f2267bb20cffa33272190befde6ecfafde38abcf007fd019ff03def2e96537e7

Analysis

max time kernel
29s
max time network
178s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
18/05/2024, 11:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5496837b865fb8138de694047ed63e0a_JaffaCakes118.apk
Size 3.0MB
Sample240518-n3wwmsac92
SHA256 f2267bb20cffa33272190befde6ecfafde38abcf007fd019ff03def2e96537e7
MD5 5496837b865fb8138de694047ed63e0a
SHA1 29aa75ff36e5f58f64ae16456e6ff73f41b00560
SHA512 c69e3732c307b3bf2b50f17299915418a84dd2b3e80cfef2ed9ecb41a6cca8afde707cc6d4e131c476e184a44b00c0e490b78f7566aa19d2b417a2f4f2cb73dc
SSDEEP 98304:Njr/k5e6y9bHrVHrwdI3XnbDMwl5GGDY8ffzxUcL3dqR:qKNed6Xn9VDVfltE
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection credential_access discovery evasion execution impact persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.ashpazi.asan.shahr.zhele

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.ashpazi.asan.shahr.zhele

Checks the application is allowed to request package installs through the package installer 1 TTPs 1 IoCs

Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).

evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.canRequestPackageInstalls	com.ashpazi.asan.shahr.zhele

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.ashpazi.asan.shahr.zhele

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.ashpazi.asan.shahr.zhele

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.ashpazi.asan.shahr.zhele

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.ashpazi.asan.shahr.zhele

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.ashpazi.asan.shahr.zhele

com.ashpazi.asan.shahr.zhele
1⤵
- Checks CPU information
- Checks memory information
- Checks the application is allowed to request package installs through the package installer
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Schedules tasks to execute at a specified time
PID:5134

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1632

Code Signing Policy Modification

T1632.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

__pushe_base_lib_db

Path /data/data/com.ashpazi.asan.shahr.zhele/databases/__pushe_base_lib_db
Size 24KB
SHA256 892958befd21339455cfb94177b0144bd916008d6ce0ba43091ad1efeea17740
MD5 526d13dd54e8e4475f018607d92c5554
SHA1 2156d660ccec059cf0ce52a12e8b7249ac52b120
SHA512 9ee5a69e944d9d0eb7b64cfb3f02e7dde1791b447394e48a85dbd1b3146f6ae6362eb70dceebccf1fcea1098ae96d07ecca0fbb7260caca8ebb5d6d75d37a60e
SSDEEP 24:TLoxSe7TlcK///IoVM9cREGSzFAOI8BNrOICfNARqFH4eK+7aOIQl8L79IJ+SP8U:TsxfHX9VM9USBAIB9ufaEKgR8LEtUvM
MD5 SHA1 SHA512 SSDEEP

Submit Download

__pushe_base_lib_db-journal

Path /data/data/com.ashpazi.asan.shahr.zhele/databases/__pushe_base_lib_db-journal
Size 8KB
SHA256 a488beee118ae1fea7b4a4d51f08f3f6eca8df91c028f101ec8b3b914a1cc5d4
MD5 bb2971b6f84ac787ac2f2dcd759ccdd8
SHA1 f74a94e601dec1dd16778a05de11a3c1e6cbaedf
SHA512 7157981184e880349d54f265151e107f1ca65280f6f2807f88f78fb6c6109b1bd3eedf5c1c94dbc1401dadf03a8a149bdca636baff9fafa72b458f1785620cc5
SSDEEP 6:7+/l9v4Pg9bNFlLdrlOERX4PBX4ogLugMBX4suuK0PM/N:7+tOqLJdTRmBEyPbGN
MD5 SHA1 SHA512 SSDEEP

Submit Download

__pushe_base_lib_db-journal

Path /data/data/com.ashpazi.asan.shahr.zhele/databases/__pushe_base_lib_db-journal
Size 8KB
SHA256 ddc7f34e6d67cafb26eeabf6f4bfaab8cc82bf1704e04782100abc6dc61c96e5
MD5 aa9a3c4acd51e6fdd25667f8401e8e2d
SHA1 28cc1f905d6438a93e8df51c879661d2d6ef8374
SHA512 a2760ed1ade604bfb9d31c062330272437ea0649d8aafdbd9ef442a9319cf36188cfe340cd91a1fe5728f132ced32afbe746f2f3a7e2a182754e8b7f4b79086d
SSDEEP 12:7+tVlpqLXyFormG4NK0COnHdOnHXy1TOnHyilc36/QN6/uJaEcZVMJwRPVz27VNu:7+tPpqLbxSe7TlcK///IoVM9cREGSI
MD5 SHA1 SHA512 SSDEEP

Submit Download

__pushe_base_lib_db-journal

Path /data/data/com.ashpazi.asan.shahr.zhele/databases/__pushe_base_lib_db-journal
Size 8KB
SHA256 b299df1cad41ac3157a62b1d44cc715957ce625ad8bae03411cbc708975c1591
MD5 7e840dbd8a1e1315547aab319763a5fc
SHA1 80d72b86ed495eb0b5a5b9113d41c3dceb08c1e3
SHA512 02a9a675fd4b0b3d9684bb292ab5d1317fb49e00383a2d9668a64420462aeaaa8e3b4d1496d74068a88e19def41502668cf6c2ed0c7f75e8c3150b7f982660bf
SSDEEP 12:7+tb7Z2vqLO00FormG4NK0COnHdOnHXy1TOnHyilc36/QN6/uJaEcZVMJwRPVz2o:7+tPIvqLhFxSe7TlcK///IoVM9cREGSi
MD5 SHA1 SHA512 SSDEEP

Submit Download

__pushe_base_lib_db-journal

Path /data/data/com.ashpazi.asan.shahr.zhele/databases/__pushe_base_lib_db-journal
Size 24KB
SHA256 413acf8a3364b14575714b73c2c25dcee16c06949c060dcc66dbdb67b1b3fe93
MD5 c1508343ca42bea995e75b42b57fe5c5
SHA1 5acd32b57644441bd49a7ac3c6c6d3a29eeca766
SHA512 17ec954f4bd57d30fac40b0b13ee725aa913a9155f78070bb8e2f1d9c4509af25d3ff8366779b5619578332556e48ff44d0e6f452d4e700bbf7e72f7d21d667c
SSDEEP 24:7+teLIQl8L79IJ+SP8K2HMqI0IZqL4xSe7TlcK///IoVM9cREGSd0bz:7Mez8LEtUvKq8xfHX9VM9USw
MD5 SHA1 SHA512 SSDEEP

Submit Download

__pushe_base_lib_db-journal

Path /data/data/com.ashpazi.asan.shahr.zhele/databases/__pushe_base_lib_db-journal
Size 512B
SHA256 a83441f1258af562cc6e6064df3c1b0d94e6e730cd8be5ff0f2c2cb2a29f9b00
MD5 9d2177adbe76c72f3bbc4f9dc0bfb7cd
SHA1 209d8c28173327e095f0a73a17cbe6b973d6909b
SHA512 612c92d7b64308ea7c1b68e5dd170f9283ba7b08be22035264babdcff6cd091ec629af404572924de03120ac0f2de3e37274bce54e86325c53a60d3b75a8fc06
MD5 SHA1 SHA512

Submit Download

__pushe_base_lib_db-journal

Path /data/data/com.ashpazi.asan.shahr.zhele/databases/__pushe_base_lib_db-journal
Size 8KB
SHA256 435d59aa44f70d5d14646dfa79f7c3b346e158b3887847ac56893ce9fe169395
MD5 e4be5c1bf27561a72028585941d24e2e
SHA1 1db2b672191db63ae84b760952789f4005593e0e
SHA512 36ea66d05cd99a237fbb7cf579d82a1165f7441bfb8abf6c3f99caaf201aa8cd802beffc29a3dbd08676a56f4aea0d989c14fbcb3c96bb15d69e2627eb0afde3
SSDEEP 6:7+/l9an1lvg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKy:7+tIqLiuWdwRmBEyPbx
MD5 SHA1 SHA512 SSDEEP

Submit Download

evernote_jobs.db

Path /data/data/com.ashpazi.asan.shahr.zhele/databases/evernote_jobs.db
Size 16KB
SHA256 8619813c31c6f241f35ad72897dc1821caf025fa37bbe670883447b071658e35
MD5 7c6ced5ec1b0c5542e47ba4e351096f9
SHA1 13fb7ac85f290b8dc79093116905c76be6c0ff32
SHA512 6f57e4ff965b1e9977c5b7b8b7778dfeed243fe64f68ceb7077223eaea5891617e1fe98e6f72b5e50d5730a854ca26fb615cec563ba6b57a550551b0a45d7967
SSDEEP 12:TLyuuEKqb0KkYrZASBMAB1G0d/P6dMboAGy3vAz9rxvW3deRmBEyPbBvOwQ7Ysvh:TLy50IKRvTZc+rGSNTsv0tjIROsXLus
MD5 SHA1 SHA512 SSDEEP

Submit Download

evernote_jobs.db-journal

Path /data/data/com.ashpazi.asan.shahr.zhele/databases/evernote_jobs.db-journal
Size 8KB
SHA256 3e683df97656744c67db8505ce1f6e1cdb383592b0aae3c22ef10cb57673b847
MD5 661abd7e141504cbdcf687e7a5dc2b9d
SHA1 986ac5ed3275108fd9d4bbcc079f79b93d6c9730
SHA512 6276aa1e6df99fc3f191ae2b323ff59b2dc8a28175b0002331f8c4d6df20fcaf77bdd2091fa0b50112bf0928f16db191c8f7aed7bd9ec66a53fedad26d2009d7
SSDEEP 12:7+tx5Yv3qL8u2rqb0KkYrZASBMAB1G0d/P6dMboAGy3vAz9rxvW3deRmBEyPbF:7+txCv3qLX2WIKRvTZc+rGSF
MD5 SHA1 SHA512 SSDEEP

Submit Download

evernote_jobs.db-journal

Path /data/data/com.ashpazi.asan.shahr.zhele/databases/evernote_jobs.db-journal
Size 8KB
SHA256 19b31ae6aca106a52a8d92746cfaecf3e86b62cd1c46b7b72aebbb9833303393
MD5 9b3fb7821a183dc157d8df76c51cb64a
SHA1 0acbe1a354d1ff76f0ba422b03aa8f157003e59c
SHA512 f3115889b92f2aab5d6654d22c5ba56aa89db96da887ca24dfc36470145db7ebbf7c9a5d4236bd8c44ad4b79f9784b73b433e7227ee2886a35eda84a3243f2d4
SSDEEP 12:7+txKWmlnoIROsSUzc6RUmu8tqLAu6rqb0KkYrZASBMAB1G0d/P6dMboAGy3vAzQ:7+tx7jIROsXLuYqLDzIKRvTZc+rGSh
MD5 SHA1 SHA512 SSDEEP

Submit Download

evernote_jobs.db-journal

Path /data/data/com.ashpazi.asan.shahr.zhele/databases/evernote_jobs.db-journal
Size 512B
SHA256 2a9079b1b6baf4428bc59663b601080ac4d8b09c3588026761fd648f25d6136d
MD5 76c436a1533c6e269c0f40e43438211f
SHA1 a6fef34698b1dde79dbc6a7c7d5f2b76ff449946
SHA512 301afd3dc8b459590ce82053c520008b45a468a89da0c23b03b2ef03af935254cd9429b2a73b09e132d502c4007a44a4515a706b47358fbe90846d683837775d
MD5 SHA1 SHA512

Submit Download

evernote_jobs.db-journal

Path /data/data/com.ashpazi.asan.shahr.zhele/databases/evernote_jobs.db-journal
Size 8KB
SHA256 4035d7204cd4e7532f3d585fb70fe53bda5f0c1f2575d8e00f999e86cb89177e
MD5 211a0293942e9a8221ea62a9122ad767
SHA1 e24b979599f6d4ccfed7b88abc90b51838365507
SHA512 b7314954b1cf030417918fd0c63123f437d19548b5cca11fcb270a47698c78bf6daa6f1d4ccd08022b68ca366667caf0b9476a4bb7d9fe279ad8a0421a5b7f74
SSDEEP 6:7+/l97llSFn1Lng9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKsp:7+ttl0/qLiuWdwRmBEyPbH
MD5 SHA1 SHA512 SSDEEP

Submit Download

evernote_jobs.db-journal

Path /data/data/com.ashpazi.asan.shahr.zhele/databases/evernote_jobs.db-journal
Size 8KB
SHA256 d1be453372373cd2a36306528b646a3cd54cefdfcee9c7e55ae1724fee8885d1
MD5 293b37374cbd09175d8bcf7f8eb5d6e7
SHA1 cdbde8b24d9515e1248931562c23effcaaf70c8b
SHA512 f48d927d11c7f2e964aea90f84a6a11702d7ff7e2833dbdd19f4840e0964da96aab2586589144c00a8b4f62975fa2278bcfb36a9cd053c97ce0c9a8761fb05f5
SSDEEP 6:7+/l9OHPg9bNFlLdrlOERX4PBX4ogLugMBX4suuK0s//1:7+tEvqLJdTRmBEyPbS1
MD5 SHA1 SHA512 SSDEEP

Submit Download

evernote_jobs.db-journal

Path /data/data/com.ashpazi.asan.shahr.zhele/databases/evernote_jobs.db-journal
Size 8KB
SHA256 9b6dc26e7ea85b5febcab88a8012d371ef38a21364cca940be876ddc39a6e44b
MD5 a8a4c749cd0581a30b5ffa09ce3f379d
SHA1 1bba8e40c7621f923c5b43a5b293a98047203697
SHA512 8a6d25f6a3efb299a0edb0cf4034b0c18c3ec635bdfe51113e4650596ca0bb2c77b35c9235cb9b84fb885d6f34fb9af3ddc88e39a928e36a038ecef594fe5679
SSDEEP 12:7+tlTyqLpujqb0KkYrZASBMAB1G0d/P6dMboAGy3vAz9rxvW3deRmBEyPbe:7+tlGqLA+IKRvTZc+rGSe
MD5 SHA1 SHA512 SSDEEP

Submit Download

projectdb

Path /data/data/com.ashpazi.asan.shahr.zhele/databases/projectdb
Size 640KB
SHA256 c6770d6175598b8955d1bef2965a3b00dbd73aead40d3d44cf8617fb630f7f87
MD5 ff3b6b9dad15cbe6d71261e5554d3d2d
SHA1 edd56b5750f55b69f62338e9f36c679b725bad0d
SHA512 a3d09aa2c977e8842f40f14d99bf9f0b506e2c7e73989f3710eb3849164b0815a8bc9f5041f98810dabb968d506d7b3357bc220b695ec92e6bbf396df1bdbbb9
SSDEEP 1536:n8eITXdDsw1wfJ1vzvKtX51ZCOOoZT/HaB5B+UvZcnW7PQs5oYxhA3o1QFae+Pj2:8jtOd/TZzNjtL
MD5 SHA1 SHA512 SSDEEP

Submit Download

projectdb-journal

Path /data/data/com.ashpazi.asan.shahr.zhele/databases/projectdb-journal
Size 512B
SHA256 15963a30f933eca6e7d39544bf33e3596fc95ea6e3ab3400a1927e46ded72a9e
MD5 becec1ca1112e9c1aadf35876d342222
SHA1 c7b6b0cf31d292d306eafc556ff6469aa70928ec
SHA512 18e4001ee38df2d81cffe903e96fa33eac8bd7f2be9835f520b2d3518673a8a7ff559a3243eb542f6814bd30c99217217ff0c97e9dd2cd6f7bd048b80701c2ec
MD5 SHA1 SHA512

Submit Download

projectdb-journal

Path /data/data/com.ashpazi.asan.shahr.zhele/databases/projectdb-journal
Size 8KB
SHA256 82d79ae62c346c3b58bb00a0d96606caa8d487ebfd0348be22464619bf4cb5d3
MD5 66cf75753f439b810e694956f73b87f4
SHA1 4f84f23d2ec316d1afb52732717963eb4b651c2d
SHA512 e88ada4811881851da0bcf83808e4ab2e9738b90ade67bf4ded7c89cc59ab3c5c48c2d423b4b09010b3b25660cecf05feda846871fa368f3bfb5fe6d6eed1ad4
SSDEEP 6:7+/l9xOn1pRg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKU:7+tgqLiuWdwRmBEyPbL
MD5 SHA1 SHA512 SSDEEP

Submit Download

projectdb-journal

Path /data/data/com.ashpazi.asan.shahr.zhele/databases/projectdb-journal
Size 8KB
SHA256 386cefa1536cfcf72cec73c02dcd7fa3fe3506fff36e06295f1eb3753e114f3a
MD5 70258df3f24ca9fbed444f3217bdb51e
SHA1 b9dd23b76594c936bef12fee56c4f210ca6c5bff
SHA512 b18a3cbd1ac49ab117b8d23cf74b89eaabea3b45d87c0423be998a7d6cdf7de3120e10ce06691e090070df43efa7d880bd6e9618932790f0fa80d552ba4f1e1d
SSDEEP 6:7+/l9uFPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKPl//x:7+tABqLJdTRmBEyPb+Xx
MD5 SHA1 SHA512 SSDEEP

Submit Download

unsent_requests

Path /data/data/com.ashpazi.asan.shahr.zhele/files/unsent_requests
Size 58B
SHA256 988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
MD5 0d210bfb2a0e1f1b4c082a6a0f79de07
SHA1 bb8ed9e364db79d1d9f2fcde3f15091893222faa
SHA512 536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads