8cbddec33e1d35849ca46c7395f4c913d8ae495f2ee1de0ec2836862b8f9c23d

Analysis

max time kernel
149s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240506-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240506-enlocale:en-usos:android-9-x86system
submitted
08-05-2024 05:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

237b23ed13d783c5f7a88e23aa0a65b4_JaffaCakes118.apk
Size

1.3MB
MD5

237b23ed13d783c5f7a88e23aa0a65b4
SHA1

f0ba143de477b047d56bac2c8d9a1292a669752d
SHA256

8cbddec33e1d35849ca46c7395f4c913d8ae495f2ee1de0ec2836862b8f9c23d
SHA512

92e1c57a316fd1a701f8d5de80acd3e53501f045e0db6d75366752107f1fbdb31216642095b289832507bf8776c17370cd07b5386c92d452e4e42f72655935b5
SSDEEP

24576:wDegf7/6D5E+jo4eqbcA7jzHvk2nxWXPm58Z9Z5xNiqy3trdwfLaYrpLQWDSuFq0:w6gSj97k2YXPHZfc9rCfL/dtFq0

Score

8^/10

banker discovery evasion persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.qnd.vgce.vleonttikg

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.qnd.vgce.vleonttikg

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.qnd.vgce.vleonttikg

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.qnd.vgce.vleonttikg

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.qnd.vgce.vleonttikg

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.qnd.vgce.vleonttikg

com.qnd.vgce.vleonttikg
1⤵
- Checks CPU information
- Checks memory information
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:4456

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.qnd.vgce.vleonttikg/databases/db_DataBase

Filesize
52KB

MD5
517a858d47e1193d3e6bd5beec653a0b

SHA1
08accce527b3dddd2c32f355f3d648b1b77f0409

SHA256
b29d0aba0977e10ad9d7f34ae729cb66feebcd777c43de5a10f7611de60d5ce0

SHA512
1de34245e8458c9929286a7868e18e595e3c20a5ab1cea7c0a55a6a1dba3d31f9062dd889105a36c42eb85454624134bd6349ffc8810fcaf1660340863c85f77

Download Submit
/data/data/com.qnd.vgce.vleonttikg/databases/db_DataBase-journal

Filesize
512B

MD5
acbe279b1b1f8377342ce4e55bd578a3

SHA1
73e412ace4b4af127b9f9615a804cf577c55ed3e

SHA256
5ed785fd2c6a150d2a38d4942b0ae3ccb418297eb40fdd2da5a9805b1130c752

SHA512
d399a1b855949a6dc988b3a256b01b573bbe3a39531aaf7ade3abbb8da416120ede940f0037ec5073a3126b6f728dc88ffac0619cb408fec5f4d6bd9d0a989f8

Download Submit
/data/data/com.qnd.vgce.vleonttikg/databases/db_DataBase-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.qnd.vgce.vleonttikg/databases/db_DataBase-wal

Filesize
64KB

MD5
c9d78da14b9d86d6c3b2f966e7d0b6fd

SHA1
c31f9aa3f62cbe199ac8fa09964de67d744b7362

SHA256
68f63dbf92358fb214fedc342b5df0bf2129cce79be999b209c9ea22fe0ff452

SHA512
b6b630af2596484b5e0c346859e308c74b85e10276aae45c6e16b47eb591c9827c47d05b1f1b4cd5c0f0802a17ac6358f63e1497915abed2cf29ed9ccc710f8a

Download Submit
/storage/emulated/0/Android/custom.dat

Filesize
32B

MD5
85bf9e96482bc285c1af780eb3dab290

SHA1
99827541c45f053ebf2c5375d3f76eb07423650b

SHA256
5ad8a9d37504feed2da28ea76ce8e31ca34fb7a2a02c1c6bc8a602701143d326

SHA512
3eaf23fd7f1c1354ab70293ca35ac165b3fbc1cbc60ecf184f5fa3ba063442b7c0b22fea1b38e92815514bb4f878a4f8ffa29eaf6c5315148dcb5d12789cf306

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads