ddf93b810899ad9239dfdf428a1039ddd7f747261ac14a38eaba47368e949af3

Analysis

max time kernel
50s
max time network
148s
platform
android_x64
resource
android-x64-20240506-en
resource tags

androidarch:x64arch:x86image:android-x64-20240506-enlocale:en-usos:android-10-x64system
submitted
10-05-2024 01:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2ca989baf2d6aba9d7263507958b85d3_JaffaCakes118.apk
Size

2.5MB
MD5

2ca989baf2d6aba9d7263507958b85d3
SHA1

99fc2b9b38b1f07378d88e97dcd181aaece4b3a9
SHA256

ddf93b810899ad9239dfdf428a1039ddd7f747261ac14a38eaba47368e949af3
SHA512

869574a1631e947c1b81472aa77e5ac69e48a1fdee36c9f79161c39b3c4ade1f50687d191f754c55d551ffca023aba03281608aa652c1b4a8af74f20450ab290
SSDEEP

49152:6z6302hTSbE9kKdkLqidmlc5MtHGB2Dryn8T:Q6302hTSgWKQ5MtE2Dz

Score

7^/10

collection credential_access discovery evasion impact persistence

Malware Config

Signatures

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	dhewu.vnjk.dwqds

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	dhewu.vnjk.dwqds

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/dhewu.vnjk.dwqds/files/17153043141070.jar	5108	dhewu.vnjk.dwqds
/data/user/0/dhewu.vnjk.dwqds/cache/1582435991586.jar	5108	dhewu.vnjk.dwqds

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	dhewu.vnjk.dwqds

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	dhewu.vnjk.dwqds

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	dhewu.vnjk.dwqds

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	dhewu.vnjk.dwqds

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	dhewu.vnjk.dwqds

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	dhewu.vnjk.dwqds

dhewu.vnjk.dwqds
1⤵
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:5108

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/dhewu.vnjk.dwqds/cache/1582435991586.jar

Filesize
9KB

MD5
e8e0527a01aefdb89afd2c508f131da1

SHA1
f1103e6b260c657ceb3d95f1b023af3fda8b133a

SHA256
f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce

SHA512
fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34

Download Submit
/data/data/dhewu.vnjk.dwqds/cache/oat/1582435991586.jar.cur.prof

Filesize
148B

MD5
a3b78d197d786c13687c3f0f89703bd8

SHA1
9967f0726b6b1ed3f198904547b81920f8329621

SHA256
c5e6754556dbe01b055066f23c28ddaaf5fe67cee4baed00d59dc993335b3d97

SHA512
9a47c9bb977edec9d29d22f280e0078ca931a722eaecc2b085c6b5aaf6246d17a6ad07c9faca45070bb5b89a3ee6cf896f5e2c7e73fb033e3ac57471df70a8b1

Download Submit
/data/data/dhewu.vnjk.dwqds/databases/db_d.db

Filesize
20KB

MD5
3172070e932ebe00a70b547397c8a4c1

SHA1
ac073d597ac1d7ac241aacf1acca295347a8fee9

SHA256
8fb91b0a18fbe1cae784864cead9d396bb3e8f3b01582f9b78dbde274309c8da

SHA512
a40f22a6e76582601dacea7dfe458aebe4eff1eeb6f7450405d2826a42da6d1f18ffe7424afbd384757bd77f355bb27d4bdf7aaa51e848d25002022f161e2f76

Download Submit
/data/data/dhewu.vnjk.dwqds/databases/db_d.db-journal

Filesize
512B

MD5
1a7f535ba755090ff641d69343558422

SHA1
33b1722e4a84f0f9f72e088dc1fb098876f0349a

SHA256
f004b8531d74f874e5fa209a9e3603091b5544dff1d0c25c8f26fe15027aeae0

SHA512
fdccae9742f5984fa8b8d2ec60a29439b5b8235671b43b6c624ae482ad865818e46add7c40fb1e70e4c3922a13d8cc5754df9b9305a752ebba1919e21d29b7bb

Download Submit
/data/data/dhewu.vnjk.dwqds/databases/db_d.db-journal

Filesize
8KB

MD5
5c506613c6f36639246c1ae81d368934

SHA1
cd8a79ad6e2c41227700b5b64f56839c88232fa1

SHA256
79048979372abda6e2610bdec81f0172f547b607c9aa88598f54ec6aac4977f9

SHA512
15b9fcfa5a54e1e5fc2ab7bccb1a89645803f7aefa5480e51ff57d3a11af7bc2aaae7dc0fd3f493aeef93f2fef27b6cb2ce5d3f4d8a1d5b4cb426b4f6f710d94

Download Submit
/data/data/dhewu.vnjk.dwqds/databases/db_d.db-journal

Filesize
8KB

MD5
642ec9919f835503e071085994ae7af1

SHA1
74846faa63c35bf93617ce93fec6b68e9cc57162

SHA256
18648fc426c2aac0cece90208c9ebbded7bdd26d4e5eada52047b9e1c5207995

SHA512
e43dc229b99b189d341595a2b92cc8106d7e75006201deaf9c6fa655663d8153c1e254e74ecd367bc5dcee858ef4cca046058f69e86a554a6a13e4312c62d1ac

Download Submit
/data/data/dhewu.vnjk.dwqds/databases/webviewCache.db

Filesize
12KB

MD5
ea628e04765adaf4238a5dcdff4bbd51

SHA1
a801947619ea8c368efe9c006a324dc6339ac60b

SHA256
885e337c2156e4dbf2176a9677ade50418740532d222ccae5ad4aa371b54c6a4

SHA512
c0287b0e7b690a7231a37d1745c49f3d861b22aa65dd769ba6a8b5ab9da55443f749957781ee05a405019c39e1be45d37a971b821bffd62a1d5620bc39119abe

Download Submit
/data/data/dhewu.vnjk.dwqds/databases/webviewCache.db-journal

Filesize
512B

MD5
f13f6ad483190d5c125115bdabf81886

SHA1
c491614941187e324967d81e833652f2316ddc0e

SHA256
75980f1c7f82f7ba13824270b7aefcef60e0f17e01985cb93f9a477fa0f15d81

SHA512
705f151e2c50eb2d9bc4ecad0b905a6b221efc576311afba008c8699d14a2b46fb54fb6808b5965f4c30d2196a3ea4fc235af338c176d1aa0026900614053b58

Download Submit
/data/data/dhewu.vnjk.dwqds/databases/webviewCache.db-journal

Filesize
8KB

MD5
50914f74aed0e34dc382a615cbefd2df

SHA1
c5ade101455e06ae29303c289284a7be71d4c51e

SHA256
e39c5c37c83895b4547937db3e83f03409685672ba4d964b57611e3073db5b11

SHA512
39a9a7c80cdf476544ec1863b30107b9ecbd81115fdcf7510395d09660a18fef7fb6d74caf69963af4c040c24502d69ffb7121466e1a4231a0da74183bce434d

Download Submit
/data/data/dhewu.vnjk.dwqds/files/.FlurrySenderIndex.info.Data_ZHB7MQ3CBM42VF73JTXR_151

Filesize
42B

MD5
3a1e973d43d566e6beae77dbfac95068

SHA1
a2f4a1b9e0c7c593aac1aa614408308bd0dbcc3f

SHA256
b7f8ff2a42c85d56861359318c49940c347eaf8b0b9f0ebbc2039b1b606d48d9

SHA512
2d2b1b3c938ecfdc98d0d033971085dc4392d68dc64157192b2b9223456067e1305750b2b13ee8cdd879d0b87e56a72e2ac7d5e5694b1f59939074b02afa699e

Download Submit
/data/data/dhewu.vnjk.dwqds/files/.FlurrySenderIndex.info.Main

Filesize
35B

MD5
0fe70c8c7ef41288a38c4f4a4cfdd8aa

SHA1
63b987a72c9d461e029d91b4a689e6a17e71276a

SHA256
10f7816327099a8cb68e72b3674996d9cc3ef8259c6f456e4781bee28006fe69

SHA512
67ab5c276e321d3b3472a9680f4bdf5cf9a30e4d68cc0d9fe62834dd31abe9ebe582b6dfeb6df60cc07a8ca930e4e10ff5fb4ac76cafe321b27c4908bb6bd3fc

Download Submit
/data/data/dhewu.vnjk.dwqds/files/.flurryagent.11f68b50

Filesize
58B

MD5
ade09ed27845a5d5811c525f6e6c867d

SHA1
92b3f5bd9175b984d6d08aef9069f3926224241a

SHA256
51c4d370042338a9af857185fc38e6d13551f47e34085e31401eabeffa17d57a

SHA512
a32408e5e952556980c4bcef997be2508aae8e11982539379ae6bc57f3f0ce1115b6160e042fae4e180b87854bc640a1b693afecc8581d041bfda11289e4a67b

Download Submit
/data/data/dhewu.vnjk.dwqds/files/.flurrydatasenderblock.b6e1f252-9283-465b-8d35-c012b60c1d8c

Filesize
252B

MD5
bd9925001950b420f5d0ebe1e4428a27

SHA1
993ee7fa376c1e13c76e4a0940f14e20189d1dbc

SHA256
17d93ed754ead8c5600a475d868b15894fd45cb7aa01df169e6c4b23f578fa79

SHA512
99849fc6078a28ebfb905cac51ca60cdc28c74562a91b4f6568ef4d49190b6b0e0f7af3fd3a8beca6c7b8599169f6e94c3c6a4c850206d9e9680178f2cbdb3f3

Download Submit
/data/data/dhewu.vnjk.dwqds/files/17153043141070.jar

Filesize
60KB

MD5
717abf087b987dff8abed70613a224b0

SHA1
e2b55daf06a83f79d49b59c82c7238af63e46342

SHA256
f308399e84a522b74567ae5bcafd128255622a22171354d2587e2e82c6d3b435

SHA512
4cf21158d41538e8cb5625c9ed7ed5ab1c75b53704766363a1ab559e5f95adc6ba0b5d23385354a0e62d3b706452e84b8223bbc586b166ff8cc90adb574a5092

Download Submit
/data/data/dhewu.vnjk.dwqds/files/com.crittercism/app_loads/53709397150_06039aab-7522-44c1-ac13-4ab0a49ca722.log

Filesize
175B

MD5
fb4b1e7d48f2cda5d84376e2468210aa

SHA1
955f92d0d3a576762af63516af0a76f9b240872a

SHA256
247030fdc31bca1dd16036364b47f5e5c5959bce620c61417d0a2d90693970c8

SHA512
de66e7b52b1505c8a7ebb51b71cad64680a4e294db93717c3df1782ae63da402d6b6439739a9065887f92b3c0184896e5076e15ab085d1968d749f2b57c5bb79

Download Submit
/data/data/dhewu.vnjk.dwqds/files/com.crittercism/current_bcs/53649839360_f2555343-5305-4026-95e2-32ed3a25119e.log

Filesize
48B

MD5
815d0cb3bc144c113f035714e916e704

SHA1
b5db0fe14cdf9909aaadc8d2b3329712e762f50a

SHA256
3e35d739e31623243394009aa0b627e6c35da27c64df908a9c5799c33e0b6761

SHA512
97e09807eae4666e4a572c7d14870438b20fbfd7e028213658705059f8d0bedec57097b416619805e83e384fc2c1389dab4e94286699daec4f57a5c124c09749

Download Submit
/data/data/dhewu.vnjk.dwqds/files/oat/17153043141070.jar.cur.prof

Filesize
378B

MD5
9eb310f04ad2eece0caa068663ef8be4

SHA1
6a14575c46c517d22a0862f95b05ca00f01a30c0

SHA256
e844cd4bf35bd10fea1608ac13871db0309f5a7dc8565a0d0c7793a82db74683

SHA512
dacf3811a467d1321d058e02531372374943f0c28bcc9b60e1422a1cea40e56054286a841dc1f5501bc245723f3a4a8db7cf406f5cfca8035cbbd950f3e37e2d

Download Submit
/data/user/0/dhewu.vnjk.dwqds/cache/1582435991586.jar

Filesize
20KB

MD5
fde2ee00cbd121cfab5290b078aa3ceb

SHA1
e2b77d5320e155e413d040a8c20020962065b2f8

SHA256
2897b0812077c654a9b3fbb0b6303d5cde681eeba7ad9981de65716c7810d685

SHA512
a9326aff8e454a2b4ac09984ef2a65fddd4dc146b4c44d839035549bff8c9fdaae490326d0b018f76c1ca2e4fb25426d74f550ca0950982fba632a023af99a56

Download Submit
/data/user/0/dhewu.vnjk.dwqds/files/17153043141070.jar

Filesize
130KB

MD5
21b9de7504b2eb67b1dba78700ba6681

SHA1
9ecf5ce403b6eb9bed4ec89e808f900ef1d7db09

SHA256
04e3643b6a92eecec86d5f2528b7549e751d59a6d017e98e02640da0fb61d27e

SHA512
67d4b5222c15723b8f8483c482af2f04de2e6021f42f76938a5628d0cc36ec270eccfa1ff11b9dd6d924bede93b79fde052712d1b11f94d5ddf3de9b1e28bf03

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads