c86e3204c784ced73e1aa8c6fecb52b783571f251e0684b2e4a5890b3e8e35fc

Analysis

max time kernel
12s
max time network
129s
platform
android_x86
resource
android-x86-arm-20240506-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240506-enlocale:en-usos:android-9-x86system
submitted
11/05/2024, 05:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

32eb05a1c934b6b280ff6cc31f8b6eb5_JaffaCakes118.apk
Size

26.9MB
MD5

32eb05a1c934b6b280ff6cc31f8b6eb5
SHA1

57e63b9baa1596651c4641934edf6e23a9dda1ac
SHA256

c86e3204c784ced73e1aa8c6fecb52b783571f251e0684b2e4a5890b3e8e35fc
SHA512

87250c3186e354f04bc851537615c6d767c1832a2193a183655e70ce4ac4a3896224ff690f5a94163964a993bffcef540fc31066bfeeaff1b01f5783b9692354
SSDEEP

786432:3m6zDeSbjj5cB+kkCvFiHRigWPuKjN74/qubS3Apn9BzlW+t:ZeDBfvyMHPtN7biS3gBzl

Score

8^/10

banker discovery impact

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.yodo1.SD008.timetravel

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.yodo1.SD008.timetravel

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.yodo1.SD008.timetravel

com.yodo1.SD008.timetravel
1⤵
- Queries information about running processes on the device
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4292
- which su
  2⤵
  PID:4350

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact