Analysis

  • max time kernel
    3s
  • max time network
    130s
  • platform
    android_x86
  • resource
    android-x86-arm-20240506-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240506-enlocale:en-usos:android-9-x86system
  • submitted
    09/05/2024, 03:35

General

  • Target

    281e3351772dc323d19056e0ca1ff1a8_JaffaCakes118.apk

  • Size

    24.0MB

  • MD5

    281e3351772dc323d19056e0ca1ff1a8

  • SHA1

    4d783928dda0d31cd9ed8b56a8db4874fe0af120

  • SHA256

    b12ddf2079cd8e588d406654eff4876e1642271b0d390ea66a344c8b7df2de73

  • SHA512

    3d2a357764116c6b6c5c48053a9346fe25cb6370ec147a60696c09f7492f2d5cc30150161358062ade77c74a6747967c918d6273e24c7e3695a513c244c642ce

  • SSDEEP

    786432:Q3yrDf2n7zJ9oP46JcSPWpOR7BibKoQSz:Q3yHfsmP401FZpoQq

Malware Config

Signatures

  • Requests cell location 2 TTPs 1 IoCs

    Uses Android APIs to to get current cell location.

  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Checks if the internet connection is available 1 TTPs 1 IoCs
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

Processes

  • com.vqs.iphoneassess
    1⤵
    • Requests cell location
    • Checks CPU information
    • Queries information about running processes on the device
    • Queries information about the current Wi-Fi connection
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Listens for changes in the sensor environment (might be used to detect emulation)
    PID:4300

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /storage/emulated/0/Android/data/com.vqs.iphoneassess/files/tbslog/tbslog.txt

    Filesize

    1KB

    MD5

    64ffdba65b5d0796ef523aac8f2b9328

    SHA1

    62206781e7b0ac3c7dfbe17af298cbc7262fa2b6

    SHA256

    4aa7411b82ae36c7a6ccd7fbc3337240d603398513e173d9846349d3b9adb443

    SHA512

    9e67cd95e9aa109aa66e5a14ebed940414f84e98d354d89abd7cb498059494af08db02c6b1927b0b4702a23f7b810c8bcfbcc3edc6063a6a003e271241e95bc9