3d0e
MD5 a84dc7c13ae5d17ff45f1d5a76b36d7e
SHA1 f9e9b53ca7655d58b1676b870d88612be51ea901
SHA512 55bbfe1dfaf735b2a83877d14976216e03bc8d6f4725b9f4930872d3717bd40650b3ff2c3bfae970f784aaa2952f18a174a0e51c1e8e501aa5492bf96a01eddd
SSDEEP 12:TL6uEp9zmzrfRmBEyPbP/uOLabCAUEWlCuUyWl98a549blqYFlYlW0V+/0Fl6Ylf:TL6Xpmzr0GSP/uKabCCbT5499FulF9
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.longtongcom.monsterfantasyasy.hack/databases/google_app_measurement_local.db
Size 16KB
SHA256 458aa953a9e0adbf5b8765ebcf6b51bc5b5a48b7664e85d25c7a8ce9781a2d5c
MD5 2f1eeee3602c828b8e9f81f6fbd20d41
SHA1 d240b568bb6929702815b9a5edd05ad635671caa
SHA512 a8642cc12cb9af0cd9d3fdc4bb1fe3b246d02af6b36714d80cdd2809def699b0b93eb585187c17f0a8e19801879e2e9edef7963ee416ae9e8cc35fd9cede2859
SSDEEP 6:l9bNFlgls1qlvlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/WK:TLuEev9zmzrfRmBEyPbP/WK
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.longtongcom.monsterfantasyasy.hack/databases/google_app_measurement_local.db
Size 16KB
SHA256 48472f593a3e9cf9e91ee5f7d66dd9ff291bfb247eb6b46778c710fc24e8d3c4
MD5 eb52a90bb70b76e946b62f50b6f7fb85
SHA1 42d767b5d1faa7dcef4cb4e1432a5f47ec2e9ee0
SHA512 b356c858cadd14b6ecddf134f1c494c0107a1d36be9387984fc53dcb00e6779d944f058f4ac99d0fc2fe3a427cd1c2921c6fc38ecad53909fc4b5b6f04459b5c
SSDEEP 6:l9bNFl4/Sls1OelO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK0DqiOwvs3:TLWuEOe9zmzrfRmBEyPbBvOwk3
MD5 SHA1 SHA512 SSDEEP

Submit Download