18a3bc8ebb5e262592741121122a8b7bbb208dd74a19ba00b9633611611d34b7

Analysis

max time kernel
10s
max time network
131s
platform
android_x64
resource
android-x64-arm64-20240514-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
submitted
19/05/2024, 00:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
579766cc5486a409f07cc1cc90726ec3_JaffaCakes118.apk
Size 31.1MB
Sample240519-ajcf1afh2v
SHA256 18a3bc8ebb5e262592741121122a8b7bbb208dd74a19ba00b9633611611d34b7
MD5 579766cc5486a409f07cc1cc90726ec3
SHA1 0e71ae2cfb2305fcde3811e604891a8e8b5ebfce
SHA512 e17eea2022ffd30d31afa1dd25494f62552f30f7b4a095f9331c639d4271d212c5a9d60dbc8a9f16464d23169b84b4ed7256392b184faa333bae257b54bbd7a2
SSDEEP 786432:l6OajWnS4CFk+TdrTWi9CV1/MuTAfWYIkz3HwYUjV624SOMnOa:ltajWnmk+TdrT19uEKczQYUjVn44l
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion impact

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.jrd.tcm

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.jrd.tcm

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/data/com.jrd.tcm/mix.dex	4502	com.jrd.tcm
/data/data/com.jrd.tcm/mix.dex	4502	com.jrd.tcm

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.jrd.tcm

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.jrd.tcm

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.jrd.tcm

com.jrd.tcm
1⤵
- Checks if the Android device is rooted.
- Checks memory information
- Loads dropped Dex/Jar
- Queries information about the current Wi-Fi connection
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4502

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

mix.dex

Path /data/data/com.jrd.tcm/mix.dex
Size 292B
SHA256 4c76a3af64cdd2f8713ffe2733dea50dbe714d0ca41c17d1847ee5b62a7ca615
MD5 63f77f99bd2c2b772a479923bde11974
SHA1 c7632e7d301e4463fafce85f84e9c3d7da3fdbbe
SHA512 3aae4a89d1ed51fdd911cb367eb10afe3c2264e4222085891b18a60d5412f85d10bf5c8f3c6642db70abb9aa42732bac5c42c42ee32d587100f53c21b5beb16c
MD5 SHA1 SHA512

Submit Download

map_record.txt

Path /data/user/0/com.jrd.tcm/app_bugly/map_record.txt
Size 32KB
SHA256 dd7e0abc12495bd0c838f2145b1b511ed6e054efd2ac01932b91a38c6709a4af
MD5 f7d89f689a489fe0a304b9ccef8c0d55
SHA1 c57260627b2e5c17175954291115970fef936fe3
SHA512 30e57c1bd06dc5d5d68e0ae5a11ecc656e1f67d23b27a2090ed4625577a29a21593ca3f91582fc801149b4fd32917f9d43c1946eb534805b3326d922841fb10d
SSDEEP 768:NxwrWaKB/WsFGr1+T1W7pd16jmJZ7qX7/WR:siaKpwr1+BW7pdRfqK
MD5 SHA1 SHA512 SSDEEP

Submit Download

reg_record.txt

Path /data/user/0/com.jrd.tcm/app_bugly/reg_record.txt
Size 329B
SHA256 f909241c5610e1e6684ba954e4cb0dcd3213f9e2ad3df07b59d9bb9c64bed93f
MD5 1ed824e9f3684fca4cd7928cb9c94578
SHA1 c5fdca9d83f3a0bf0ef38eeaab5a6d027735b802
SHA512 2a77bf10b15847d7de15cfa4ff78ec8d1570678759c1669947f7201881257b6a2c71513fbed9588a9f14b51dd1e18b4e3fce87ef8193e1f4b8d6017888802e2f
MD5 SHA1 SHA512

Submit Download

rqd_record.eup

Path /data/user/0/com.jrd.tcm/app_bugly/rqd_record.eup
Size 29B
SHA256 12eb72ff09eef9137e67ce8f0588607a28976e0e082b80125f7ff572405a582e
MD5 5ec758aba3fc538354888e38ac5ed313
SHA1 d35b6573d25b6e282a680a4ffe9ccfceebec74a4
SHA512 13e094ecf0cad0cec897853bd3fad125b5ab07db68652cad4affb1b03da9d50a19815b268361a45543205cd54774148691a3433abb075a48ef0c846dae73ccec
MD5 SHA1 SHA512

Submit Download

rqd_record.eup

Path /data/user/0/com.jrd.tcm/app_bugly/rqd_record.eup
Size 104B
SHA256 4d2746f5a7e441ad8d31cf3000c619a178f2207ae0c2078d4c00f157b7f8ef83
MD5 207f404ccea0b761159a713befe5b089
SHA1 5396dc01547dc2c0e6da62ffb3c377c938633919
SHA512 7be8c700e461c58a257e6af11275eb3df36ad96553a68a146bd72bf1a23bcac8eedb2fa66dc4b2651ec27542cfce4cfcd197aeb9bb163a4011e35da4cf0e3236
MD5 SHA1 SHA512

Submit Download

rqd_record.eup

Path /data/user/0/com.jrd.tcm/app_bugly/rqd_record.eup
Size 432B
SHA256 8645cf5c4a0dd3bce40ce453692efc2c08a3ac81bb339e1d5d91fbb6389ebbe1
MD5 66151646e27a50130c2c4941374f857a
SHA1 b25717a3eb0e5374119e75e398cef82537674a53
SHA512 c4d8ec8dd84560e4aa32ce96996024e9ee17a75a1734ea5f21402a3dde5e9588525bcde9d2c87a41736a5b4f79acc50ee3a2de71507dec536658f78488843c04
MD5 SHA1 SHA512

Submit Download

rqd_record.eup

Path /data/user/0/com.jrd.tcm/app_bugly/rqd_record.eup
Size 1KB
SHA256 96cbe351aff48e88df8afbb6a961fa4bc3674d5b57bdb9e07e722a12742072d9
MD5 dc1313cbb755912d0ead69ce89c13992
SHA1 c1d79683373663a370d0770cceb93cceab27a47a
SHA512 ad4303a76e71909768b8ccf5777e6c6d5fd86d4bc155facc834bd4dcd3ae0af136c4088d716fcecd421a7a79ee3119c25b2a61e241660314f133ab066de2dee4
MD5 SHA1 SHA512

Submit Download

sys_log_1716077674633967.txt

Path /data/user/0/com.jrd.tcm/app_bugly/sys_log_1716077674633967.txt
Size 57B
SHA256 1eccb1927c86010f036010acde95940ae8c01a8563d30e6857dd7783df4f1855
MD5 77632b5ad58c0505625021da0e397d3a
SHA1 38b2433d9f9fa9eb25d9d95a3feeea2c539ebb83
SHA512 3b3d8d90da8786aa73c169f96dc01fbf2fbe032940dec40bb385661f9a094de501c6f773d44fb960751f5a94835440d9a7d9932321cf2ede57b11ee4e99173c0
MD5 SHA1 SHA512

Submit Download

tomb_171607767568.txt

Path /data/user/0/com.jrd.tcm/app_bugly/tomb_171607767568.txt
Size 772B
SHA256 eace115b5c826fcb8f58737617700c95deb907ca32246fbc567a7e19183b617c
MD5 e1e89a0d05cf15b2e315d2fcd7763b00
SHA1 570e41d64e900e0501fe4c2f26160e7269a52fc6
SHA512 5cf81de62474f124ccbd62b7b68ef444a4ff1f0cb96073a2c82d89e6c631d64811f89978d02aebc4b1f7ffcf520e46bcd2dda642319c64207761ed54603b6df9
MD5 SHA1 SHA512

Submit Download

tomb.zip

Path /data/user/0/com.jrd.tcm/cache/tomb.zip
Size 580B
SHA256 2296338cde50f9cb548a3204a497c90b01906b5f51c36f8c3286b20d2752dbf6
MD5 53816e86f65c131736d29a7af512ee5e
SHA1 88ca5fb7371a6048677aaaba5d18369c020960e3
SHA512 22f037979b50813c56a05592e7b4fdcadd47a5185efb90ffd9d4d338a3d75b2a9b75b0ad5e1049fa80c5fffd92b4d067b34550bb84552eeff7f165ecac15b5c1
MD5 SHA1 SHA512

Submit Download

bugly_db_legu

Path /data/user/0/com.jrd.tcm/databases/bugly_db_legu
Size 136KB
SHA256 a9f8873dc6538bcfa71e6ebb9565b7e7604a6707b0004d9a8a2d9c3da53a5f0a
MD5 649925c863be41aaad957b864d2dd332
SHA1 1932c3c62204ccd581bc97cf47ecd1b61443badf
SHA512 5dce284af83ed4f5161560ae4777681df6449e7ec2f3323a0519d73546997de5080ccc4870a2f1a310fed34b42b6507f37d630ef179720936994b97fc3cbfada
SSDEEP 768:i9T9OsVCAMiDuEVyirUGdsVgrU+gjJ8sJEJh3UsVCVh8tTjQOt7R04Uzf4u8KadC:iBRU6kAF
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/user/0/com.jrd.tcm/databases/bugly_db_legu-journal
Size 12KB
SHA256 e10a9b2120a88decb6de014cee41d13d36c91566a592a68b4046d78bfd666959
MD5 64c3ec61e65a1e6ca2562a4485ac9e92
SHA1 ee9c9bf270837c7380818ed0d3ddc2109cda66e0
SHA512 66121b3d231e72202f9efa4ef36a47c5d1a2facff9026543f66884fd66ebb67c296d3b6fdea125a6bf4a7b13770777bc47ebdc84180e26f707190ba1ec0991eb
SSDEEP 48:7MGxqTZfrQiw6uMg6/YBg72meposSOE/pHoXL0tP84dxblUNele7nl/Qlet2AErC:79Y4m71/CaYNegQU
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/user/0/com.jrd.tcm/databases/bugly_db_legu-journal
Size 512B
SHA256 9b2af24ed553050f6c34a7502235bbb307370febac4a96d471dcdb03dadb6b8b
MD5 6c8c882824ab8e20f3ca08d853566703
SHA1 28d56839953f496eb2f69430738948a1e1146170
SHA512 934d5bb335d392217c74250a6fd8f53f8aed3dbb5cbef8bea900471c429c5865e4c9f4f9233cbc0e6594227f6d925e420ae06385938bb85192e197c8040efa32
MD5 SHA1 SHA512

Submit Download

bugly_db_legu-journal

Path /data/user/0/com.jrd.tcm/databases/bugly_db_legu-journal
Size 8KB
SHA256 c4b1f8389ef498119a81c2c2d8e15fffc0ac6e97fe5039feb2805f143bdd90cd
MD5 d7943b1b1169136e22d7561390500203
SHA1 8b14e08a46ecf8ae9b1723f4d061181a18950bb9
SHA512 a8f3e42084782d28e49e1f2d26a8efd79adc014d870a51540b4abdcf18dcc9b0577deac164d607ffdc5a06867ec68a719408b819a1e24654db3968701146d307
SSDEEP 6:7+/l9JE/0Fn1Opg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKCen:7+tkqLiuWdYRmBEyPbA
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/user/0/com.jrd.tcm/databases/bugly_db_legu-journal
Size 8KB
SHA256 a7a41b5ee2d9688ee218e723591b7bfee189768f91c0a409d52b16f8814d38f8
MD5 506052aeecfac44d158067ac2d42ab04
SHA1 5736f6d2286fca07f17d7772c153942dac8bb15c
SHA512 0e82f06de1de64373d950f591a29bac79c7fc59d6e979c65e94d7618262da05c36cf2c02ae6b61845f06b7cbc624acd8fb8d8a8f45ce069eb7b34367219feb08
SSDEEP 6:7+/l9tPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKW/ez:7+tPqLJdeWRmBEyPbBe
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/user/0/com.jrd.tcm/databases/bugly_db_legu-journal
Size 8KB
SHA256 3c366edabadc446f8419a0466358f608da530574503f13e40ae14553bc9498f7
MD5 1223c4635acee4cb83dce256fe9b74e3
SHA1 7297d7fc886a1a144aaffa2f18eca1605120c60f
SHA512 7ff26c5c0247dc655f790e5e39d0a2a1b087861c7f3e5b8708968beba7bd658678344bb783200511f102513ec1ad586c227173c5f2832bdea716bcac10f67993
SSDEEP 24:7+tVqLTtrrqqn26VnrQiVicXX+MgeRKkYBg72m/mpLwBpGSI:7MVqVZfrQiw6uMg6/YBg72meposSI
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/user/0/com.jrd.tcm/databases/bugly_db_legu-journal
Size 12KB
SHA256 705e617ae4b2f25413979b28aa587c4c33aabff9f3a256a5d2b93a4e4419e1bc
MD5 b115179f9d36cb7ca7b2eff404b9ac8f
SHA1 58f629fccfea24afcc1a6d5257fa31a996cfc5f2
SHA512 1c09c46aab70a425a8925af55554b24ec6f370df4d3e3dd417604df0b643d9846989e76583fc4ec8d8ce121278eb921fa787dba8207ac7edf3e197c9d5b9d429
SSDEEP 24:7+t1yvqLMvtYrqqn26VnrQiVicXX+MgeRKkYBg72m/mpLwBpGSF:7MEvqlZfrQiw6uMg6/YBg72meposSF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads