ea22884a32fd053be5b63eb02e416d84d7a822c692c5515adae29778f1feb1cb

Analysis

max time kernel
47s
max time network
130s
platform
android_x86
resource
android-x86-arm-20240506-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240506-enlocale:en-usos:android-9-x86system
submitted
09/05/2024, 15:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a8e0fcd3332ef0583a7557fd9bb8838_JaffaCakes118.apk
Size

11.2MB
MD5

2a8e0fcd3332ef0583a7557fd9bb8838
SHA1

0f81a61f37b7cf13323ec98af722a9a312f63649
SHA256

ea22884a32fd053be5b63eb02e416d84d7a822c692c5515adae29778f1feb1cb
SHA512

a8a6dc1fd0cf4b0b88ef3551acc6ba7c5dbe06ad98623d98be7fb33d32d92792e7e3b61a7348e359ba57fd7a61984d9c207689527ca1c377d77e859124a25065
SSDEEP

196608:KXy1Clb03Mv1fqZD23AKiL6djy7EvdpDKvQBw//6TswSTPNSkE5D15S1j7FHDh/T:KX5bbAZ+AbL6FVpvI6TYTPQ3XeZH2zI

Score

7^/10

persistence

Malware Config

Signatures

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.nd.android.pandatheme.p_zuiaibohelv20141201

Requests dangerous framework permissions 15 IoCs

description	ioc
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to write the user's contacts data.	android.permission.WRITE_CONTACTS
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether.	android.permission.PROCESS_OUTGOING_CALLS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to record audio.	android.permission.RECORD_AUDIO

com.nd.android.pandatheme.p_zuiaibohelv20141201
1⤵
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4276

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/pandatheme/pandahome2.apk

Filesize
6.4MB

MD5
5011f55af38c92dacf828ebcec5661b5

SHA1
8cdd71a6b2ff882cdad7417fde86ffdd10c56e54

SHA256
53960318a44827dd37509209d22e22202e39e3b045308ed8771517853cbabe78

SHA512
707051b5c09283494da411d0ed88c83cfe2fad65523358f37ceb56e26820b95ab52fe60a9fb3a6ea443ff20071a651e0c4398c11353b468bc631c1f6c88e67b5

Download Submit