Analysis

  • max time kernel
    178s
  • max time network
    185s
  • platform
    android_x86
  • resource
    android-x86-arm-20240514-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
  • submitted
    18/05/2024, 19:28

General

  • Target

    566553791b7642b25b2f7fc2ca0d27f6_JaffaCakes118.apk

  • Size

    25.6MB

  • MD5

    566553791b7642b25b2f7fc2ca0d27f6

  • SHA1

    1f5cc95f2fbb1bc7942737386abadb0e901cf86c

  • SHA256

    d5af7a5faef2608be5b6f8b9cc8fc5d73551383998c5be1ffcb32d9ee5445f84

  • SHA512

    a2e8665500242dbdd2a3cc67524a93748a3f7a845da9aad0746a68233a75699e329c783fcfdf94fc3942de98a3bb186285980c301c54c19c375a98a9654b967a

  • SSDEEP

    786432:I6UhCfahjDyQeZd8Sc2qvVOx5DlvAmiptc6Imz52uMXH2k:jP8P7eZd8gq4xnvAhMS3MX2k

Malware Config

Signatures

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
  • Acquires the wake lock 1 IoCs
  • Checks if the internet connection is available 1 TTPs 1 IoCs

Processes

  • net.kairosoft.android.onsen_enmod
    1⤵
    • Checks CPU information
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    PID:4280
  • net.kairosoft.android.onsen_enmod:pushservice
    1⤵
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Acquires the wake lock
    • Checks if the internet connection is available
    PID:4310

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • /data/data/net.kairosoft.android.onsen_enmod/databases/google_analytics.db

          Filesize

          64KB

          MD5

          29d16b2819b4f72b23f15ad2a64f582a

          SHA1

          9c96e3ed7eea5241b1024f6385c94efed93f6b7a

          SHA256

          294306b58260536c12a9868271faf8ec7946a740248b4acecd3f34b32922dde8

          SHA512

          f6a301158eef4ef67e1493e3ed78fedd7491404b79c2cb61d2214fea01f0ff1669f1ca9be3696403903344e304cccd4d96979b5f9556b0faa28c5f13e43b9fff

        • /data/data/net.kairosoft.android.onsen_enmod/databases/google_analytics.db-journal

          Filesize

          8KB

          MD5

          f3cc3cbc9cf9f231b089309f3d306941

          SHA1

          331a0efcb6d3b586d384642a9b44de5750298e4e

          SHA256

          5793a78ef6a2660db7d2938c529a10bc531d56bd2c9616a39dd3fb5c740bd1e8

          SHA512

          c5f372bb4670d611d596632cf5761412faa0c5e4cf0661220bd60c8bd7d05fdcc9b46ac951560871b3361b75dd8dfa3fb6745494aa49401be4beb5d89d267a74

        • /data/data/net.kairosoft.android.onsen_enmod/databases/pushsdk.db-shm

          Filesize

          32KB

          MD5

          5763f8100c3eb2b16ec27c88a56c9fe2

          SHA1

          36f79becc869897a741585e4b2d312f9d960364a

          SHA256

          a8eeee7a6e9ce8b025518793e8ea447c3873e9172dd17f9ff78e83938a8f5d8a

          SHA512

          1ab2c7707e6850da314c06abf044e5091a2bd131aa4213c53724700552c5cdf48022224e9d9d7807ecb7b481e933955229a8daa5838a5c527babcf9521f9e43d

        • /data/data/net.kairosoft.android.onsen_enmod/databases/pushsdk.db-wal

          Filesize

          80KB

          MD5

          1f71ad748daea11bd09808569a0ddd3d

          SHA1

          3169021dc6aab89062b3f9518fe174974688b32b

          SHA256

          1ae3aaefaaace1fea81abc3c17564aeb8ac04a4d363de0f7ac5599d1432482c6

          SHA512

          e028eb6e7f23a2c102e792585408da41bae59cab6bce631405651f4366e66e463a3debd284e2dead1a2c9a3a1ea59d5772417f36febd0da3253cfd2ddbb43efc