Analysis
-
max time kernel
178s -
max time network
185s -
platform
android_x86 -
resource
android-x86-arm-20240514-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system -
submitted
18/05/2024, 19:28
Static task
static1
Behavioral task
behavioral1
Sample
566553791b7642b25b2f7fc2ca0d27f6_JaffaCakes118.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral2
Sample
566553791b7642b25b2f7fc2ca0d27f6_JaffaCakes118.apk
Resource
android-x64-20240514-en
General
-
Target
566553791b7642b25b2f7fc2ca0d27f6_JaffaCakes118.apk
-
Size
25.6MB
-
MD5
566553791b7642b25b2f7fc2ca0d27f6
-
SHA1
1f5cc95f2fbb1bc7942737386abadb0e901cf86c
-
SHA256
d5af7a5faef2608be5b6f8b9cc8fc5d73551383998c5be1ffcb32d9ee5445f84
-
SHA512
a2e8665500242dbdd2a3cc67524a93748a3f7a845da9aad0746a68233a75699e329c783fcfdf94fc3942de98a3bb186285980c301c54c19c375a98a9654b967a
-
SSDEEP
786432:I6UhCfahjDyQeZd8Sc2qvVOx5DlvAmiptc6Imz52uMXH2k:jP8P7eZd8gq4xnvAhMS3MX2k
Malware Config
Signatures
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
description ioc Process File opened for read /proc/cpuinfo net.kairosoft.android.onsen_enmod -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver net.kairosoft.android.onsen_enmod Framework service call android.app.IActivityManager.registerReceiver net.kairosoft.android.onsen_enmod:pushservice -
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock net.kairosoft.android.onsen_enmod:pushservice -
Checks if the internet connection is available 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo net.kairosoft.android.onsen_enmod:pushservice
Processes
-
net.kairosoft.android.onsen_enmod1⤵
- Checks CPU information
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4280
-
net.kairosoft.android.onsen_enmod:pushservice1⤵
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
PID:4310
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD529d16b2819b4f72b23f15ad2a64f582a
SHA19c96e3ed7eea5241b1024f6385c94efed93f6b7a
SHA256294306b58260536c12a9868271faf8ec7946a740248b4acecd3f34b32922dde8
SHA512f6a301158eef4ef67e1493e3ed78fedd7491404b79c2cb61d2214fea01f0ff1669f1ca9be3696403903344e304cccd4d96979b5f9556b0faa28c5f13e43b9fff
-
Filesize
8KB
MD5f3cc3cbc9cf9f231b089309f3d306941
SHA1331a0efcb6d3b586d384642a9b44de5750298e4e
SHA2565793a78ef6a2660db7d2938c529a10bc531d56bd2c9616a39dd3fb5c740bd1e8
SHA512c5f372bb4670d611d596632cf5761412faa0c5e4cf0661220bd60c8bd7d05fdcc9b46ac951560871b3361b75dd8dfa3fb6745494aa49401be4beb5d89d267a74
-
Filesize
32KB
MD55763f8100c3eb2b16ec27c88a56c9fe2
SHA136f79becc869897a741585e4b2d312f9d960364a
SHA256a8eeee7a6e9ce8b025518793e8ea447c3873e9172dd17f9ff78e83938a8f5d8a
SHA5121ab2c7707e6850da314c06abf044e5091a2bd131aa4213c53724700552c5cdf48022224e9d9d7807ecb7b481e933955229a8daa5838a5c527babcf9521f9e43d
-
Filesize
80KB
MD51f71ad748daea11bd09808569a0ddd3d
SHA13169021dc6aab89062b3f9518fe174974688b32b
SHA2561ae3aaefaaace1fea81abc3c17564aeb8ac04a4d363de0f7ac5599d1432482c6
SHA512e028eb6e7f23a2c102e792585408da41bae59cab6bce631405651f4366e66e463a3debd284e2dead1a2c9a3a1ea59d5772417f36febd0da3253cfd2ddbb43efc