Analysis
-
max time kernel
145s -
max time network
166s -
platform
android_x64 -
resource
android-x64-20240506-en -
resource tags
androidarch:x64arch:x86image:android-x64-20240506-enlocale:en-usos:android-10-x64system -
submitted
11-05-2024 00:39
Behavioral task
behavioral1
Sample
31dbb88896204e149c54064f94593106_JaffaCakes118.apk
Resource
android-x86-arm-20240506-en
Behavioral task
behavioral2
Sample
31dbb88896204e149c54064f94593106_JaffaCakes118.apk
Resource
android-x64-20240506-en
Behavioral task
behavioral3
Sample
amap_resource1_0_0.apk
Resource
android-x86-arm-20240506-en
Behavioral task
behavioral4
Sample
amap_resource1_0_0.apk
Resource
android-x64-20240506-en
Behavioral task
behavioral5
Sample
amap_resource1_0_0.apk
Resource
android-x64-arm64-20240506-en
General
-
Target
31dbb88896204e149c54064f94593106_JaffaCakes118.apk
-
Size
30.4MB
-
MD5
31dbb88896204e149c54064f94593106
-
SHA1
d5848e43fe6983a34359e1cb960debf3a62456e6
-
SHA256
1f44c598e7188498f593dfabc052da810c428217c782f44568a1ca05bb15e247
-
SHA512
9851674abb65f9b0c74ca5b74422aaa6a94ba13ee060bde6e12146a0be091e877487918fd473d252e3c518e2754ecbc0084d237c227397856761d55e1f0e183e
-
SSDEEP
786432:FySrdp5MhAWzzU4SUDRZv588PGxRF+owaFbrf0P9:FySrdpRWzz1DrZPGjdbFbrsP9
Malware Config
Signatures
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
description ioc Process File opened for read /proc/cpuinfo com.smsd.sxxcw -
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
description ioc Process File opened for read /proc/meminfo com.smsd.sxxcw -
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.smsd.sxxcw/[email protected] 5134 com.smsd.sxxcw /data/user/0/com.smsd.sxxcw/[email protected] 5373 com.smsd.sxxcw:pushservice -
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.smsd.sxxcw -
Queries information about running processes on the device 1 TTPs 2 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.smsd.sxxcw Framework service call android.app.IActivityManager.getRunningAppProcesses com.smsd.sxxcw:pushservice -
Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.smsd.sxxcw Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.smsd.sxxcw:pushservice -
Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
description ioc Process Framework service call android.net.wifi.IWifiManager.getScanResults com.smsd.sxxcw:pushservice -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.smsd.sxxcw -
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.smsd.sxxcw:pushservice Framework service call android.app.IActivityManager.registerReceiver com.smsd.sxxcw -
Checks if the internet connection is available 1 TTPs 2 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.smsd.sxxcw:pushservice Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.smsd.sxxcw -
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.smsd.sxxcw Framework API call javax.crypto.Cipher.doFinal com.smsd.sxxcw:pushservice
Processes
-
com.smsd.sxxcw1⤵
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:5134
-
com.smsd.sxxcw:pushservice1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries information about the current nearby Wi-Fi networks
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:5373
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
63KB
MD5b6ad56d106f702dddb1dc3c0601ddb80
SHA18711881f25f5c3e7b76d373b47ab21fa42eaa687
SHA2567528fab6046989051804f84ba630a01d243ac621579f4225a56c5b11002af9ca
SHA51257fe70013549930870ed5009eb322d224d7d9d07a07c40e8aea9cbb1e201dde92ff7820c5b1e50aa9c764d91e5dc343b7eb0739302144a55f43b4457d6ab3672
-
Filesize
63KB
MD5de62e1f5b87e1cbfcf09b29b962d66d6
SHA1bcbc8fd3ff4ae3b443deb51f57933452109abb03
SHA2561456f12bd1f1716960498370cef7c6483147b7c5e875fd128260d23e4e64815e
SHA5123234a3537d1813318f8799578dd423af7c442791419a0e61a64fbf3929e6fb5236d8a022f52f40bbacaafc1409e92476fc28c390ecf839196770d67bce9bbc89
-
/data/data/com.smsd.sxxcw/cache/image_manager_disk_cache/0e597b54266cfa1eef2ee58e303081fb1608cc2ebd561bd2639aa2a8366cc65e.0.tmp
Filesize8KB
MD50618e379fb3d80b0ec67a60b14f63a3a
SHA12d6fa71c5ff6529de0f2d15424dadbcaf43996cc
SHA256b0f4ecf78c0beb9663ac823ad393dc2bfac9e685ddef5de21f1978d90b871854
SHA51247aec114feea50946211dd59e8cbbad1a1039184b4f6889b619cf67ab2d80249700daaca8e843016a98d2a72f3145341230153bc1deab7797257aa143c2d005b
-
/data/data/com.smsd.sxxcw/cache/image_manager_disk_cache/677529b1e3d2e44c0d12b8c7cc1aa3792d547b620785dd8c50e943d450ae2144.0.tmp
Filesize770B
MD5c393f29ff899a6ac92ccfefa45da24f2
SHA147367d6ce8d20083fc59be261bd67a73a3676e7c
SHA256699d08ec80cb217b031dd81ed46934bfb0de49d921766ddf4f9dc2d7e370b982
SHA51200181d9fe2d6eef56199e0260e838ad00c1e4cde1d60ae74abb5dafb8b83e8d931af546b568a30fe8372b1c81a2651272f86c7d41937461911716106f27a9952
-
/data/data/com.smsd.sxxcw/cache/image_manager_disk_cache/97671ff72c7f3f8ab8404d315b1d53d44483009402d56b2557229f67848df32f.0.tmp
Filesize8KB
MD5456acf5a1a67990f25b2e2ff3aad1820
SHA178f457cef3364f70d279d9775b2861365f1778e8
SHA2566944ec397d428e774c2286348bc25c7785211dc65eb6dfc06d05ac596f82ffd5
SHA512929ac7710f05a108882753fab084046d7c764c2eef9d23db8f97bcfa446595f148ef7fe0df23d09eae3aec83c8df80b7d0afe0f1c3aa54e5069091c7291387bd
-
/data/data/com.smsd.sxxcw/cache/image_manager_disk_cache/d3c8b9b381bfb09c21f4900dd9c3363070b0d252d4c9323056c618464d4917a1.0.tmp
Filesize8KB
MD5e0dd56271b83faded0aa0a8b83e02216
SHA1ee1b6cd048e0cd6c63daab39454f10c4ddbb8413
SHA256d1323dd3a9b312f3bf3dac25e3b4c24818315f5a33a037e065aa3aab60b3a6fd
SHA5127801aecab422160139c1366ec6e9caff28a1392669197f1c5069a99b8973075cf646d76dcc9786b8c9029e2981c0ff2c69a643f54b432a91a8450b78045f169a
-
/data/data/com.smsd.sxxcw/cache/image_manager_disk_cache/e55a689f931205a2d67b4fc55566c26aac374dd33f30c330a991cf22c2320b94.0.tmp
Filesize8KB
MD56e7fd0ca4594cb0e7b7d3dfdb1efb3bc
SHA1fe05a0e5064db929e9ccafcce0250b38ad2a4510
SHA25661f1567d76128f4cbfba1751e2be509b17c44f79e07808236fd72d635a3a51ba
SHA512b0fb00a69dbe7ac2dc9253f40a1fd235856fb9c0cfbd8044d6a175b9376f185dfa3c2105cbe3a8d0c61bfbfd40dbe5dcb06cc5ad8afb6b50818140756a722e22
-
Filesize
8KB
MD5d5c9a6cda5a4dfd197d85f34e7627b64
SHA18497aec3966446a66f746e6422a2eeda118f4615
SHA2564176e78b6169169491313662bf359925a4e22bb003358baeef18ec390714d4db
SHA5128bd7bb9d34e4fe62d14d3b77b27c9224afd63e87e9491384c019d50cdeec1af0dd0f6c09575e3d77d312cd6d27947808e0215037c6dc9559fe7d9e8bdb1ea12e
-
Filesize
31B
MD58c92de9ce46d41a22f3b20f77404cc1d
SHA18671a6dca00edb72be47363a7071be65cf270373
SHA25668bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
SHA51230f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56
-
Filesize
8KB
MD5ab49236a681e8ed6f614e021f5e2ca42
SHA199a15595b3efd723863782ff0e030254eb361eff
SHA256b01dd2e03b9beef9a214d164dffd6b256999e0146cd67caf4eca0efef2eea672
SHA5124ef800ceb542c7ea1fbedf18a8251ac4e2a81cbba6df39105c2e3a132064013835c0bda2ae2faa94f4d545b8e137225fd5e71bd4b29389262c9354131743f36b
-
Filesize
28KB
MD5b2a067a74e73193042214c7ec286f9b0
SHA157705e5541f5f1f4ac1b02cae8b4fab8e0bff732
SHA256424bf508fb737635ec390094810a757b986ef3cd24f3789840b5d987389c173b
SHA5127bbfc1cae7b9b24779cc9a694a7767e8b1321c9f19708eb5186fee0e75866ab4410f08bb537a2e1c942607395d95aa4da325ccee7ad0b77b53995d181438afdf
-
Filesize
512B
MD5b5742777855dc668b77b8f17f4ad9e58
SHA12ca0f35f39a2837011a4264e633cb036668b38fa
SHA25601e86ab4c34be00e6f58e8270d18651f45ac487e09cdfd857438c93bf0137687
SHA512a77eb49bd952b6b1b5678ecdbd95d205aa9528cb6f74c5824d30c4e2d774bbfb90832366f6104d3b201b53cd611f78a735e407abf32c660071eac3e783cd9771
-
Filesize
8KB
MD5e5fc5af7e3fa542374150e77ab6fb1e2
SHA1b3550d9d6ef4dd83ff76ff29f0951a65f60b4d14
SHA256ea0f7d0a483de204adbdb5a1d021bde4efd5e9482649b66388998fc371c343d8
SHA512cc00ea0a23056651e55f4fc2342a08ae52535651758934129d8da30282c1a2528bf30b8ef9cae6393e1335661fb4ecc0bda440d94b833356c380f9d6641abed9
-
Filesize
8KB
MD58acfdb3bc25c7e4f55da1f7d6387c0c4
SHA197e5c3078767b3ecf7128403489be2533653caaa
SHA256c657a85b974eb67a7dfff63b91766f84a36df0fcf18f5265b2df8b20532c814a
SHA5120c67b5d955dfd2a8c2e630ea9a95178f7482aaa011db557e0816ff67640c5a61295bfa04d5959b3b7e7bb2f25a9450e4fa24e87002a000d5aee037eac3f7fad7
-
Filesize
8KB
MD508610bd1878c8f134eaccb65ba884d78
SHA1b32992281ff9751a8a63e6cd8b1e44d2c447ec07
SHA2563c96d1e5bffcd52bc3f1ec76b0dfebd09143fb6b44e04155b1c6f7961ac49101
SHA51252d09c6adaecf5862cd062aaa6de6f1421b31daa1cd79454da6acd535d497de9a2fc6eb5f5e41938fe8df8a306af1d6e214d21cf158f686fb2ee6c98650c841a
-
Filesize
12KB
MD57f4779130b2418d6b9cecb6ba23ad840
SHA1455e009085a04552b6eb21d94a989be37f03c3ed
SHA256f768042fa5ff5fbb08d553385b5918143d3b7869bd44decf01cb2c0a802e5d74
SHA5128c1a3a4abbc6c065068411f5cef01763222ade9e6f3da55af9dead2d1bbc93c07a5abfbf22a10cda3e8049959f7078e36432081eab058a7795488a389835efb5
-
Filesize
12KB
MD510bdd31b420b8d4c8e976a21edcf3ce6
SHA146341be4c14cdea8db973734da2a8d273485701c
SHA2566b1e2f33bfa72a04d16c4c9c3f43136a1c5b98094c3716fa346e516702a40b73
SHA5123e07b4cff88483b7465b5f53d4b68ffd0f91f404375e106ffaca3cf89b8c7accbc79dac6e450e73353d5dd7999d63e78a4637a25f480d16c9c25805839364021
-
Filesize
8KB
MD5efa7f67a65278e408e11fc63d51fa093
SHA1483a78c6b3161023f1597d019619e0080d80c3c9
SHA25657ecec8e8971625661914be88df19626df8833fb256775eb1dc76674b8ff6886
SHA51260f8546506eb08ad5f526ef8778828ea5cfeabeb318db29981ce4955000947b2f2adf790c8c315e373c87a851d0fdeb3b127cf8f9dd2224514e2fe946031491d
-
Filesize
8KB
MD5aad0df1b4b4f27bdb4aab915d08abe92
SHA1e50a7aa425bbefe55a60053b0aa6e309494ee6f5
SHA25678fb1b468f68ea38427a86638edba0a0a289930a0ee09963d3b2bce3bc8c8672
SHA5127192e9a30ab0f233affc6fb31b8d9ddeb00a7635526070f7c0a6a243acf1d87cae387e3b3684266dd9b8975df98047299b6042d630b656ff8c138e5eab5a72e6
-
Filesize
512B
MD5d8a5e3ee5ad14e7a2bea05baf3b1c564
SHA15f273d3c6d0b23a7a19f2cbd4eca859bff6016fa
SHA2568cc26472676ff5cc0e04d94d0f38365f73bdcfad441e43a9a43ebe89ca4c7683
SHA5126420bc831bfc95d46fcce8754d3282182afbb45bc183d2c2d76d09b35f5c37fdba410381bcb73a61a35b6a6018b6f42ce355b87007e6850d399812c6bc571e24
-
Filesize
8KB
MD5c1f50ccc269fe9cb880ac3ceece834a9
SHA15e99006296377adcb4699330d9fc5470c61cbb5c
SHA2563219e33787548da3a5078b698c4a182c589168a67a136426f94e348b06a14829
SHA512d66a385e66c7c22e612187ce3088f49b69d5cf4348062eb324dc9b5af633c4f4187c16c90d184424ff3437347b65056091c2c9d0dffd260abcd300b65be9a887
-
Filesize
512B
MD55380ec93eadf3da21967348b69a5c7fc
SHA1b4882664e7da84a1e014add6450b7f33b40a7156
SHA2566832fea35a8e20efa228763da2b30e541761442b4e766b7be65c01a76345bce1
SHA5129d98805da386d9bd5c1f0c33b27bb67392d2f4314c8c3eb64d54f3a307a5be356b7c53900f7b49d917da31c5109c2c1f384a1c363a3bc1ef54c17b3a25dccf03
-
Filesize
14B
MD550208b85c8f50959f1777e000ab6b6bf
SHA1ae699f25245cea97d584d7c1e04163c892df88f8
SHA256bfd36d1f6860f807f385cddf9e616b1e1070a8c5c464445c2d5006442a3b2b80
SHA512c5cc295738a77986523a78c2bc8da9b89ce24ae792664be23e1b3857833769080b41d3dfe04cab3c0164bff79dcdff71026af9e4ad78bbf26637b870be4b2f84
-
Filesize
8KB
MD54808715ec02c980675f25596c4355c21
SHA1a7cfb5ac0a83d1573619ea9d4b5e9ecf25bbbe73
SHA2566bd1c72f3dfb82475c7eb07cf251308cfca4edd02d73ea900502eda673a623ed
SHA51281f59e37488ba3407300ed978a7abd2b68f121265ec07e4b9e50c93619bab71ea20eb797fc28df19737d3dfb3b4c351dd64244bc2b6b53b45fd85786a813dc45
-
Filesize
8KB
MD547458884685997a9b2ffce137e87336f
SHA1b246e2849db5cd2c8d02f002054b24df94782da0
SHA2562037d73ce013a2d66b4ccce86a2a7deac8c7e4824ec1ed1907b2b17eb292d4e4
SHA5123fc9885cbe629504e0e3d14f76b5e44b3e0e22abf71a114ac2cd482d1ef69eff5ff2ef777a0ba345c4d526a9b8a53070e3458ec08336580fe5c2e4c23cf9ddc0
-
Filesize
48KB
MD5a694421767e62260bf839e235b874e0e
SHA11ac641b569f84baa50ed553c60c35dc7df683d40
SHA2562aa1380a888f6614b81e80eb9a91fa6f3eab1a6a2de98d2117ec1612d686a583
SHA512726594867c9f1a45e268e4e42fa8f962eb7ded061b62f930c721ef2f6bd37098c386a3313d1ec1eb2214ed778c9f008232879b3136c95845a3bd68d98c729f3d
-
Filesize
4KB
MD59bf4975784a3f7d4b2e864f4b885c2ee
SHA113afae6aa09dd761cb8b31d517d42990f5dc6351
SHA256baaea0e178baf80c641e8cf79ce83c2271b573447d7039654de680d2bb20ce1e
SHA5122e27e0174451f8f2b819e0b9c14b4d00515dfee21ab02e80a2fa7cfcb05a07822bc5c07dafcf51c88e8488ac6e4ca5df5b11933be737d05961bcb2ac64bd36dc
-
Filesize
28KB
MD50e7b0f7e53ffac7413733e41184992d2
SHA17d6fbf835de9982981f33d5ec3bb8f7f0a5bee8f
SHA25619fe767474f27b6dfbdf8dc2cfe37646c8119fa284529dbf15bb9ca5bcca3584
SHA5129854cfa619c4ecdd19d35de992a0b1367f08f71abde188d838eb0d5fd8541da8d9ee355ca01d692d313a10b867976fa1a039889a1ed2be235b5f4da6ba146dd2
-
/data/user/0/com.smsd.sxxcw/[email protected]
Filesize63KB
MD55061e4948844f7d366972ac8005e9f13
SHA1a2b79a1c79afb095ddebf0f16a1f9db64482bcaf
SHA2563aa6caecfcd101531539147e01382bc530b4fdc61e98937d63cc4648793c6a45
SHA512223d18ce248912df18cdea3c8e864ea5e6ec058ca42cc5fde738188c54abcd260d7f24ac53d4987d3e32f4ae3e1e40e01354054d035bb100eef51b2d695f5299
-
Filesize
8KB
MD5ba9ecbface95e553b05e334c86588a8f
SHA1e6db102f4a70853cd976c593e097f0dbc0a33d65
SHA256b3a105f516f6c590504171fdc4684d20c77ae576657d3d85302819f2a1b654c5
SHA512d2d31277508f7448a78914f50a37ba0549d34503563f66b99c11db9e74b943f89803d22da4cfe359af527d8aa3eb3248ee83af8b49149e53f7ef80421e9e1a68
-
Filesize
659KB
MD524bebe5ac883f1a7434a4fdb9ed67254
SHA1c18ab28c67435ba598fe1ebb9c5f5dc0488f32aa
SHA2562641a16b8ed245934e72114da14edca6478fd8a00af782d4b2a39ce84879fa1a
SHA5129d63e934dc650a15cbd517f0cea358d8849ad67baf7588de45b02a15fb1e3a49dffbe1b8ebddeadfb168cbc961e876a106d774dc89b8516749bacb8f2261479e