b770372a732b2fbeb98583f7de4f5944fdfe70aa94e5d0e755dd902c2db56b7b

Analysis

max time kernel
68s
max time network
150s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
16/05/2024, 15:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4bb03ab99296dc42ee35817530463d48_JaffaCakes118.apk
Size

26.4MB
MD5

4bb03ab99296dc42ee35817530463d48
SHA1

76bec8c35d966695cd28bc70876d2d8df0ab36d5
SHA256

b770372a732b2fbeb98583f7de4f5944fdfe70aa94e5d0e755dd902c2db56b7b
SHA512

67749fa9d958d60f9b9841e69ee5968c73a4d483c587a6b84e8f18ac15a639cb84a14900dc1c1dd884ffc8c56e8334f6b0aec2ab0d5bdded2ea61efe127c379c
SSDEEP

786432:E8UmvzGvODYYUv8NCy7+kSegbBSubebTz8Zwh9Xx:EUG2UYO8NHCkSegbBSEebTAwh9Xx

Score

7^/10

discovery evasion impact

Malware Config

Signatures

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	jp.co.cygames.roomsweeper.pj

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	jp.co.cygames.roomsweeper.pj

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	jp.co.cygames.roomsweeper.pj

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	jp.co.cygames.roomsweeper.pj

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	jp.co.cygames.roomsweeper.pj

jp.co.cygames.roomsweeper.pj
1⤵
- Checks CPU information
- Queries information about the current Wi-Fi connection
- Acquires the wake lock
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:5195

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/jp.co.cygames.roomsweeper.pj/files/.um/um_cache_1715872175232.env

Filesize
582B

MD5
040d08aacea940125420b1db7028b882

SHA1
4af9f9ed73f2da8e29e1f7c832c5dd7b7fbc0c65

SHA256
087d8df19773e79f8beb093df94687d898238da1b6a4dd2105e189646a969b61

SHA512
cb968e22e9213a0291825e820a494e882a7b0a4cb3c1e8136fca40559004dde5cace62f5a2b12602a9a49559576b3108c9dc7edb6ec8f9c7ab94374e7b42d9f1

Download Submit
/data/data/jp.co.cygames.roomsweeper.pj/files/umeng_it.cache

Filesize
245B

MD5
7b5f5ece231bd9748f8acaa1541c98df

SHA1
966a52486ead41703e0c3b097420c17df20dab49

SHA256
650da54ce9c002bd3c228ce95f2b847431745b33f92f4a4db2f00689598d5768

SHA512
ca258ab41f7d09d9be30b956ac14f419f3a11b5c69f3a6b34312695290223ffdb8a46228e32a02e3ec9b44dad62381bc4afe6d43165a5dd4fa91f99bd9aa5e23

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads