3d0be5f3994e404f2d742fe2475fc578626f2d8beb167b56324d9736f3be4a20

Analysis

max time kernel
56s
max time network
132s
platform
android_x64
resource
android-x64-20240506-en
resource tags

androidarch:x64arch:x86image:android-x64-20240506-enlocale:en-usos:android-10-x64system
submitted
10/05/2024, 11:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2efa67a42b8846396b10f6acd7a7040b_JaffaCakes118.apk
Size

7.0MB
MD5

2efa67a42b8846396b10f6acd7a7040b
SHA1

ce591e9640233a38295e5b852159e28b2a9cb2d8
SHA256

3d0be5f3994e404f2d742fe2475fc578626f2d8beb167b56324d9736f3be4a20
SHA512

c9caf4812b06c9a3d9f59c7b16cff50dfb06abe326796ce45d6067776afbf1c2e3081b641fd804c45d2000e92f9513567d058c197fa04012fcf599e6c54166c4
SSDEEP

196608:pZyEk9Kb59qlA08SYjY60KfdYJ2+wptSAP1T0:bXkcdclA08SD60Sdft7Ph0

Score

7^/10

collection credential_access discovery evasion impact persistence

Malware Config

Signatures

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.igoldtech.an.swipedfruits

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.igoldtech.an.swipedfruits

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.igoldtech.an.swipedfruits/cache/ads6949732286395604659.jar	5054	com.igoldtech.an.swipedfruits

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.igoldtech.an.swipedfruits

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.igoldtech.an.swipedfruits

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.igoldtech.an.swipedfruits

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.igoldtech.an.swipedfruits

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.igoldtech.an.swipedfruits

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.igoldtech.an.swipedfruits

com.igoldtech.an.swipedfruits
1⤵
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:5054

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.igoldtech.an.swipedfruits/cache/ads6949732286395604659.jar

Filesize
2KB

MD5
d80f6d032778b02d10a9c9a2f1a24714

SHA1
e34d4ea9618b1b499b65032723ea029ab3998500

SHA256
ee2de01a238f9e1834f9f9934dd1f5b267bdf9747965641d2fd636d740041f9b

SHA512
34fa52d41831142f86999ac407aafeb2b69bb4cd45ada9f739be84c80deb0414d11d6784f385eec287e4f6b5bdf29ba1c9a6a77c07707d66a73c60eb389136e1

Download Submit
/data/data/com.igoldtech.an.swipedfruits/databases/http_auth.db

Filesize
20KB

MD5
62a3561989ede658cd16cc1f14199c1d

SHA1
6320791cdfd16b26450bf711bd6776d80a396912

SHA256
9ae0206411304ee027e0cfe3b4e6732ced5b423f99c33340dafb68d2b5b215f6

SHA512
c4ef43e702e053ee39153149d1fb11311c57c6ad5393ea905df942df8bcd3625e2224563eb4c35bfc45e140aa09135c5123f48d220fe622d9dcf2a4cdaf5dfe4

Download Submit
/data/data/com.igoldtech.an.swipedfruits/databases/http_auth.db-journal

Filesize
512B

MD5
df8173b446e8b34d7708e542b8d2ee15

SHA1
026746fe8c2eff8d411ef84e4fefe76dee6cbb81

SHA256
fb56b831d32fc2a35583da7064dc1a1f2be418eefb8370ecbcb4c2a32ea1cb02

SHA512
4244cf45047de22d31463fc7277ea9ca1a377f58922dca408335180807119389356a93decf145a7e6e77409224a3342a5b41fc70e7ce3eb2fad162183445758d

Download Submit
/data/data/com.igoldtech.an.swipedfruits/databases/http_auth.db-journal

Filesize
8KB

MD5
b8fb2204b1b87eae329d3900327c4ca0

SHA1
c22cde03c8c80f0916ab68c648908dfeb1f86a62

SHA256
15c2c679d9034eb6034d564b480baf87c068fdbf67fd9eb68f0ebbe817852cc7

SHA512
c1e961bfaa554de061ad9d5bf636b682b32973d75e66de08b4e8adbe80d8b51aab7f34727279c60d67b435fa6e875dd6423cb606dc32f04697a98f56d0f5a97a

Download Submit
/data/data/com.igoldtech.an.swipedfruits/databases/http_auth.db-journal

Filesize
8KB

MD5
24bc25aa3cdd7d8a02ef1e6af4c8423c

SHA1
1108c8e621e9a610e42d6979d8fc0e81806ef391

SHA256
16b75f12258f7c0513d29e0da0cdf4be5807532b734feb9d3d5ecec47be877f4

SHA512
07b2abb24e55121dfa874e0c5bb5657e909c785078e88b9d3b201c5da80d8256daa0e6658c6e4c43eb3caab297b6bb4e0aed32248a504d0ddd62c7693777894e

Download Submit
/data/data/com.igoldtech.an.swipedfruits/files/gaClientId

Filesize
36B

MD5
556d6c6689e89b4dc5ca4f8585e54683

SHA1
6c90149a6bbd76bec6eb917b9513db090616f3fd

SHA256
4a209161c32d1615a3b85d88a8e90f64c0fa77e47bea2b6c0fb7df0942a1899a

SHA512
19c7cd765f0e19732f3ceb9795bd16fb8768d3473f46e9d5335c43bb451b2b298467db3b03a82e818513dd060444fc61431fda96822b09838a741729ffc0308d

Download Submit
/data/user/0/com.igoldtech.an.swipedfruits/cache/ads6949732286395604659.jar

Filesize
4KB

MD5
12670a32ad1380c9021a9e74aa5f2281

SHA1
7e8caf0c7a4d78452efb90958e8ce1aae5148e44

SHA256
f3c142f78cadcb57d7da3d8e4dc5f8c7b05377417c639059910696c844afc1f9

SHA512
1277dde373cab02d5df62732834adb79f8dbf1d1a9ac56b5b348e354317fadc24fe20b5ebdd1ecc28f8fc98dcdff807d2839bef75ef7d871e976e68a95851b06

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads