61970069c6ee613bac07b5dc712b8942ca1d56103a974f728f217720b453345d

Analysis

max time kernel
7s
max time network
130s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
17/05/2024, 18:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

50c6bd16143cfbd887c8417c5dee71a4_JaffaCakes118.apk
Size

21.4MB
MD5

50c6bd16143cfbd887c8417c5dee71a4
SHA1

4a50ab3b32103572935afd038bfcd8ed12518d82
SHA256

61970069c6ee613bac07b5dc712b8942ca1d56103a974f728f217720b453345d
SHA512

1e3bc59669575dddf7f06169286feb1e0ccee59b37003fb90034852eb803e71053ba83f7231eb6a45e69bbe4ac66757adddc4553d70981e0dee9d88b158df520
SSDEEP

393216:jSU7OEAGRnFUNbzOxPcGpWtzcQ0x+uuzVL3RhhW2ojcMA7+q1xzu:rdd56NAcGpUzCx+uOvQgMA7h1xzu

Score

8^/10

discovery evasion impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.pikpok.rua2

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.pikpok.rua2

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.pikpok.rua2

com.pikpok.rua2
1⤵
- Checks if the Android device is rooted.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4306

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact