d2830c8e0c3f2896cdd4e685256883ea95077ca3cb7a54e942622b8a714fa6f5

Analysis

max time kernel
152s
max time network
159s
platform
android_x86
resource
android-x86-arm-20240506-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240506-enlocale:en-usos:android-9-x86system
submitted
11-05-2024 00:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31d204f580e01f8439cf87e815f6d143_JaffaCakes118.apk
Size

30.8MB
MD5

31d204f580e01f8439cf87e815f6d143
SHA1

a59921eb65bef582c9e420be59fbd88cd11858bf
SHA256

d2830c8e0c3f2896cdd4e685256883ea95077ca3cb7a54e942622b8a714fa6f5
SHA512

7863a3152a0b92f60ab2063250bc66491ce07260c24935903b58d8383fbc16168a32cb0999e566b5ba6fe124236ced46bf80d48a7ef3cd6abc3560c11834b514
SSDEEP

786432:sIThbMVx+FRLUU7ZiaJ0LrW4YlxXlzmyQcIYrTPZCEytL:LbQ+FR4U7om0LrWVvN3Sx

Score

8^/10

collection discovery evasion impact persistence

Malware Config

Signatures

Requests cell location 1 TTPs 4 IoCs

Uses Android APIs to to get current cell information.

collection discovery

Location Tracking

T1430

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getAllCellInfo	main.opalyer
Framework service call	com.android.internal.telephony.ITelephony.getAllCellInfo	main.opalyer:mult
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	main.opalyer
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	main.opalyer:mult

Checks CPU information 2 TTPs 2 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	main.opalyer
File opened for read	/proc/cpuinfo	main.opalyer:mult

Checks memory information 2 TTPs 2 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	main.opalyer
File opened for read	/proc/meminfo	main.opalyer:mult

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	main.opalyer
Framework service call	android.app.IActivityManager.getRunningAppProcesses	main.opalyer:mult

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	main.opalyer

Queries the mobile country code (MCC) 1 TTPs 2 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	main.opalyer:mult
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	main.opalyer

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	main.opalyer:mult
Framework service call	android.app.IActivityManager.registerReceiver	main.opalyer

Checks if the internet connection is available 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	main.opalyer
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	main.opalyer:mult

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	main.opalyer
Framework API call	javax.crypto.Cipher.doFinal	main.opalyer:mult

main.opalyer
1⤵
- Requests cell location
- Checks CPU information
- Checks memory information
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4270
- sh -c id
  2⤵
  PID:4415
- id
  2⤵
  PID:4415

main.opalyer:mult
1⤵
- Requests cell location
- Checks CPU information
- Checks memory information
- Queries information about running processes on the device
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4329

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/main.opalyer/databases/og5.db-journal

Filesize
512B

MD5
5508f09e8cedd115891b6cd23dac97ae

SHA1
6dcd140761fb45283b04106efcc234b44dce7223

SHA256
e23deb7785cbb0b6720f1fbd66f43caaade15607f579cecbf369ef450c046ae2

SHA512
656f081a551a1a821462be877f4df5df7973ed02d849d460e8aa21fdbb849080738ac83b87b6917ee4b5fefac0b2f132d91a0059d865c10a4b19dd0fddfe42bb

Download Submit
/data/data/main.opalyer/databases/og5.db-wal

Filesize
40KB

MD5
ecb8f6296d620ee33393d129a94400d4

SHA1
a073a411deb32489e3a7d4467c1d0dfe054abf70

SHA256
66ecd011af5bbf52788c42220035f4ece2ecdd12c916614fc1687ab44658542b

SHA512
db5256fe0f98fb747451e154ed1e004cb11075bd45467c4621731bf7d848200c0b16e9d0d7fe4960864e60748b726e8accdf1be7c9aa314465da3870e7b0057d

Download Submit
/data/data/main.opalyer/databases/sensorsdata

Filesize
4KB

MD5
4cd3b58fb019c49142df1f5d40bd152a

SHA1
a3ea8d113ae32bc0dd1b3f1be4d310afa585b6da

SHA256
22af87dd08bee029b33251532fb69415be4492865803135f68e0fd39898fec08

SHA512
d929f84c94691fc333a2f871f48f566f056db5117aaa51906e3f0b7f341c48947798f456b7899ee30f8785685593fac8efd4b6058d9ef2b4917c406a4ec7c907

Download Submit
/data/data/main.opalyer/databases/sensorsdata-journal

Filesize
512B

MD5
99111ee21fd3e2f70094afbd1c55256d

SHA1
01ef37e4c47a372eec1f9a9496ebc9ffa4e89e2e

SHA256
fbd3534f0818d7915803bbcddf91776216cfae0829e79db1edb0c47b18347614

SHA512
f26a4faa06ac12191c97cfcd581e701e256eed366532595742e55f21974f9f09341896d12d596a5f5ceb4d24fe4821f1ef6f237c9ade985104bd1863c27d0a3e

Download Submit
/data/data/main.opalyer/databases/sensorsdata-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/main.opalyer/databases/sensorsdata-wal

Filesize
60KB

MD5
fb9521fe12540dd2619823f75aae0d5e

SHA1
40b7ffc03cb4b14b3c6218275ed6161929670641

SHA256
3862a2c9b9163376ebd3b686270373b6942785cad3e083d5a978ab1c226e4a3f

SHA512
ad009f1a2329c505bea400b1a3693a788fa30c8662c147e7701088b5c6fc6962b3b15c29af9fe36eff7818aad199c53e6cda63f3256a30c3835f48e2983465a4

Download Submit
/data/data/main.opalyer/files/Mob/domain_1

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
/data/data/main.opalyer/files/TDtcagent.db

Filesize
32KB

MD5
72ab49f670926e4b1367ac033996fab8

SHA1
014bc08c7a954cd448016acb95ce81ccd4907acb

SHA256
eb83e4b8c33127ce285040c5955188c27cc250c2c9a598a1b8f17e281befd065

SHA512
5a940ddbc92276b9931a8e40330b695d19a2f2f8c1cc87b2a317d24cda854d5ba96c2cb005980478e97aa847da710362a363d201d36d7a7f6187e50b08f23e26

Download Submit
/data/data/main.opalyer/files/TDtcagent.db-journal

Filesize
2KB

MD5
606c9e3d5c7e822f89659426319f124f

SHA1
bb3e754bda29014113012945623433bf67b5d9f3

SHA256
c76edac8abc270d07638bc4ea5aae4a9ba2ad62a2b485820e4672deb69688efc

SHA512
8c8fe303fa0dcf56c744216c8939bcc1f44dcabfeddca970c9b17d4be39996571477bf08dd768cfc69a0f43d818a363da94b76988480d95b34396622ab1224a5

Download Submit
/data/data/main.opalyer/files/TDtcagent.db-shm

Filesize
32KB

MD5
73f3818e8b884d54f6ad19f41a666519

SHA1
1d867d789efa9564e283863fa0d3a21229ae12af

SHA256
473966b27a11446ee8a293948ddbfc90d5bcb79f70ba14ad70b57c2838e5a199

SHA512
10a5821e27fe94a4b4212cce376b36be2ac9d7d89b9c21dc9179280fe7f865fa45ef9f53cc5c717d88604b88788860ce95ecf12412ef1b702d78a3341372b459

Download Submit
/data/data/main.opalyer/files/TDtcagent.db-wal

Filesize
72KB

MD5
a482d25e50b53b85dfdc08daf616b980

SHA1
dcc9f0ec186959243fea3e6052b8d06670feee2f

SHA256
26358dc6dbee706e162f1c77b7d832e81920c4424d68b38d10af44e64d921897

SHA512
1ecaa39e97db068b60b6a8fb5764c82e86746fe204b4e972a76cc9d5d164410b9af6d5dd1ea0ddf33efedf44ac9f365e609c44c8f027540b7f96b6c380b7355f

Download Submit
/data/data/main.opalyer/files/td_database1SaaS/1715387583210_4270

Filesize
2KB

MD5
e1c6610a34deb8e3f16c2950d075c696

SHA1
8673db8dfe48630fdca60374116f0adaefe72c6b

SHA256
62148f220db81f081172bf484aa6725b864bb73b98e339caa1dc3bd38decfcbb

SHA512
2721e4de5b5f0e6bf68e527843c7da8726cd502221320295c31a3f3abb4a52b39d1fed77ccfd5402318f18177ce2d822955016df2db3ee21ffb23ad3171696ca

Download Submit
/data/data/main.opalyer/files/td_database2SaaS/1715387581987_4270

Filesize
2KB

MD5
83114ca0ce0a0ce27fac66c382acc145

SHA1
ce3ca10e567cc3c1c941b8706950387c7040831a

SHA256
4888da2ed3f62a4598ff239f0df417599edfc293e6ef3aa7bd52f5c657f17f25

SHA512
b681d74993591dd23af259af5dd880a42473528b6cb3d072e01611a9c379ea00e22437d3783da274f408e14d60f6bb5f8ff7b3eba154f1dd9d3e8a57763aa193

Download Submit
/data/data/main.opalyer/files/td_database2SaaS/1715387582251_4270

Filesize
3KB

MD5
04bb01d63268dab84dd92ed9fd43a19c

SHA1
86715f5927e7630f75ed1b53ca7baf1d476ea15a

SHA256
ecc1316a81b3c7fd60de436bb1451dd17c85e875bef0e0a6e150b6b4077ded6c

SHA512
4b9b0dde7ea5590bbacf47449261745c9194ca38c56ba6e2c60916181ab83187d36d8a154ad478ab8ce7e2b0b58b335e15d244fbdd57173c77ff1f875a437c65

Download Submit
/data/data/main.opalyer/files/td_database2SaaS/1715387582778_4270

Filesize
2KB

MD5
92b2a2eb9bc30b651ad012b5b3f8a55e

SHA1
18b01c59cdc0259abbb0b25def2c022ba76d0512

SHA256
21c76999fbde13525a4ceed8137bf8e307c3e2f67adcda33e94b634253e88026

SHA512
addcef9a5721448805a066797423dbb04a1ff43847d70447e3a9416206e80a61b201719d3c2d30b7bef83104bb9c0a8dd54cc3684e5b8263fb6b6c5f774e693b

Download Submit
/data/data/main.opalyer/files/td_database2SaaS/1715387582795_4329

Filesize
2KB

MD5
1aa0ad181c0fca4af63ab0e7511689f3

SHA1
1217fcd99dc5b545570c09ae1339e0e204133430

SHA256
c5b63e47b23d7d7739f7673a5a571a92684cd930fe9e36f69a00cff43e99682f

SHA512
213d6bd73ff0da27fac4d62affc67b8a64970c41c86cea0776834b435a6885b92f93e2a01f00f788a6effb6198c157ae7dfc3c6f67c6dc1c0c7bd1cc12506636

Download Submit
/data/data/main.opalyer/files/td_database2SaaS/1715387583881_4270

Filesize
2KB

MD5
27fe3c89ba1863a631dd8803fb964f94

SHA1
b98f5c39738db9aa78d79372f1098a54a0d53988

SHA256
bcd6a886cb51c3319bafa2c811a14ec6d84454a9bddc45988cda2b01b477e397

SHA512
ab8c230b82d5cc4c6fcaebafb29ab1bb95f8deeb269231fe45ea7a926e64b37fbfdcc37bc883384ef9d00672553ad520f180d6ef30d17e394c8bed091a99d4db

Download Submit
/data/data/main.opalyer/files/td_database2SaaS/1715387642320_4270

Filesize
4KB

MD5
f10062a3e5f1412f5864248744b6dfff

SHA1
27c2383bedac0cf83b880c269be84a7f2c44b89c

SHA256
4653c7eae72e53ec7cece78d00d026c1d84bd312883f4c12f9a405caeb227eee

SHA512
82d14a42dba8eb11dcce271b6716d7ba4d231d9264e299f0bc39fd0b06b1ee53a992ae543e095cf0dccf5f21bc5412d61b4cf7d0b868febb686cd982196c794f

Download Submit
/data/data/main.opalyer/files/td_database2SaaS/1715387642653_4329

Filesize
4KB

MD5
7c5ff08a6788f82e4496a1189bd526d0

SHA1
a46af42faa72d9ad69ac7bc12d3c68f3942a29d9

SHA256
5c6401c31e452deb8458182e5ebaf0366775685951a0d635c08c464e48b3d6ee

SHA512
91adf1985d409aecbdb7746e0679d573917c89f3b738d55e7c371c2910838d7e24c2d92befbff5f088a2ae2ff97b75d3fecb23777e226348f6e967ecd7991b4f

Download Submit
/storage/emulated/0/.tcookieid

Filesize
33B

MD5
e0345311d773d08729d9a888a0c9c497

SHA1
af2c9a56134d3741561e71291d5aa90c56b6383c

SHA256
fb125d85fa1fd1fc36915e74cf7624359d65baab9ce12a3877bc09a1d169424d

SHA512
5fd2ef55e68bb8405811e5b9fe625c60563177a122201dbc101d48cca6695266ca55de3dd672e72c1a075cbbec4e1658ec12ca3087f389cac289c772bc6c7990

Download Submit
/storage/emulated/0/.tcookieid

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/storage/emulated/0/Android/data/.mn_410185822

Filesize
130B

MD5
f321656a466363e5192773d92000e401

SHA1
3a6abe9be1a6f4deffaa98fd27f3449c888d3c4a

SHA256
53efd5207de6ed80429ec3c7865eed2b64023a0ed66e0fd29e7f45b708a1751c

SHA512
fcf6884bf5ce8d10b3a3dd461fad96cb6cf0bc4129e01788de112551230fbc4d8ea6961b04411d1c7816e248437c4560277069d9c544e5450612abc0e2c0171d

Download Submit
/storage/emulated/0/Mob/comm/.di

Filesize
57B

MD5
70a42cba408700f9a6c01c7941a8829e

SHA1
eab01cc2c0671538795fb0b1146017dc099d0984

SHA256
499576707ce2623293166979e59c832be5b8636c64ad39aa63ebcf961910c35f

SHA512
8900d4dc8eed0430babbacb72942401bd22ef7fe5430cad90d3ce0c2c53010220d666aa0e2eb1026f3ec81d574c7fa12585b49222a5f15b01637f6ba134fe70c

Download Submit
/storage/emulated/0/data/.push_deviceid

Filesize
32B

MD5
494e42a27fb0871f11248c555c8de86e

SHA1
00c484e8d822751e02e2af3d61e978db3f4539e3

SHA256
ce68a19158a26c39afcdfc599f2bcf34afaca8323654a61d280ad2525082be62

SHA512
e0bdd8a5bdcdbffad4c1df0bb862c5babdb36e59e1e35aa65d9101291bb570b5a8b75256bc0952779f9227850169d14defa611189948a96c49301bb8c3348dcb

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads