cedcd5f0a48630680b99dc6fec61062125d8b46dc7f1f29c4df4c2dd6ecacc4c

Analysis

max time kernel
69s
max time network
178s
platform
android_x64
resource
android-x64-arm64-20240514-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
submitted
18/05/2024, 09:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
53f80cedf90dac4e1329a6d0fa64c21b_JaffaCakes118.apk
Size 5.1MB
Sample240518-k12sbsch8z
SHA256 cedcd5f0a48630680b99dc6fec61062125d8b46dc7f1f29c4df4c2dd6ecacc4c
MD5 53f80cedf90dac4e1329a6d0fa64c21b
SHA1 218d5686f86e80d95877a23b13580415aa04d33a
SHA512 ea4c2154def808ecd24ecdad352bce2cd6a514c15490260e9a19548f502320c42e66530be761f961a12b1556191c7043a924a9c69b0dc6e5f1ed514471daa4ad
SSDEEP 98304:vkNifA0BrQPQyPJud6OnO3fyzJPUvBvTBRPI0+T3naG0gYOPPaRNWHx:vkNidCM4Oefv5I3L0ZOaRY
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection credential_access discovery evasion impact

Malware Config

Signatures

Requests cell location 1 TTPs 2 IoCs

Uses Android APIs to to get current cell information.

collection discovery

Location Tracking

T1430

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getAllCellInfo	com.orange.org_player_new_alone151809gg
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.orange.org_player_new_alone151809gg

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.orange.org_player_new_alone151809gg

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.orange.org_player_new_alone151809gg

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.orange.org_player_new_alone151809gg

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.orange.org_player_new_alone151809gg

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.orange.org_player_new_alone151809gg

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.orange.org_player_new_alone151809gg

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.orange.org_player_new_alone151809gg

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.orange.org_player_new_alone151809gg

com.orange.org_player_new_alone151809gg
1⤵
- Requests cell location
- Checks CPU information
- Checks memory information
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries the mobile country code (MCC)
- Checks if the internet connection is available
- Listens for changes in the sensor environment (might be used to detect emulation)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4606

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

User Evasion

T1628.002

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Location Tracking

T1430

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

TDtcagent.db

Path /data/user/0/com.orange.org_player_new_alone151809gg/files/TDtcagent.db
Size 20KB
SHA256 5b1df908a64a20e70b719aa4af181b7ddfd57f5949faf5eb095f845e4ad0ffc7
MD5 0b6ce54f1cd1270a4f5d174cc50294d5
SHA1 b978dc6233fd38e61993989e06820701346d7287
SHA512 afd471f92b380b3259d054893a4cd43a7f11d7e7245ce3c6aad083e2b6364fccf4071aab2333b059b1dc4e16b9b8e72a3de033a0a783ae40a3fc33eee975a124
SSDEEP 24:TLT3nxeb0TDHYB0ECWYqlBl8Uxz/gpEGSP/LzzVAQ0:T3xeYTDHY8qlBaUd/gpTSP/TVAQ0
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db

Path /data/user/0/com.orange.org_player_new_alone151809gg/files/TDtcagent.db
Size 28KB
SHA256 2acd372ff768d7d3e735c55cc66668c778a2b78b740a0f2a1864b09816768f26
MD5 b901db642fbd0a66c5402ba83318b920
SHA1 9649739272921b0bbf16b8819ffabc79bbb78c48
SHA512 1b8715ca3426314ac37aa3f9d5cb614b72c0e19eafbae734ba5e40d31e938cb445e112dac13327c1b66a16a09058d22ad5b2ef10c3d3afa9a628244d0391a12a
SSDEEP 24:TL6S3nxeb0TDHYB0ECWYqlBl8Uxz/gpEGSP/o2AYR:T2SxeYTDHY8qlBaUd/gpTSP/MK
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db

Path /data/user/0/com.orange.org_player_new_alone151809gg/files/TDtcagent.db
Size 32KB
SHA256 978e10b07e91ca29ede5c387dfd9e501a19cc5a02675196d716962e7697de695
MD5 f382a52cf8568b9cf2673ed5ef041014
SHA1 c507f0a1052262ad5eb828b64190bd0422cfd76d
SHA512 d3c06ea93abc8226595452003d40d66b74697a921c74c87f5a0e22f31f27e842a85f9572d8a372549154feb6b564dedb516443faf02f6ea025db9aee5455fabe
SSDEEP 24:TLD3nxeb0TDHYB0ECWYqlBl8Uxz/gpEGSZGQQQ:THxeYTDHY8qlBaUd/gpTS
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db-journal

Path /data/user/0/com.orange.org_player_new_alone151809gg/files/TDtcagent.db-journal
Size 512B
SHA256 601e8510e683d492face5201d8357b537d105b6a7525c259c8067fc6bc12f46b
MD5 c288a6ec663bb794b35325281b41e8ca
SHA1 8765f30cd502d84cd29d00b7f24897756cb9a6bf
SHA512 2c5902eaffe1007a47d32be2848e40657f458c302760b0e7ec005576896c8a646792c499363b1269da504f9102bf91b0f55a9af03027d6314ad783a3c77ee5a7
MD5 SHA1 SHA512

Submit Download

TDtcagent.db-journal

Path /data/user/0/com.orange.org_player_new_alone151809gg/files/TDtcagent.db-journal
Size 8KB
SHA256 519a49001a8467fb61950f245cce12a8237a397314b9cde5d1709a4cee2bd169
MD5 17bdfbd26da9857f701a7ecfecd9a900
SHA1 7b608653b1a9f3cc46b4bdf5a19a47188afe01b8
SHA512 33281e583140ef72f3f7927bb4c35c1548ee9f3609fb2dbc7bd9de369b6658e6092c7c96905b45b3f60b120f121896b1355e4764ae3b3431402dc43a959b5e4f
SSDEEP 6:7+/l91gn1dng9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKC:7+tTAnqLiuWdYRmBEyPbx
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db-journal

Path /data/user/0/com.orange.org_player_new_alone151809gg/files/TDtcagent.db-journal
Size 4KB
SHA256 40419e0f7f5271a8ffb31ae8dfd3e92d30b254d5d24f9bbd2d6495434856cae0
MD5 873c6174101404aebb795dec0e6d001b
SHA1 5afa5c54d2c503d6dd790320244c6f35a43f7e40
SHA512 374d600cda5d91e0a4f77810a8024171a66cb730868d411389c60acda13ece0a71b396d49f0545a67b83e89f86e89c33baa20d295516be737f965a5be1444a8b
SSDEEP 6:7+/lbC/0FPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKK:7+tbC/0BqLJdeWRmBEyPbZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db-journal

Path /data/user/0/com.orange.org_player_new_alone151809gg/files/TDtcagent.db-journal
Size 8KB
SHA256 830647edf9b94307c361874160d392b5de63876184114e6f24cc0d0cd9ef959d
MD5 10f766e4d7e81b7837fed17b7f064201
SHA1 6d41b4bb0d4d9e0962d2dec7e27d1d5489645323
SHA512 8253f00cea0c4bf0131c08699d8059862365118e08db7b785b751606dd878808bddc3b5749188087fd38a544aeec0f2539abc01be5fa4149d697ef01a77f19cc
SSDEEP 6:7+/l9lPg9bNFlqhrb/kPlOERX4PBX4ogLugMBX4suuKW/G:7+tjqLmORmBEyPbtG
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db-journal

Path /data/user/0/com.orange.org_player_new_alone151809gg/files/TDtcagent.db-journal
Size 8KB
SHA256 9d88d36ce581fc2382884a14ff6542b91cabe5d4f1c25b8d3d6b6ba3d4e0f4a3
MD5 4e0c0a7eac0a9007fe0b5b53aca90a1a
SHA1 a67ea7e6e6205d446134464c848b5c13683d97bc
SHA512 a78bcabd8085ffea27dd39e62ef6d244d97b2414984e3c7db38af4ec74c08c956ef7cb4aaaffee9b0f228a03764aca42c620e3a1afec91486d52209d4f735c83
SSDEEP 12:7+tPinqLyT9QyNTSFby/8UxF9/gpvRmBEyPb3j:7+tPGqLyT7l8Uxz/gpEGST
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db-journal

Path /data/user/0/com.orange.org_player_new_alone151809gg/files/TDtcagent.db-journal
Size 12KB
SHA256 d253fd42e5b8e6932672357977cf02b0f0cee18f82686192ca5baf21e9b759e0
MD5 da198c262a0f188c9ebd80b07712a145
SHA1 704224db2609085eca3f9d27ceed88e61aabd75f
SHA512 1086f78beb1925004eea51b5b806b8dc65f6c12c2cdcbe0af9eb9354afc100c013c215c3e5d3695133cfb7faa3998f03d3d0bd531fbd1b18de18393b70f42349
SSDEEP 24:7+tJYqLT3nxeb0TDHYB0ECWYqlBl8Uxz/gpEGSa:7MSq3xeYTDHY8qlBaUd/gpTSa
MD5 SHA1 SHA512 SSDEEP

Submit Download

.tcookieid

Path /storage/emulated/0/.tcookieid
Size 33B
SHA256 e58d7f65a021805af2aa80e3244a4ef8a3c07d029ec2f39c3bd59ee0b640b4ec
MD5 eb5ba563cd022fa68e5012586e15eb86
SHA1 a4bdb5e58afba484db0dfa47f8a88c18b7386a34
SHA512 1c4034faa721a82941fbe41117e7e043dc77c2ee87561ed64d9bf6a8d1f9308e2153863f6d3ce9adb8faa888cf21bff5a93877c1660f679d24cefecd59943725
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads