Analysis
-
max time kernel
3s -
max time network
130s -
platform
android_x86 -
resource
android-x86-arm-20240506-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240506-enlocale:en-usos:android-9-x86system -
submitted
09/05/2024, 03:35
Static task
static1
Behavioral task
behavioral1
Sample
281e3351772dc323d19056e0ca1ff1a8_JaffaCakes118.apk
Resource
android-x86-arm-20240506-en
Behavioral task
behavioral2
Sample
VqsVirtual1.apk
Resource
android-x86-arm-20240506-en
Behavioral task
behavioral3
Sample
VqsVirtual1.apk
Resource
android-x64-20240506-en
Behavioral task
behavioral4
Sample
gdtadv2.apk
Resource
android-x86-arm-20240506-en
Behavioral task
behavioral5
Sample
gdtadv2.apk
Resource
android-x64-20240506-en
Behavioral task
behavioral6
Sample
gdtadv2.apk
Resource
android-x64-arm64-20240506-en
Behavioral task
behavioral7
Sample
gdtadv2.apk
Resource
android-x86-arm-20240506-en
General
-
Target
281e3351772dc323d19056e0ca1ff1a8_JaffaCakes118.apk
-
Size
24.0MB
-
MD5
281e3351772dc323d19056e0ca1ff1a8
-
SHA1
4d783928dda0d31cd9ed8b56a8db4874fe0af120
-
SHA256
b12ddf2079cd8e588d406654eff4876e1642271b0d390ea66a344c8b7df2de73
-
SHA512
3d2a357764116c6b6c5c48053a9346fe25cb6370ec147a60696c09f7492f2d5cc30150161358062ade77c74a6747967c918d6273e24c7e3695a513c244c642ce
-
SSDEEP
786432:Q3yrDf2n7zJ9oP46JcSPWpOR7BibKoQSz:Q3yHfsmP401FZpoQq
Malware Config
Signatures
-
Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.vqs.iphoneassess -
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
description ioc Process File opened for read /proc/cpuinfo com.vqs.iphoneassess -
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.vqs.iphoneassess -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.vqs.iphoneassess -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.vqs.iphoneassess -
Checks if the internet connection is available 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.vqs.iphoneassess -
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
description ioc Process Framework API call android.hardware.SensorManager.registerListener com.vqs.iphoneassess
Processes
-
com.vqs.iphoneassess1⤵
- Requests cell location
- Checks CPU information
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:4300
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Execution Guardrails
1Geofencing
1Hide Artifacts
1User Evasion
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD564ffdba65b5d0796ef523aac8f2b9328
SHA162206781e7b0ac3c7dfbe17af298cbc7262fa2b6
SHA2564aa7411b82ae36c7a6ccd7fbc3337240d603398513e173d9846349d3b9adb443
SHA5129e67cd95e9aa109aa66e5a14ebed940414f84e98d354d89abd7cb498059494af08db02c6b1927b0b4702a23f7b810c8bcfbcc3edc6063a6a003e271241e95bc9