Analysis

  • max time kernel
    123s
  • max time network
    151s
  • platform
    android_x64
  • resource
    android-x64-20240514-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
  • submitted
    17-05-2024 04:51

General

  • Target

    4e7d171fcdcc00e1882872750b1f8fe6_JaffaCakes118.apk

  • Size

    5.8MB

  • MD5

    4e7d171fcdcc00e1882872750b1f8fe6

  • SHA1

    e71bc1f849bd0afb0b36a3ee3574577cedb90cdb

  • SHA256

    8386715c5fc28c0c5de37fbde8004c29ad1022b15141107633b2b48799fa0df7

  • SHA512

    43be43293f73d18ae861109e11c7afbc8759819ca01431ac5b3720da52db320b661acb87dfa666ac490c907e0fe383e87911af9bef9b9979eeb8ce6042c503ff

  • SSDEEP

    98304:M0XCcDlfLwJ55mHgLljLWH6yE6eQTsddYU46uR3M13PxuqUsRt/OI5w5tPP:9XCcDljwfJLWH68pKcRhqUGUUw5dP

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 2 IoCs
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Requests cell location 1 TTPs 2 IoCs

    Uses Android APIs to to get current cell information.

  • Checks the application is allowed to request package installs through the package installer 1 TTPs 1 IoCs

    Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).

  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Acquires the wake lock 1 IoCs
  • Checks if the internet connection is available 1 TTPs 1 IoCs
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
  • Reads information about phone network operator. 1 TTPs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

Processes

  • parseh.logo.two
    1⤵
    • Checks if the Android device is rooted.
    • Requests cell location
    • Checks the application is allowed to request package installs through the package installer
    • Queries information about the current Wi-Fi connection
    • Queries information about the current nearby Wi-Fi networks
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Acquires the wake lock
    • Checks if the internet connection is available
    • Schedules tasks to execute at a specified time
    PID:5107

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/parseh.logo.two/databases/__pushe_base_lib_db

    Filesize

    24KB

    MD5

    9ebe5bba1c2ff97f49c50afda6703043

    SHA1

    7df0ed269b47ba1e7872c74b054e1fd187aa55b9

    SHA256

    7fe422f7ff8647ba295ef0bc30f70cc18c07b4b6221760114a544fde2142579c

    SHA512

    d8b836fdc6d9eb1c68ff8e2414a5bd7093ab5ad810b4e1b842b4d90d0cb6d5213f4e8b2aae264328fc3f4565100adfc7871ead9df057fcdf54efa37ffdcebf37

  • /data/data/parseh.logo.two/databases/__pushe_base_lib_db-journal

    Filesize

    8KB

    MD5

    318d332bfece0f887c639780d286d94b

    SHA1

    00248dd399a82f51a5bfdcd3cd1ae043e014a7d5

    SHA256

    d4fea9448b471c3709c39089d100ad27952f2c4803961ee6fa22c171eb3d3c22

    SHA512

    9e094dc8c6a1e3c1735156275e2d3f7d84d38ab10f482547e1a036c4e0c8fa7931ffe68f8a520cc1214e4c5f291b8238632a50ef7c5f73ec026eee9b4ed92e08

  • /data/data/parseh.logo.two/databases/__pushe_base_lib_db-journal

    Filesize

    8KB

    MD5

    313103339c1b683c43c3cf6be54e9e56

    SHA1

    53fd9cdd2a6988d9e29fc8c1cb1ce37e10723ab2

    SHA256

    1208c33df7e581884fed13453ce8c3a4f857af9db3a6d53983f85430e7ed5bd8

    SHA512

    f123147297fa4ec4ead3a3c8bc44829e0ca3f7ee02bbe7ef880ebbb27d685add14c41ac0fe8df8d1c7a62c725c578ef1ddd461d2f5f2e5e619bddebed0212e92

  • /data/data/parseh.logo.two/databases/__pushe_base_lib_db-journal

    Filesize

    8KB

    MD5

    1c57e739edefca3f9a66bdf4a366025f

    SHA1

    983ffc6105eb31dd1aeb8339c87c8a001f48cb2d

    SHA256

    06777e6455a4983058d13cb7f6ec0a1b46cc2410ff8e9b031dc1c3ba92c4656e

    SHA512

    54b1b2529a675b3372cbc53fe3f817635945ae2f44005bff27f840b9f7b963c80eda0b1fd15faf0f73d52db618a1121f7c6767f6d5cc86c667d332b3e692f037

  • /data/data/parseh.logo.two/databases/__pushe_base_lib_db-journal

    Filesize

    8KB

    MD5

    6c85d187dc842efd6e73a305f2f8a154

    SHA1

    7c46f74df47e3664605912c16116cccf6a2435a9

    SHA256

    85a56d26942b885e170a9594c5e13d1b117afe708376c9d2fdf4016fafd39564

    SHA512

    d81dfb535e192109597f492c8c771c4fc2714f561eddc4f13bac23b5db346ca1a158017a29536d0865c0f33a42d6dc3889bd2ed5acbe9066cee902ff4b99f34a

  • /data/data/parseh.logo.two/databases/__pushe_base_lib_db-journal

    Filesize

    24KB

    MD5

    b6069328e0fb41809383dea35d92643e

    SHA1

    c84c649a47e4f957129b89c7b6e8a6a9a8db6be3

    SHA256

    94ae87fa5685f4427e25230bf594efc4a06530534789eb44cff96ae8f9c039e6

    SHA512

    b35d2d4535e39beeb6ef5de9fd7b593121d96ae3d01bc3c05d352b7cb0b7c4f2617243f6715ba96137ff89ccd30390525a6d2bb908682870287c1d82dac47df1

  • /data/data/parseh.logo.two/databases/__pushe_base_lib_db-journal

    Filesize

    512B

    MD5

    57fcb7b1d7c59777cc666cce7ac735eb

    SHA1

    8f49d3a749beb76f18e4e93426ab1ff91713fb3c

    SHA256

    ae66c295fbfea229e74b207d8bffed23d314c41e9618aa52191102eed6d6d6fc

    SHA512

    a1d08e236534dcd663f1f041628b9d38c0de9acc9b864815a71368fa7328e84b658502db19d7fc3ebbe570461de523785215c2306a105e434c3d199e32d9b525

  • /data/data/parseh.logo.two/databases/evernote_jobs.db

    Filesize

    16KB

    MD5

    106fbfe9130e55c23964d4c2cfd07e4e

    SHA1

    9c984eefc1130fdf4a90f9ca3a7fdb90c01fe947

    SHA256

    5f01792763b359945a6a9c0d26042d37fc31296ee21a43b7e13bbe479621c726

    SHA512

    465976192f4b11d389f465f3521f30100ec4e11ae5eb081b6d74931b90e1d3056f525b0af6408a8289e1ee27820b81862b3a89bd52e0c7fc5a79af7d2159eda2

  • /data/data/parseh.logo.two/databases/evernote_jobs.db

    Filesize

    16KB

    MD5

    4956c59522b119a6cdbff4054d7e0125

    SHA1

    c0f2caa89ee57a665156a95e54f7f8226a35e1d6

    SHA256

    01671092a51071c4fb750876813950d40660a873c7db0c31d7635abf8a89b460

    SHA512

    efa27171cfaf2940f10bdca8b3c1add15d6a80e7598e3492051e1c79102398cc7b4604be9b08128b982900524ac173737b6e3d72b181c6f0aa1a6737daa75fa0

  • /data/data/parseh.logo.two/databases/evernote_jobs.db

    Filesize

    16KB

    MD5

    89466ce4794bdd5c83e9a1d13b364af3

    SHA1

    b3a2b82a09b24eee8a79568e6dfdec259525c282

    SHA256

    74a85998df212239e6d581845d2c17682d6af8534e2daaf6869637b11ca12ec0

    SHA512

    81250e2efcdcbcba982f7759e3420a88c6806ec229848feb11286d4e510280fe74efdd22354849bc47bc53a832b94ec05866a5d94e7edde7fa2dd57c73204412

  • /data/data/parseh.logo.two/databases/evernote_jobs.db

    Filesize

    16KB

    MD5

    00e829076f54c72b50b63fd6de296a03

    SHA1

    fbeb1b8be863931f98a7c29224a03b89f9616ab2

    SHA256

    c479f839c0bc15e9a9749cb5a5a3eef4e09c0163160073477f72fa78b2e300df

    SHA512

    1c6b0bfe980050072927f8d407ca86353098d03502f7194f141d43c045a3f35103261811281f023262f4823a4fd70659d6802b76e126e991120dc14cdf74bbcc

  • /data/data/parseh.logo.two/databases/evernote_jobs.db

    Filesize

    16KB

    MD5

    6f17623291346b978b507f6429400c85

    SHA1

    637ec4b0d369a029657c23a1db012a139d4a2032

    SHA256

    e4847b46d6b4d20c6d59f055725cf5015ee4eed8d70f789a94e9bad9fac32745

    SHA512

    828e2d357423d3b0689d0f679102cdad4fe5c967750a8ab4287e47c1bfbd29ea158354109fcdea56ab1a7ed48a4e761e0ee417cf63d430d9e1e325e5c2c74b66

  • /data/data/parseh.logo.two/databases/evernote_jobs.db

    Filesize

    16KB

    MD5

    6f72fe09377b968c54b07ad38dd4737d

    SHA1

    5a2ba0567ea5cea4ed3c9025e31133c41db10814

    SHA256

    632147d269cd647c43abbacb33a9325998add347da6420f005b51cca4728dcec

    SHA512

    d7c5f797fb39334154626ece0163f0821976b6e3ef5f4faa07ae877336cc5dcc151d0f493e016d47acbfa2ac9248e15539733c62482535f4ba47ec0c911957c1

  • /data/data/parseh.logo.two/databases/evernote_jobs.db-journal

    Filesize

    8KB

    MD5

    dcc1d104459121a346f6fe4d84bcf387

    SHA1

    73da54d5963f2a7298c298e62e2fa14fc60a11e6

    SHA256

    c16cd57e2e627316bd8d7a63e06efb0127920d019e1ba873d0362efb0bdc36f4

    SHA512

    3d8d8291284eb4709abe0a1c0f67dcc5d808c8e901045b2b6082a92ed5945c506d0b18a363b97e4523128784a00012499a1503730b3bec25521935fe0e4b3742

  • /data/data/parseh.logo.two/databases/evernote_jobs.db-journal

    Filesize

    8KB

    MD5

    36dc56431eb3dd275af9c0a3b94273ca

    SHA1

    1899f801f3a032ab08af6532d8c7a0bed5d59010

    SHA256

    8b3fdffd68bc4b03f63d3318b02efacf24a15b4dc91d528204d51f768cf758a5

    SHA512

    22560962a7dc256169b2b237b6cc0e09da27eede1a0be92a001af6d442e48735c43bdc689f7fe577ef03d1ea42ff340decb812b0b9a9b40f491f8323e27c5b79

  • /data/data/parseh.logo.two/databases/evernote_jobs.db-journal

    Filesize

    512B

    MD5

    57ebcb9242291c0c6375cb6190040780

    SHA1

    dcf1c35c0a008d841b918d73f4d4ec29878c94f2

    SHA256

    c612e28845f8f8a377b131f6b2804f9190bdf8c36a67180ae7d730be477a1516

    SHA512

    68c3d626a97a938f84948fbc29474e3358035ad7cd4c72cef20a11791d848de99089f1dd6118c05c8de721e3bd21d6733dd606cccdb691ccfa2660ccb10c17cc

  • /data/data/parseh.logo.two/databases/evernote_jobs.db-journal

    Filesize

    8KB

    MD5

    31a1ed57686a69bcff9b932442ec9fb2

    SHA1

    ba7fd92ab8d47794c30052a61ebc9ff657fecbf1

    SHA256

    1f60535f30ebf9351c76f51b83bfe6aa770cc26c54bcbdc2bdaa8e6fbf6270bd

    SHA512

    05745ec07cd44ebefb79d7c57e797b0025926986c5392aec99db33044b9fc226256e12da2ca5881f13ec4c5cd71579780e18223123785101995bfc2f1c57ad56

  • /data/data/parseh.logo.two/databases/evernote_jobs.db-journal

    Filesize

    8KB

    MD5

    ef1aaaf7252887fc364845f890c3a0f4

    SHA1

    48436e8c1ba5a469bd4ac314c93b46f6416fd7bb

    SHA256

    8a702a93e8559757d8313d838ccc84784bb4fa82996f1e887c8fa9e6cea347d5

    SHA512

    c38e483c739d6f6c394544cc6b23ef9f14367231b9112f847f550df89cc4f7b375a83d3eef454658561dbfb9c28b77236c65d488d5950f26a679156ed36f82a3

  • /data/data/parseh.logo.two/databases/evernote_jobs.db-journal

    Filesize

    8KB

    MD5

    a591ef79c382332fd641cba76d876e9a

    SHA1

    c0957a38809c5ddcacbfba73baa48db1a502381c

    SHA256

    73e15dafb9d20ef7e14e8ab05c9b1c37f8ab6f19c89a302a98214237d04284c7

    SHA512

    a05d7edd3c9d7b0ba626a903e7a4d4cb03e69df86a149916f5ac44d5472d9a0282279e62422550bff5797ba4325b6db39231b4fa05b2331d014720e7222c1c54

  • /data/data/parseh.logo.two/databases/ir.tapsell.sdk.ads

    Filesize

    36KB

    MD5

    2f515ee72eb2f5f40eef1fcdf67bfdc7

    SHA1

    81da15fb4317240515d0a78a6b7504ecd335a448

    SHA256

    bf4a759fcd025c1142ad6ed70e3bb0d159935b4ca96762c8d4ac1d3c0c0ef353

    SHA512

    5c612d44a20beff96d9ab2d4b6e111f31c80c07d882a54dedac16480bb9a91e6c1cf0a91c38fa853c85b03e8fc7dfa6eb61f76462dfe37dbc55e77b5454ec932

  • /data/data/parseh.logo.two/databases/ir.tapsell.sdk.ads

    Filesize

    28KB

    MD5

    237111b0303218ca0f940795cb4cc36f

    SHA1

    50df0e2481963fc4a24fecf4f441c1f4a817222e

    SHA256

    2f92f495b62d364d289f80f1e5cf967688f90b600a195dd0233de2b5499e0367

    SHA512

    50a6304e67e57079e0aaff0187627d879c2a5461d65a38108e3f38b8f2a294fccf595a4efe3315557f809d24af15ebbb2697ae447959f69171a0dbe4c7ded349

  • /data/data/parseh.logo.two/databases/ir.tapsell.sdk.ads

    Filesize

    28KB

    MD5

    8cbf0aab03a83de7e58e0d8000d29a1c

    SHA1

    332de4d36047bfb8ced675434a1a98cb588939d3

    SHA256

    20dc2405ab9918a73558345f44ab67af359d9f26046ec219aa5b84711a5ad4ce

    SHA512

    d48e59d628c3e085185d9685ea5d8c2ecaf0b399ba4c075c36fd9c524ec0e670590bb8db7312bf464af355d98b09a319aa5453c1d0e4d6ca894c610375e923f7

  • /data/data/parseh.logo.two/databases/ir.tapsell.sdk.ads-journal

    Filesize

    512B

    MD5

    da1595c94f9d8f4e8c4faab60489bb93

    SHA1

    3b359952fcbf7d005634b2762e95b7087c96fd1f

    SHA256

    69a04ef71f5c8e9ad4cb8a03f4d94c62c29768f23d438c264a2402cc8aeaf1ea

    SHA512

    5e9eea888ac197c36b051736278a2e8bf1fbcc838872eb14a977cc4ba03e17d957cc2c9c6e9ef95bd60cd9acab51eb4bb61358005e194014c28ac8bb81de813a

  • /data/data/parseh.logo.two/databases/ir.tapsell.sdk.ads-journal

    Filesize

    8KB

    MD5

    783d792345d44c5e2381f5bf77a045ac

    SHA1

    f1b655be0afb6fc0e53756ad611a88974e7eccb0

    SHA256

    1735c47f8d20cf3b470b7406a6e4561f59a0889d0008dcb4f89c8491f6d99cdd

    SHA512

    a104a76ade3ea085d11c1f21df3b46c5ec5d1402fe5be0f21b9af6d33829c05574e1faa2436c218e4adf429e2d8120f967397a0843651702871815b74ace02de

  • /data/data/parseh.logo.two/databases/ir.tapsell.sdk.ads-journal

    Filesize

    8KB

    MD5

    5859d4e541517b5bf41ed3f6866ea588

    SHA1

    dde2b03ffe3d7653552392e002bf9cf19177adf9

    SHA256

    4822e32a744e0b241ae372df21349a625a5f20e65cda24515bf42a41e2747599

    SHA512

    996276ec701dbb727802e56bde572916288a7c0016c3af095f9f9ab80ba9d0d0d4d7e68709950270876f2cdd9e2ccc0e312cbdc2849b0a2d727294ac117a9d48

  • /data/data/parseh.logo.two/databases/ir.tapsell.sdk.ads-journal

    Filesize

    12KB

    MD5

    388b76f72f587c790c0156ce77a5e9db

    SHA1

    64d1c0e04147211a3930db6b3387abd2c030f5c5

    SHA256

    e883fdd0731118d9ddbf58a3116e07bc1a2a8c580c9c5accf9a2af419986181f

    SHA512

    46ba28310df2ffbeb0af80245faaf20a34904e4dfe6971aa63714b5979a42bc3b1b95f5a630bd1f160ec9ac7b5e50b975e0888cc65a18538a382e671886460e4

  • /data/data/parseh.logo.two/databases/ir.tapsell.sdk.ads-journal

    Filesize

    12KB

    MD5

    fa4e27d3afa558dd66dcc072303a361f

    SHA1

    4252b5720333ce0904c834e9e32636f79550a893

    SHA256

    a86627aa62edfcd7f5cd4a21518b943bae009fcdcb1d85ef7675a371ee03733c

    SHA512

    fc1c31c22f7416a0f46025252e4e310a403ae5eb9e7ab95924c88c7212c87a61c91e169ec86781e748aa17c55bc6644f50db2f59a9e33be68b9582228ca23536

  • /data/data/parseh.logo.two/databases/tap.db

    Filesize

    44KB

    MD5

    694d8539801603790854368111160611

    SHA1

    530600b332e6e7127c1df6992dba147194ac0dd0

    SHA256

    aa073e1227c040f8ffe9cd3ec6bd17f89e115906c6b051443ccc694981dead93

    SHA512

    1d45b89b30da4565653a2ca3a6fd08f52bda1e0ebd9f9b8e1120d71b166a467b14e9e854e400fd4b8ca44519d82c71a01f58c6360033a12724712a2a71d7a2ef

  • /data/data/parseh.logo.two/databases/tap.db-journal

    Filesize

    512B

    MD5

    c7a723e92ee430f7609cd8608d8098d3

    SHA1

    dd1ece5e884c4a2a7db62eb4c6925609667d23e8

    SHA256

    1e1ebcafd9b75be0efb232d273318299f83a85c5df6b770368c4e66c7493f8e0

    SHA512

    6b50454e441b056fcbd09d4c32f313d791c5def92be5bad72f1f6f6b907cf7677e7852d3dd54e4d73fb342604be0801083e0611b1e5606ec1ae609bdccb02b34

  • /data/data/parseh.logo.two/databases/tap.db-journal

    Filesize

    8KB

    MD5

    f2cd865fb854b6fb5c72290bc9badcd9

    SHA1

    4d41231b13a513e092788356a9e987e7febbb999

    SHA256

    cc43062c0efbc330ed6a88b1a4fa7603dfaa976660e9e2d1099946fa543010e2

    SHA512

    1c5511c2e6f533547fcab56fe834af655c2ff7848233420d5746acc258ea37d499a1f4b1f092fda5fbc2be1d64294a034062190a73c4524cbef134bc0075be14

  • /data/data/parseh.logo.two/databases/tap.db-journal

    Filesize

    8KB

    MD5

    b62fdd4a34a8e92282fe79444f56de38

    SHA1

    1d72dc02cfe2efd6246f335f9305b632997aa3c8

    SHA256

    091cb35bfde32a53918aee0482b44b0a69900d2e92e74a379f0deea137c2d578

    SHA512

    f5bf036af874bb7e480f3a9f5d8667c65591a84931f8e00c6ec46771c013a9c6f59911a11a169116aef3a6e33129d2a22d31c1177940b2dec5b9b25ab3bbb7ed

  • /data/data/parseh.logo.two/databases/tap.db-journal

    Filesize

    12KB

    MD5

    27f887e5717d8940649f5e198410398d

    SHA1

    92ba62f54384307ecdd307b2808150f716f28fba

    SHA256

    e3ec1def51679872b377df00dacd8f997f31570b6099c39e2d55dfc58ee70f9f

    SHA512

    a10badc380376b3f11a9af23568902b646d19d31ed63d527575149e2f0946da4a157704f2096952362682165f4d76f9f19d05d468fb6cd7fb68bd8c491b5ba31

  • /data/data/parseh.logo.two/files/fonts/bkoodb.ttf

    Filesize

    3KB

    MD5

    42ed81df7776b8b0ce4272a0928a2565

    SHA1

    51d7d6847c17547d17f5e658341022f0c1566ca8

    SHA256

    25d3f3d41f695978a1920935a09c2839ea1cc221191aab12dbb03560156a72a4

    SHA512

    76a9bf954af4cf14e909ead307ff46bd978b01bc25aa7b30a565cf7128b55166c8381e5cabf05705d271dbf8301e2f6834cf4dc3285dc2d17a05ba76da3ea33c

  • /data/data/parseh.logo.two/files/unsent_requests

    Filesize

    58B

    MD5

    0d210bfb2a0e1f1b4c082a6a0f79de07

    SHA1

    bb8ed9e364db79d1d9f2fcde3f15091893222faa

    SHA256

    988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d

    SHA512

    536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1