ebc81dff64acf02b8f96632b9c17252da5c43bb7ddc322e705867b5914a7cd33

Analysis

max time kernel
7s
max time network
150s
platform
android_x64
resource
android-33-x64-arm64-20240508.1-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240508.1-enlocale:en-usos:android-13-x64system
submitted
09/05/2024, 21:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2bb406c59fc759657dc5d3de25c4dff7_JaffaCakes118.apk
Size

7.2MB
MD5

2bb406c59fc759657dc5d3de25c4dff7
SHA1

0ceb571364512e560ea57d19fb3eefafc4cc7365
SHA256

ebc81dff64acf02b8f96632b9c17252da5c43bb7ddc322e705867b5914a7cd33
SHA512

861d59413094c3256169742123b1bc929a761fa8f0ec7e2d9765d63f2ce4c6ef4444cb3c459df4db305483086b7226d26c72ad8684b41fb8972a006dfbe880df
SSDEEP

98304:pThapY9D+3nIUPOu86t1o2E7cVnsZymt1gBr9gzL6S82xLxPy/SYNlh3O8tLhW+H:B4Y9i3IGL8syzPEBhULFJ6KYxVM+TtJ7

Score

7^/10

collection credential_access discovery evasion execution impact persistence

Malware Config

Signatures

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	ir.ashpaz.mobileapp

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	ir.ashpaz.mobileapp

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	ir.ashpaz.mobileapp

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	ir.ashpaz.mobileapp

ir.ashpaz.mobileapp
1⤵
- Checks memory information
- Obtains sensitive information copied to the device clipboard
- Checks if the internet connection is available
- Schedules tasks to execute at a specified time
PID:4218

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/ir.ashpaz.mobileapp/databases/__pushe_base_lib_db

Filesize
24KB

MD5
d4bbbb663a1d64e579eb73e7c0612430

SHA1
eb65c687323046462c00fc28016ac2e53ef32836

SHA256
e5cb32241ace566d2ff9edb2dbe01b25da2b452c7d6c91602bbebe7d14138f2c

SHA512
8439a0f12a34384243d84e5499a3f7f22a5236cf61d23449b8da0ac40b200c795a444c639dd1b6dbfa0194fc7b52294fb086d7923f828f6e51f9b89e37177289

Download Submit
/data/user/0/ir.ashpaz.mobileapp/databases/__pushe_base_lib_db-journal

Filesize
512B

MD5
70630dea9cbf6521b786c638dec2918d

SHA1
d9905c7222fb971dabe054cb56d0e4e7c49eb18a

SHA256
4f943e1458883d3212ab1a439f7bcf4de8326f26b44742faf9ac1e6eb792c19d

SHA512
ae0ffca1cb6af5cabe5fd4f20e8462d1905b5fe1560813f114bf3472fd510f116e4338d6927705abad0a0b9119070511285d18dde579ae608d2ca129c04e9cea

Download Submit
/data/user/0/ir.ashpaz.mobileapp/databases/__pushe_base_lib_db-journal

Filesize
8KB

MD5
5e08e948b3e66244ee8783919fffddff

SHA1
3069142c30ddf642e1b8bccccf27b82b020f5a81

SHA256
4cf93cb20c39ac7012cf405e5281126dc37ed3c89b18524ac6a622826ae709e5

SHA512
0ec99470e2062cad8ed9e43cf0c0175b664c2e6943b304899bc74dec530febd8d90b8d2542b198b28a30365970d6cef10d945b34a6458c6e9ef12948755b28db

Download Submit
/data/user/0/ir.ashpaz.mobileapp/databases/__pushe_base_lib_db-journal

Filesize
8KB

MD5
1cc74290415976d39677c91520435151

SHA1
35271fa487d6cb03f18f43738dc0966666ece09b

SHA256
a6efce79d628f50c2ee31b5c928cb18ad53b56bebb039d31f9f3bcece2cdd343

SHA512
97c70a6b3d488b51b9e62164057ef69ee1d748daacb961c7b69e311b4ce3bad32363c89f4a36aa4d4264e8f92f393c4937bb1c2ce451f105b6e9e79621d01749

Download Submit
/data/user/0/ir.ashpaz.mobileapp/databases/__pushe_base_lib_db-journal

Filesize
8KB

MD5
65d0f74cbb3546e7772c8ac49291cb3e

SHA1
4423397ce91cb90953cf9428f909a2af64734d99

SHA256
a2fb2e47f8b9fda8adc3b2af314000c6621e5a665c32aea74295a517606634e2

SHA512
89d4f7def9c02935d2c6ff1427edd63ace07c190590bc07fb06e48eb7b28cbd7b54d1b532473be0092f1d62ee3e0938394b5e2bb8e777e5f0b2974d76f217bce

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads