f2267bb20cffa33272190befde6ecfafde38abcf007fd019ff03def2e96537e7

Analysis

max time kernel
143s
max time network
189s
platform
android_x64
resource
android-x64-arm64-20240514-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
submitted
18/05/2024, 11:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5496837b865fb8138de694047ed63e0a_JaffaCakes118.apk
Size 3.0MB
Sample240518-n3wwmsac92
SHA256 f2267bb20cffa33272190befde6ecfafde38abcf007fd019ff03def2e96537e7
MD5 5496837b865fb8138de694047ed63e0a
SHA1 29aa75ff36e5f58f64ae16456e6ff73f41b00560
SHA512 c69e3732c307b3bf2b50f17299915418a84dd2b3e80cfef2ed9ecb41a6cca8afde707cc6d4e131c476e184a44b00c0e490b78f7566aa19d2b417a2f4f2cb73dc
SSDEEP 98304:Njr/k5e6y9bHrVHrwdI3XnbDMwl5GGDY8ffzxUcL3dqR:qKNed6Xn9VDVfltE
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection credential_access discovery evasion execution impact persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.ashpazi.asan.shahr.zhele

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.ashpazi.asan.shahr.zhele

Checks the application is allowed to request package installs through the package installer 1 TTPs 1 IoCs

Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).

evasion

Code Signing Policy Modification

T1632.001

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.canRequestPackageInstalls	com.ashpazi.asan.shahr.zhele

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.ashpazi.asan.shahr.zhele

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.ashpazi.asan.shahr.zhele

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests cell location 1 TTPs 1 IoCs

Uses Android APIs to to get current cell information.

collection discovery

Location Tracking

T1430

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getAllCellInfo	com.ashpazi.asan.shahr.zhele

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.ashpazi.asan.shahr.zhele

com.ashpazi.asan.shahr.zhele
1⤵
- Checks CPU information
- Checks memory information
- Checks the application is allowed to request package installs through the package installer
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Requests cell location
- Schedules tasks to execute at a specified time
PID:4510

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1632

Code Signing Policy Modification

T1632.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Location Tracking

T1430

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Clipboard Data

T1414

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

projectdb

Path /data/data/com.ashpazi.asan.shahr.zhele/databases/projectdb
Size 640KB
SHA256 c6770d6175598b8955d1bef2965a3b00dbd73aead40d3d44cf8617fb630f7f87
MD5 ff3b6b9dad15cbe6d71261e5554d3d2d
SHA1 edd56b5750f55b69f62338e9f36c679b725bad0d
SHA512 a3d09aa2c977e8842f40f14d99bf9f0b506e2c7e73989f3710eb3849164b0815a8bc9f5041f98810dabb968d506d7b3357bc220b695ec92e6bbf396df1bdbbb9
SSDEEP 1536:n8eITXdDsw1wfJ1vzvKtX51ZCOOoZT/HaB5B+UvZcnW7PQs5oYxhA3o1QFae+Pj2:8jtOd/TZzNjtL
MD5 SHA1 SHA512 SSDEEP

Submit Download

__pushe_base_lib_db

Path /data/user/0/com.ashpazi.asan.shahr.zhele/databases/__pushe_base_lib_db
Size 24KB
SHA256 70d672bbfcfc7ca0616c6bbc47fecdb84804acf91400bb6881e393d65fb203a4
MD5 f19b37e6658c84dcc3010f89952c803d
SHA1 a7fc51e84b7628093818eb0a93bafdf387a77d67
SHA512 38e80133152dc40c7726543a0ce39a1630a7cba9d1c7fb82dd1260edc36408082adf85b7317f98aa025c7d0d3f0f07bfef7b284d6c7a21ecc575870f3e373165
SSDEEP 48:TxxfHX9VM9US2vLw8L3qUDU2JKmqHB6axFTJ7DvLl8LO:jHXbk16w8OUL6hlftLl8C
MD5 SHA1 SHA512 SSDEEP

Submit Download

__pushe_base_lib_db-journal

Path /data/user/0/com.ashpazi.asan.shahr.zhele/databases/__pushe_base_lib_db-journal
Size 8KB
SHA256 7ac902d52bfb798c67bdd1a995279ca16aa7c0f2c58949c0f823643ce0791203
MD5 8d7be17d167952a88cebd8374aa263de
SHA1 073dadc308518c8009b9d8fa00b501195a16955c
SHA512 c3f9343f5326b0277b54e46eba120eb2e4e1ac267821d57ae6c61ebf5dbad8a9cfb4468db25c7da3fa4a0765aa1738e53f45d7ea5fa33f49a6756275c50ad758
SSDEEP 6:7+/l9Q/mHPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuK8QM/I:7+te/4qLJdeWRmBEyPbWsI
MD5 SHA1 SHA512 SSDEEP

Submit Download

__pushe_base_lib_db-journal

Path /data/user/0/com.ashpazi.asan.shahr.zhele/databases/__pushe_base_lib_db-journal
Size 8KB
SHA256 a0c27963951d6c13f3551ce4a71f2e60b94c89e91771b5c683b239eb2b34b0aa
MD5 a9957e20d0b4784b871ab1029722e132
SHA1 02c6a1293363024166f14f00f2138071c1e58d2c
SHA512 5097b6374eafb3024525fabe895f8a1be3e8598215e7661b46af20e5130a1f0b25c8f3a5e11ef044ef28586a5ecd53afdd99af65501e920cca04e8a13c3b5d7c
SSDEEP 12:7+txHqLXKFormG4NK0COnHdOnHXy1TOnHyilc36/QN6/uJaEcZVMJwRPVz27VNgf:7+txHqLjxSe7TlcK///IoVM9cREGS6
MD5 SHA1 SHA512 SSDEEP

Submit Download

__pushe_base_lib_db-journal

Path /data/user/0/com.ashpazi.asan.shahr.zhele/databases/__pushe_base_lib_db-journal
Size 8KB
SHA256 fcb84aba943b9097079e82ccd0a81edd32f2a175c7c892fb6290dc5e602ffc88
MD5 b3c3af9a8b36e8bb5593f8956595a743
SHA1 47b06a2cef1c3c032661dd2ee3be34d6324b19d6
SHA512 4199e6fdd977d25416a4194230c988d7bc1b9f5e7714a252616b351aede97e656daa4b57196b7e23ab872def93650d38b6ddb724f18648ceb49de3282ea58259
SSDEEP 12:7+tghqLO1FormG4NK0COnHdOnHXy1TOnHyilc36/QN6/uJaEcZVMJwRPVz27VNgJ:7+tghqLTxSe7TlcK///IoVM9cREGSw
MD5 SHA1 SHA512 SSDEEP

Submit Download

__pushe_base_lib_db-journal

Path /data/user/0/com.ashpazi.asan.shahr.zhele/databases/__pushe_base_lib_db-journal
Size 24KB
SHA256 342a362cba3a359a4c04db84f2065dcf8e2056b018bfd6be530c6b9ae6a81383
MD5 f40d380cf1f1dc3b2518d56372e3fcfc
SHA1 8a08421bcfdc186349d34d1b0f65ce2e1ed7f3a4
SHA512 555740ad6f4d37ebac2ad05b55857270533003e958134427c83464c76ea17e110f76a570e3b407eb70754bc110ac0208b83ae2c72accb6b45f0e5dd0f2f43ad5
SSDEEP 48:7Mnj3vJ7DvLl8LyqhxfHX9VM9US/qHB6aI:7etLl8uuHXbk1ihlI
MD5 SHA1 SHA512 SSDEEP

Submit Download

__pushe_base_lib_db-journal

Path /data/user/0/com.ashpazi.asan.shahr.zhele/databases/__pushe_base_lib_db-journal
Size 512B
SHA256 f0a305b990d07b99f2208b197b75b1ae8ccd179e026c4fe4bf60dc2abe044991
MD5 42e60b68bf358c14d673c3bd4ab6ccb9
SHA1 4dc6d8522ad10adb81d22b5b063257c33b461dbf
SHA512 e20ce348bffef2b09c7663f5be1cb90b81dd00a885f9dafe2b2fc66434457a23bd7d4232962c6a947a13640799505fd6108a0d566d78c96f4ea46649e80ebcb5
MD5 SHA1 SHA512

Submit Download

__pushe_base_lib_db-journal

Path /data/user/0/com.ashpazi.asan.shahr.zhele/databases/__pushe_base_lib_db-journal
Size 8KB
SHA256 d4696db57cb46ea6fdef1785d1efeb8f9bc3838b80027aaa1cef5ef681abef58
MD5 ae0e7793b5431c6f33650bb5281958d3
SHA1 a4e466f8fc91fcff9785e7918e2977af064bf60d
SHA512 0edd3077a127c6003536919d798eec5cc97970b7f08c09254515e65ce6a14beb50eb44799f1f38107b2b51fd9518954a3994f092939dd4ecf63308247e13c344
SSDEEP 6:7+/l9p0Mn1CDg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKym:7+tABqLiuWdYRmBEyPbDm
MD5 SHA1 SHA512 SSDEEP

Submit Download

evernote_jobs.db

Path /data/user/0/com.ashpazi.asan.shahr.zhele/databases/evernote_jobs.db
Size 16KB
SHA256 e6fbe5aa54fb726c4a6775efa6485fce3a6192c383aa94d3368ae4282223ae9c
MD5 f04ae6c07f61a56c45832b46547ce2b8
SHA1 9c3e4bfa0f29fee0b23685dff60a418f017a265f
SHA512 23d24ae6d9627d5a87931a0ec3582ae328a3b11d4385ef8d7fd7eaa495c36c600a4a3363eb0b7f232009709639c3174125581943f6b0c67fcc5c5f2c2471c37b
SSDEEP 24:TLlJIKRvTZc+rGSNtJawg8ARs80sCGitROX:TJJNc+SSnJ/vARETGiuX
MD5 SHA1 SHA512 SSDEEP

Submit Download

evernote_jobs.db-journal

Path /data/user/0/com.ashpazi.asan.shahr.zhele/databases/evernote_jobs.db-journal
Size 8KB
SHA256 040bee061192936b55c5625176a93d4d876b78553d54d25761ffebdf7c5f09f4
MD5 7201a3275da6e0638fa9abb74a42b41f
SHA1 3c6c63fe7f52b0540786e9cfa1974dd92ea31449
SHA512 764573dbd228d94f8e8584d97ee12fd64ba714d700bfc7f156e95c03c4a2f635fd013811395addd4d2ed048820ec7e7288e4c431e7ed2c9771f28321dd30a406
SSDEEP 12:7+tR5YvuoqL8umqb0KkYrZASBMAB1G0d/P6dMboAGy3vAz9rxvW3deRmBEyPbT7:7+tRCvuoqLXPIKRvTZc+rGSX
MD5 SHA1 SHA512 SSDEEP

Submit Download

evernote_jobs.db-journal

Path /data/user/0/com.ashpazi.asan.shahr.zhele/databases/evernote_jobs.db-journal
Size 8KB
SHA256 97e05d994ff3ce5a8fdfed600efddc73adf4206095cae760bd61b39fdc5e98c9
MD5 7d34ec48dbcc50a0903b3cfa191914c8
SHA1 57c68ce688997b3e29ccb59954a2f05261ef0253
SHA512 705f9b583295b4693bf354eac57fc77dd769bb596e862c017a7af851b91eb80621ba8be7b55921dee56781c32981fc07fad7d7b8f17d72c2181bddb9f26c5ff4
SSDEEP 24:7+tJqawg8ARs80sCGitROX67buNqLWAIKRvTZc+rGSp:7MI/vARETGiuX62Nq6ANc+SSp
MD5 SHA1 SHA512 SSDEEP

Submit Download

evernote_jobs.db-journal

Path /data/user/0/com.ashpazi.asan.shahr.zhele/databases/evernote_jobs.db-journal
Size 512B
SHA256 5d125687aeb42d84c315ebc7fca004ef1c0bbedb90d4132a9831d73ee7e6062c
MD5 980b9035fb2b9c0389263216cba08d14
SHA1 84325cdc78271f379aa8f27fe79f5d09e52c2e1f
SHA512 7b0f5c7a42ed51de0183a5977db2de5a96db6304bcacdcada96bbf96c0cb2d4886ac5d355d8f9cfc17c1679c056eb258fb05b12a15c8f6b5988c40cfdd6c8150
MD5 SHA1 SHA512

Submit Download

evernote_jobs.db-journal

Path /data/user/0/com.ashpazi.asan.shahr.zhele/databases/evernote_jobs.db-journal
Size 8KB
SHA256 153da891ac49c7e6906da3a13d1018c59799c6f807405c6c86cf385c45bde78e
MD5 9d6baccadd2056c6c41a72d8aa68f464
SHA1 297133dddbab9cf1f077026eb75178aae9191014
SHA512 6809512528f0ea08a4dc1f149d3c49b9e054ce3852f7eb4a7e45feacad05ed9bb5bc70a024d51d0ef3c94f6f0ff54a6cbe49044cfdf242b7f837f128c53f8d5f
SSDEEP 6:7+/l9y8sl4n1K/g9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK5:7+t08OqLiuWdYRmBEyPbu
MD5 SHA1 SHA512 SSDEEP

Submit Download

evernote_jobs.db-journal

Path /data/user/0/com.ashpazi.asan.shahr.zhele/databases/evernote_jobs.db-journal
Size 8KB
SHA256 c499f3e49d28de04e7b16077637a0aa5ea3b66ad0f699b198320d1a457c9a0e3
MD5 286da1841e76581ab21a8b9f53c9d250
SHA1 c4355bad5f707fbe79d2e5f9979425bb6663c972
SHA512 7a9784061878507560e726abd483135456231a14a9e5e98580064a114e2cd2f9014f328ab9826090bba3a216e6ab84ef4390abd6dd99fdde4e0a099ad8bb55d6
SSDEEP 6:7+/l9hPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKe/Y9:7+tvqLJdeWRmBEyPbRY9
MD5 SHA1 SHA512 SSDEEP

Submit Download

evernote_jobs.db-journal

Path /data/user/0/com.ashpazi.asan.shahr.zhele/databases/evernote_jobs.db-journal
Size 8KB
SHA256 4cb3030763e036aed29d7efd106dbc1cee16d7412747bbe39888c3ac2643afc2
MD5 49771233499a1d7b100dddbbdee2685d
SHA1 cdbd2a0adcfd909546bdc1831a4e3c40a14c1856
SHA512 914edbff675e9ada7ab880e63b190d98e4a9ae09729738621f0d1af788fb19e1eed971103c0403bcfe3e37929bf8883bda0f38ee0885ab2c212a760d5ab82ec6
SSDEEP 12:7+tQD5qLpubqb0KkYrZASBMAB1G0d/P6dMboAGy3vAz9rxvW3deRmBEyPb3:7+tQD5qLAmIKRvTZc+rGS3
MD5 SHA1 SHA512 SSDEEP

Submit Download

projectdb

Path /data/user/0/com.ashpazi.asan.shahr.zhele/databases/projectdb
Size 16KB
SHA256 57c76c21c7fbf5e78fcc3768baea055d01f4002464edcf80858834067556746d
MD5 08b310822889c60a4c0bbf621572752f
SHA1 68e97389f2884fcf3d03f8923497cc490b7648a3
SHA512 22e9359a0c073cfda9d6c3708d47cf0a586e9fc065f989ae6ab71cbb3a54dde45751c15088ae43b74fbe014774f2eb123c057cd2426fd74ea1f2153cff2c6b43
SSDEEP 12:TLpEptcguFlrlyiBDPbN4gofhgKKERmBEyPbBvOw:TLktoAixzDo+K0GSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

projectdb-journal

Path /data/user/0/com.ashpazi.asan.shahr.zhele/databases/projectdb-journal
Size 512B
SHA256 8c40e614494bb364f311d05c2122bc069369f767bb3a1be43f68a2194d6c4ca8
MD5 73008bee8fa33e63316f54bd74f970d3
SHA1 9316a25c864a7822609d1526454712444b7a75cb
SHA512 dae9c961a603d938df390ddbf00d6c1e96c0a52e4986f7e89c37e1f3323477e2bb3b1fd8c7b36a75c01aed3f511f7357becd84d95ba16ee2c1579a01b347731a
MD5 SHA1 SHA512

Submit Download

projectdb-journal

Path /data/user/0/com.ashpazi.asan.shahr.zhele/databases/projectdb-journal
Size 8KB
SHA256 e1076a86d65fac08abda2ef5fa530b15d147d67042069b271c5dc6e39a11be8c
MD5 146eea6b2216398c486944339fd7ab14
SHA1 18e6d0ebdd1465c9799285a8067ae9b93b6bd14a
SHA512 99901e9835251c89e8b3e78514c9bc4ebe3660c9f838662fd5e878aee35c811d0bbeb52795ac1303f3563cad10ad27a365a12efe5e8fa516c07ffb02da7e964d
SSDEEP 6:7+/l9kTn19g9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKK:7+twqLiuWdYRmBEyPbd
MD5 SHA1 SHA512 SSDEEP

Submit Download

projectdb-journal

Path /data/user/0/com.ashpazi.asan.shahr.zhele/databases/projectdb-journal
Size 8KB
SHA256 57b9e52529db06493573124f5f0fea85518f7c5da9871212fe361af39d930df6
MD5 f41d766812f81f7e02ae66de3d1cdb9d
SHA1 5b8f25b5521a1700e8397cb2a0e6ad314ef277e6
SHA512 14c29495470cce0ec8f7084edf7baeee8b314e25accf1fa15131332f7d1d76c639db4c0edccd3efac2f4f70d2748680fbd876a13e74a4eaf4b874900898abded
SSDEEP 6:7+/l9ZGPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKkhLC/J:7+tiqLJdeWRmBEyPbLLSJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

unsent_requests

Path /data/user/0/com.ashpazi.asan.shahr.zhele/files/unsent_requests
Size 58B
SHA256 988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
MD5 0d210bfb2a0e1f1b4c082a6a0f79de07
SHA1 bb8ed9e364db79d1d9f2fcde3f15091893222faa
SHA512 536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1
MD5 SHA1 SHA512

Submit Download

unsent_requests

Path /data/user/0/com.ashpazi.asan.shahr.zhele/files/unsent_requests
Size 2KB
SHA256 275be21d48bfa8fc3e5b8e6acfbf0375e90d6e0ea93a43a43b525a4721d586f2
MD5 e89deea79c0bd93a2e1e8f65b372a7a1
SHA1 55f4d82b4c5e4657fb9567761e83359c9e853f8e
SHA512 6efc218493d5b6d16f12af821024177c51bc0fedcd250bc6a8ffa43d1020de43ebaf86cf87b157adde07e3cde9c9c0b9cd9ec86ae68d98225fbbf5f35acee86e
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads