1ceff414d9162d793aa037ebe22e0555e326631c2159ce504c9f9d77780597b2

Analysis

max time kernel
43s
max time network
151s
platform
android_x64
resource
android-x64-arm64-20240506-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240506-enlocale:en-usos:android-11-x64system
submitted
08/05/2024, 22:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2709b236cc215a63857d63cd76c01cd7_JaffaCakes118.apk
Size 6.2MB
Sample240508-2grxfsde43
SHA256 1ceff414d9162d793aa037ebe22e0555e326631c2159ce504c9f9d77780597b2
MD5 2709b236cc215a63857d63cd76c01cd7
SHA1 1cd8571f5a07834bcd64f2be28066321e1803456
SHA512 c1ab2e4e4d260107762506284e702a92765ea59af27c3870fa8e01563ffdf0ac1330a612906b37e01510e1b47409c992d97cb3e28795c5c9b4e2ec29ce252090
SSDEEP 196608:MWhozeL6JIb7oEZ08pBvI3GxYDWviyf0KQ:MfdIb7zXpFGPyf5Q
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection credential_access discovery evasion execution impact persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4941	com.longtongcom.monsterfantasyasy.hack

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.longtongcom.monsterfantasyasy.hack

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.longtongcom.monsterfantasyasy.hack

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.longtongcom.monsterfantasyasy.hack

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.longtongcom.monsterfantasyasy.hack

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.longtongcom.monsterfantasyasy.hack

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.longtongcom.monsterfantasyasy.hack

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.longtongcom.monsterfantasyasy.hack

com.longtongcom.monsterfantasyasy.hack
1⤵
- Removes its main activity from the application launcher
- Checks CPU information
- Checks memory information
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Checks if the internet connection is available
- Schedules tasks to execute at a specified time
PID:4941

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

OneSignal.db

Path /data/user/0/com.longtongcom.monsterfantasyasy.hack/databases/OneSignal.db
Size 40KB
SHA256 c276033016c0ae04c4e1a7128d443a01aab24d99c434696ee1b01fef2d3acf15
MD5 2479ff01e32c1445266304f37e9e7b35
SHA1 63a2b50d03eff98a4b5e684f1f95996b78219e6c
SHA512 14b24f8be6f9a88e31a2d74f3f13cf9e84817bfe445b8b8a873c1678f274714237b3f1a2fc9c5821c300fc72418e3229439107c2a2ff307007409dee6fdf16d3
SSDEEP 24:TLq6dOvoaTdLtdxShqWkGSe/+X5Eyrz2+xGTrOPjwV+HVMGGSv:TG6d83rvXcrObMoOS
MD5 SHA1 SHA512 SSDEEP

Submit Download

OneSignal.db-journal

Path /data/user/0/com.longtongcom.monsterfantasyasy.hack/databases/OneSignal.db-journal
Size 512B
SHA256 f07b43d8c78ca923d7f45ea659f337772bdd833f6bb4bd9f6e016980a1416b5e
MD5 afcb22c682579b5026af1aaa6632fa67
SHA1 50f896a66f7808f72c97cfb014833b3a549dcbb6
SHA512 6c9f78c75ccc337245fc60c675ea96766878511e8bd5e5a3b2585454fb0a2397828e6649d6d4a319563e65b76b5e401a7210b6e80e166048a5935b13a5e11a8e
MD5 SHA1 SHA512

Submit Download

OneSignal.db-journal

Path /data/user/0/com.longtongcom.monsterfantasyasy.hack/databases/OneSignal.db-journal
Size 8KB
SHA256 13f155ec0cdcd2e6976e413010432e0bfd236f843ebdd080563752e8d89a5466
MD5 b70d224757522edfd7a55f917c416a5f
SHA1 19daab9abaa4ce94bf37e8df6c6ea22d90f62cd9
SHA512 5cf1a4106056a2c3828ebaec200a8c4aedf2d63a26cc4be025254a19e99fae9218d794accce2414a806e6f4bf27006b9452f8b08b3917e84af069d2448825084
SSDEEP 6:7+/l9Dn14g9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK9:7+tMqLiuWdYRmBEyPbm
MD5 SHA1 SHA512 SSDEEP

Submit Download

OneSignal.db-journal

Path /data/user/0/com.longtongcom.monsterfantasyasy.hack/databases/OneSignal.db-journal
Size 8KB
SHA256 ed68900d1cb4e8e38043a7bea16cba5f5b56621fa24e27bef67c1e34229c0243
MD5 66f302780bf0ac8b5ecb7aa418fe3dc3
SHA1 4ef49777d3e0f20b4af06c1314bc1264bd9f3340
SHA512 c1ad3e1f105043e4a275c68cc52da7ac97db76b40153038b712e54c73aab47f0cc094460301f08f3236ec93b69b75285d831d63509867c49f4eeeb3e0ec825c2
SSDEEP 6:7+/l9DPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKtC/w:7+tZqLJdeWRmBEyPb/w
MD5 SHA1 SHA512 SSDEEP

Submit Download

evernote_jobs.db

Path /data/user/0/com.longtongcom.monsterfantasyasy.hack/databases/evernote_jobs.db
Size 16KB
SHA256 121a7e4809562649241d9df96742d50d1b6ae3f34d06ee0659642d5fc62ebf8a
MD5 5a89ccfe1aae0ee421bd1881917e5bcc
SHA1 a06fda3cf516b5007f52a825340bd714fdf9807f
SHA512 82f37c2ff94869f1e4428d82077fb0c88e67a1132741c732e60b8cb31f00bd8ecb10664494fbbc676acacc411c484daa5db2340944f36d7dba2d6c6d68843912
SSDEEP 12:TL8UpN0KkYrZASBMAB1G0d/P6dMbWAz9m9W3dOsuA3MTzeRmBEyPbBvOwzOIn:TLRpOKRvTZYAZ3mGSNzOIn
MD5 SHA1 SHA512 SSDEEP

Submit Download

evernote_jobs.db-journal

Path /data/user/0/com.longtongcom.monsterfantasyasy.hack/databases/evernote_jobs.db-journal
Size 8KB
SHA256 c327552c4bd0ed2914d306be4c4936fa153b85f4d5cb5921c17a1dbcddd1a904
MD5 b042e1523d6970d3147d80fa1b32b142
SHA1 7c0e784820338cb60e7be06fe7f81fddbfaa0637
SHA512 10a9b03349516e7fe116e0a1f1d0243156ed2b7564c33828102d7accbaf4d5072208c5e8c07f143e7a372714d863347fd700d8fe9821ee788005bf47bb62af6e
SSDEEP 12:7+tYqLpvpN0KkYrZASBMAB1G0d/P6dMbWAz9m9W3dOsuA3MTzeRmBEyPbu:7+tYqLhpOKRvTZYAZ3mGSu
MD5 SHA1 SHA512 SSDEEP

Submit Download

evernote_jobs.db-journal

Path /data/user/0/com.longtongcom.monsterfantasyasy.hack/databases/evernote_jobs.db-journal
Size 512B
SHA256 0db497e100795eedb32df6c73d753946972b7359cfe8cc2fc434e9387d5a12b1
MD5 07955522f2f53d72c47d779315358dc7
SHA1 e4c65ed910a24925d5c10358f1b2ad2132c07314
SHA512 64c6268aa596adb960fee7d32fa14f7e0fdf5c32a4e7136cf883b23527f9fdb96a9bf204df2cd111767ff692345f2135c00768b31f4f3ab208afd6f9d0d74fc5
MD5 SHA1 SHA512

Submit Download

evernote_jobs.db-journal

Path /data/user/0/com.longtongcom.monsterfantasyasy.hack/databases/evernote_jobs.db-journal
Size 8KB
SHA256 68b38517503152274b4b912a5c3f163067b0d13e65e8004e9de0863b13526928
MD5 21e38d612c5e32bbe4699deb7b1dafad
SHA1 05b2145f259a3f8bf6621d270a212abf5413ca1d
SHA512 067eb9426eb68204859dae82883c17978b5621434e06dea3d0536652f06d27e7b224885b1dbcfb24d5053aea972302a352a06dc49477258c85d871b4ee29f299
SSDEEP 6:7+/l9fln1ug9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKAe:7+t9KqLiuWdYRmBEyPbA
MD5 SHA1 SHA512 SSDEEP

Submit Download

evernote_jobs.db-journal

Path /data/user/0/com.longtongcom.monsterfantasyasy.hack/databases/evernote_jobs.db-journal
Size 8KB
SHA256 26edcc2abfac6afe13544f3af6da0216dbaab249dd16be7bc2aff2c343a36003
MD5 8258d5ba86af13f447ef21c7d62e7fd2
SHA1 201ba3c455a0d18e3f71dd55465d5e369b58553d
SHA512 7d943c82715b89d857d6e27ab8ee496d3311f4227140eb573d015a1fdc97474a6a632fca2cc67ffa1d4fee8eb92777eea9a7245ecfe530f4c74ad2293c7483eb
SSDEEP 6:7+/l9jHPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKS1//4:7+t5vqLJdeWRmBEyPbT4
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/user/0/com.longtongcom.monsterfantasyasy.hack/databases/google_app_measurement_local.db
Size 16KB
SHA256 61cd5b36b14bc788b672314bc6e5d094b6d2d3f56705250d7ea052caeabc88d0
MD5 4d6b10122973a4b52ae994f349348f41
SHA1 d629332ce84cc827e5b36b10ca3a48f4c7c2b818
SHA512 65774f9c3505c11b224886960cc1fe822a5509642275df60152159c14c3541b66a07bde96e2d6a6411083462e0e2670d670ea811e658bf5cc2a2e5e8ac705eb2
SSDEEP 6:l9bNFlsls12tnlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/RCM+/lulvl6c:TLiEq9zmzrfRmBEyPbP/P+/0Fl6wlX7
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/user/0/com.longtongcom.monsterfantasyasy.hack/databases/google_app_measurement_local.db
Size 16KB
SHA256 28da5dfa3f0be2621c354832b9c6ad95152f0ae73721a51b91ee67f75c138fc8
MD5 3816703ed875967620f389b8b2d826c5
SHA1 9faaa033f96e5b56dbe37b634c43a14f3d7526d4
SHA512 5a619471854ceb4ae7dee0765659ff06c9934e4abe89704418c4c6160fe6f3582fb3064660b960fc9194220de8227b07feb6187fe0e27a22b213a208d9d22bbd
SSDEEP 12:TL1E39zmzrfRmBEyPbP/hr/gW49blqYFlYlWcV+/0Fl6wlX7:TLopmzr0GSP/h1499FGlFF
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/user/0/com.longtongcom.monsterfantasyasy.hack/databases/google_app_measurement_local.db
Size 16KB
SHA256 e2b2038819fa36b9f0723805357a9f9c1111c7eb83458560d9bdaa84f845bc55
MD5 898cfbdc5e2c6eadb68884db8ccab4b0
SHA1 e55b023a61039bde91a526ba43d2cc9757ec5c54
SHA512 4bddca94274c232068c3958d00af0ff6e1325621546e0a90ad72b58467139df8fe2519b974e9ef8986bd65095ca4c689dd3d4790b6621e91d03bf6bee6b5134f
SSDEEP 12:TLIEU9zmzrfRmBEyPbP/JOLabCAUEWlCuUyWl5gW549blqYFlYlWcV+/0Fl6wlX7:TLYpmzr0GSP/JKabCCbL5499FGlFF
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/user/0/com.longtongcom.monsterfantasyasy.hack/databases/google_app_measurement_local.db
Size 16KB
SHA256 05c2769e3cee51f9fd1e319013b9181bf12bfcbae3bfbabcecb1e21fbfe73184
MD5 c361d4caa54cd358959d9991510f610c
SHA1 ddc7a03277b2efbfd5ffe7333ae00c6228fe0550
SHA512 199bd21ba5e337cf93bd3ca4b30beae296c8365ca3e40a8aeba46d51c5cf76b5e7e3c9ed9d9a55d72c304755a14290b66a22006341162d0aa3ae7779ddfbd338
SSDEEP 12:TL6uER9zmzrfRmBEyPbP/uOLabCAUEWlCuUyWl5gW549blqYFlYlWcV+/0Fl6wlf:TL6vpmzr0GSP/uKabCCbL5499FGlF1
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/user/0/com.longtongcom.monsterfantasyasy.hack/databases/google_app_measurement_local.db
Size 16KB
SHA256 b4765a86f69c122307448d0c6e81cebd52ffbc59b0d19da42971e2857f773e6d
MD5 818548be1885386cc995f564f36a8e8e
SHA1 008b0c602ed55b1122dadfb3a20db517d55c10b3
SHA512 47840561a1eded73600b656576a7a9195bd1beddb79b08090b9e6bd9ab610de6cfb0a334310bfefe0b33ef157d420aaa17c6315fa2e689398da3328c4460a02f
SSDEEP 6:l9bNFlgls1WnlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/WK:TLuEe9zmzrfRmBEyPbP/WK
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/user/0/com.longtongcom.monsterfantasyasy.hack/databases/google_app_measurement_local.db
Size 16KB
SHA256 2d227e9b7a044c8e10294f6a831fb92d81ea9582381796d87f35bd268e37538a
MD5 d9cf75fdd1c2292d986f6c3d5d60f2c8
SHA1 07ecb1d3a26d952ae5fecf54f36699ab498510b1
SHA512 442c96e4b4c79b8d1c64dd3a6d6088ae1dace441e78d830dfb3190ee1c0fafebc606fb432071b4a1ad1a4ba9b68c7877b0bce520ccc88708feaf82bbc474e0cb
SSDEEP 6:l9bNFl4/Sls1mGnlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK0DqiOwvs3:TLWuEmO9zmzrfRmBEyPbBvOwk3
MD5 SHA1 SHA512 SSDEEP

Submit Download