Analysis
-
max time kernel
135s -
max time network
162s -
platform
android_x64 -
resource
android-x64-20240506-en -
resource tags
-
submitted
12-05-2024 08:36
General
-
Target
3936153b6fec314797315ac7e7a2257e_JaffaCakes118.apk
-
Size
9.7MB
-
MD5
3936153b6fec314797315ac7e7a2257e
-
SHA1
b38194afa9c747a2911c8ed2be6daf230a6f6924
-
SHA256
d649b07ee07f944ecd10e955d6edd0c998b54cf5542fe23905282ceddc70e74a
-
SHA512
3bd901436281869bd19b88b977abaf441cad0846c16dd1f252a9a0bfe7ed7f71d7af6e48ff0ecb4e4400b41d5ca3e1bd6d8b3046eb3bb27291765b84c94452b5
-
SSDEEP
196608:0x+jyRfmruRV40IcAWpFzFRJp99I4pyvZUSFQJpF1UrNGhJ1RxBPcAKx:0xGyRwuR2Nc9jJb9I42ySFYpANc1Rx9Y
Malware Config
Signatures
-
Queries information about running processes on the device 1 TTPs 3 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
-
Checks if the internet connection is available 1 TTPs 2 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 3 IoCs
Processes
-
com.juying.wanda1⤵
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
-
com.juying.wanda:pushcore1⤵
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
-
com.juying.wanda:ipc1⤵
-
com.juying.wanda:ipc1⤵
- Queries information about running processes on the device
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32B
MD5ba850e0f6bfaa499a2ab3c30b3c83150
SHA1adce394a578119655b36485fab31b2489311acf1
SHA256e107e51b90784f97229c3529d9ffbb292935a581755a26e920eaa00e3a94a00e
SHA512e448717f599ac7c46e8b5e622f3a7c35f48a8146f8e96c2cbe87b222871ec71cb6ea94166337ca18233d9bbca3c788eab1d459ffbec6433cba26b5b856d8ede6