8cbddec33e1d35849ca46c7395f4c913d8ae495f2ee1de0ec2836862b8f9c23d

Analysis

max time kernel
157s
max time network
145s
platform
android_x64
resource
android-x64-arm64-20240506-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240506-enlocale:en-usos:android-11-x64system
submitted
08/05/2024, 05:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

237b23ed13d783c5f7a88e23aa0a65b4_JaffaCakes118.apk
Size

1.3MB
MD5

237b23ed13d783c5f7a88e23aa0a65b4
SHA1

f0ba143de477b047d56bac2c8d9a1292a669752d
SHA256

8cbddec33e1d35849ca46c7395f4c913d8ae495f2ee1de0ec2836862b8f9c23d
SHA512

92e1c57a316fd1a701f8d5de80acd3e53501f045e0db6d75366752107f1fbdb31216642095b289832507bf8776c17370cd07b5386c92d452e4e42f72655935b5
SSDEEP

24576:wDegf7/6D5E+jo4eqbcA7jzHvk2nxWXPm58Z9Z5xNiqy3trdwfLaYrpLQWDSuFq0:w6gSj97k2YXPHZfc9rCfL/dtFq0

Score

8^/10

banker collection credential_access discovery evasion impact

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.qnd.vgce.vleonttikg

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.qnd.vgce.vleonttikg

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.qnd.vgce.vleonttikg

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.qnd.vgce.vleonttikg

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.qnd.vgce.vleonttikg

com.qnd.vgce.vleonttikg
1⤵
- Checks CPU information
- Checks memory information
- Obtains sensitive information copied to the device clipboard
- Queries information about the current Wi-Fi connection
- Checks if the internet connection is available
PID:4910

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.qnd.vgce.vleonttikg/databases/db_DataBase

Filesize
52KB

MD5
488e8cb9d727747468002b9938f6d5d4

SHA1
9451c6dd571d1735fa42f26ca5204ab4672c503b

SHA256
f8d4f5654b39b7f7a654d58a8b10385efb8ad93d87fd5f9b51ad03fe310a97f6

SHA512
f4eed0c7be56515df276ca96544019c441ddb1f0fe780c7d218276e23dc2e4f01d02e235c7ccca9df8d50e1f7cd2ce79e14f6397916f0e3f14455bfc4982a4f7

Download Submit
/data/user/0/com.qnd.vgce.vleonttikg/databases/db_DataBase-journal

Filesize
512B

MD5
501ef888606877af2a0451e16a9d44d7

SHA1
9f30f5c333d30473ec19fcc49652f3d6feac593f

SHA256
87580ac8e27963d7a8a41307f6169e66b0266479e283f7a98681f80d461bb676

SHA512
a6d8fa49bc0abbfd4d8a4e27f7febc38c7d378c8d87a6383b3b06169b6cad8fce751f82f1d96e3452b2fda611695f19da03c871597725412856477e31e70949a

Download Submit
/data/user/0/com.qnd.vgce.vleonttikg/databases/db_DataBase-journal

Filesize
8KB

MD5
ed9c9bf1c0f4d0a61a2f3acab34d437f

SHA1
f7abefce862c3233c610bd737607b01e3b8b3550

SHA256
a540b2bc43bec7b165e2377fa44121ff6be63f19632f28c0dde5d485924d95e1

SHA512
6fd15c971295af80e072a77de4c101f858fee98211c92886f680c0d156fa3d4b87ac29f68b7d8705bb02b6ede38b6fe169550ba79e706208c05d31c80b38494d

Download Submit
/data/user/0/com.qnd.vgce.vleonttikg/databases/db_DataBase-journal

Filesize
8KB

MD5
50b403cc75b18e78b906e157cb1fb2cd

SHA1
306e332ed30823dfc045943e9edf6d3c188e5cf2

SHA256
021c6766d342e67eeba3333ece1e9de1809e04f1a3404f3e19fb11df2ecf3be2

SHA512
1af6bac00ff6b17101e57c9003392da5427c5d5a900d80d8a9be7e1cbcde21627c859215bdd23279ec0736b86a02dd377108eb0041790e56be26416f70722eab

Download Submit
/storage/emulated/0/Android/custom.dat

Filesize
32B

MD5
859564c81ced5787e09ba8fa3ef0fc41

SHA1
7aea65df201c023f4706d031ce4061a307d21766

SHA256
92a0ebd916bb20cddc4f531dd1757f7555a1bae213f519f76dadaca501ec9718

SHA512
221b594c91289c855816b82036cfaa27a514cfbd5f3f4e96a2eec2b1ecc9ac757dbaeeb353b6b816b01277d2236b001053f4105c6ccdc059abd8ff6e65aecfff

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads