3d0be5f3994e404f2d742fe2475fc578626f2d8beb167b56324d9736f3be4a20

General

Target

2efa67a42b8846396b10f6acd7a7040b_JaffaCakes118.apk
Size

7.0MB
MD5

2efa67a42b8846396b10f6acd7a7040b
SHA1

ce591e9640233a38295e5b852159e28b2a9cb2d8
SHA256

3d0be5f3994e404f2d742fe2475fc578626f2d8beb167b56324d9736f3be4a20
SHA512

c9caf4812b06c9a3d9f59c7b16cff50dfb06abe326796ce45d6067776afbf1c2e3081b641fd804c45d2000e92f9513567d058c197fa04012fcf599e6c54166c4
SSDEEP

196608:pZyEk9Kb59qlA08SYjY60KfdYJ2+wptSAP1T0:bXkcdclA08SD60Sdft7Ph0

Score

7^/10

discovery evasion impact persistence

Malware Config

Signatures

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.igoldtech.an.swipedfruits

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.igoldtech.an.swipedfruits

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.igoldtech.an.swipedfruits/cache/ads710018732678610483.jar	4465	com.igoldtech.an.swipedfruits

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.igoldtech.an.swipedfruits

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.igoldtech.an.swipedfruits

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.igoldtech.an.swipedfruits

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.igoldtech.an.swipedfruits

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.igoldtech.an.swipedfruits

com.igoldtech.an.swipedfruits
1⤵
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4465

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Discovery

System Information Discovery

2

T1426

System Network Configuration Discovery

1

T1422

System Network Connections Discovery

2

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.igoldtech.an.swipedfruits/app_sslcache/www.chartboost.com.443

Filesize
9KB

MD5
75c8fb7df8233b05ad6bb0264f552d47

SHA1
1089e8bd588c94c1e359414a19ef26f4fb4cd3de

SHA256
2ed7c19355838e7e0a773f99183f520d6a7b321230581d6520b04dddd160de4b

SHA512
06d13b6fe4b46c976cf679ed996d874333065a8957f5d98dae638ec8a0679b5b5e87831a2cc5f97f49e83f397a45cd474967c64935e150602824aaf6ea755885

Download Submit
/data/data/com.igoldtech.an.swipedfruits/cache/ads710018732678610483.jar

Filesize
2KB

MD5
d80f6d032778b02d10a9c9a2f1a24714

SHA1
e34d4ea9618b1b499b65032723ea029ab3998500

SHA256
ee2de01a238f9e1834f9f9934dd1f5b267bdf9747965641d2fd636d740041f9b

SHA512
34fa52d41831142f86999ac407aafeb2b69bb4cd45ada9f739be84c80deb0414d11d6784f385eec287e4f6b5bdf29ba1c9a6a77c07707d66a73c60eb389136e1

Download Submit
/data/data/com.igoldtech.an.swipedfruits/databases/http_auth.db

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.igoldtech.an.swipedfruits/databases/http_auth.db-journal

Filesize
512B

MD5
59aa40e703d43b5fb47a58550efe460b

SHA1
4d4ce8db28a2b19e06479ecff34c17cdce30137b

SHA256
2d2f847c3d29bb1e5f470fe330ea4059a9bee4f4f9de35a0b4ccb035dc2c7f6b

SHA512
7fdfce49c39f63f9501df9e03d40e44085abd3cabed8d8cb5e4446cebda8dbdf2218843ca87f5f0557ceeb980b81eecde0fcc4c45e0ce546709a45d750693d4b

Download Submit
/data/data/com.igoldtech.an.swipedfruits/databases/http_auth.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.igoldtech.an.swipedfruits/databases/http_auth.db-wal

Filesize
32KB

MD5
61e5e0a42f5b17a1930c5f57e1bad37b

SHA1
c2727543e22cabc409ed8177fdb1805583eb6b0a

SHA256
db86c9b535c20e086f06b4e7123ec547b9ded32f5c49f1de2448029c82db6190

SHA512
65fb70661d3151cba9e0a570b2c1aff6094ce0c2f907651df1051211b784667a9eabae45d1ccb7bfcaef9e1436ac1fafd3b32adad7a08459dcbdf071da63438f

Download Submit
/data/data/com.igoldtech.an.swipedfruits/files/gaClientId

Filesize
36B

MD5
19d4a0d62abb63e9c6056605d9b01cd1

SHA1
b57d8a552bea8be492747376dab1d407af8fc1be

SHA256
ab4c46f0584daba2103e91752c54fedc950f8537b46e174808f0015110e1309f

SHA512
0bae4dbdb99a72eb5ee11fba7b5d1f39f8e7960bb8d25eb045d4d651e512441ff7ff1c51a5efb1a19c65b71137c694a34b57995bdec146bf072511b1fa5c1530

Download Submit
/data/user/0/com.igoldtech.an.swipedfruits/cache/ads710018732678610483.jar

Filesize
4KB

MD5
12670a32ad1380c9021a9e74aa5f2281

SHA1
7e8caf0c7a4d78452efb90958e8ce1aae5148e44

SHA256
f3c142f78cadcb57d7da3d8e4dc5f8c7b05377417c639059910696c844afc1f9

SHA512
1277dde373cab02d5df62732834adb79f8dbf1d1a9ac56b5b348e354317fadc24fe20b5ebdd1ecc28f8fc98dcdff807d2839bef75ef7d871e976e68a95851b06

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads