Analysis
-
max time kernel
172s -
max time network
188s -
platform
android_x64 -
resource
android-x64-20240514-en -
resource tags
androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system -
submitted
19-05-2024 19:29
Behavioral task
behavioral1
Sample
5b1146f96fd42b235d2be644bcb4f77d_JaffaCakes118.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral2
Sample
5b1146f96fd42b235d2be644bcb4f77d_JaffaCakes118.apk
Resource
android-x64-20240514-en
Behavioral task
behavioral3
Sample
tcore.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral4
Sample
tcore.apk
Resource
android-x64-20240514-en
Behavioral task
behavioral5
Sample
tcore.apk
Resource
android-x64-arm64-20240514-en
General
-
Target
5b1146f96fd42b235d2be644bcb4f77d_JaffaCakes118.apk
-
Size
5.7MB
-
MD5
5b1146f96fd42b235d2be644bcb4f77d
-
SHA1
4e14ad04f12d0d3dc67b3e00e33cc9e0326a4f9f
-
SHA256
e001c0dfe6363347f3fcec884bc561029b0913a236afbb885fb61c4ba8a8132d
-
SHA512
2b23f8a36b07ae05bb74025eb01a3519b38062e91212eec32deee0f548fec5677fc5f7c59ea7d132343e1eaca850c90a0c9dc070a8870fd3f062c5ba84273a60
-
SSDEEP
98304:w0+I1S00AE5jKoxCwHLD723aByAMIUoe4SwrGcwZiTQ4U1MLRDRjBr93uL:7JBXEwo8e3723zJIUoxdqFq/N4
Malware Config
Signatures
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
description ioc Process File opened for read /proc/cpuinfo com.yangmaodi.app -
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
description ioc Process File opened for read /proc/meminfo com.yangmaodi.app -
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.yangmaodi.app -
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.yangmaodi.app -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.yangmaodi.app -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.yangmaodi.app -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.yangmaodi.app Framework service call android.app.IActivityManager.registerReceiver com.yangmaodi.app:pushservice -
Checks if the internet connection is available 1 TTPs 2 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.yangmaodi.app Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.yangmaodi.app:pushservice -
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.yangmaodi.app Framework API call javax.crypto.Cipher.doFinal com.yangmaodi.app:pushservice
Processes
-
com.yangmaodi.app1⤵
- Checks CPU information
- Checks memory information
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:5096
-
com.yangmaodi.app:pushservice1⤵
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:5285
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD50908e924aa236931dc7166fef6e00862
SHA17782648d6d8f6e835bd47058d4852932c096a467
SHA25638f8548795ca7470b449dd1de9598c07a247ba59883c0764c9c96ff0b7d31d7f
SHA5123c16fbc5172aed04cd206e776c46d26e911732c6e3631536410a71f1d217449475727ac9b3175e827c5ce645a1da9e05900258ee6ca27c936a9060f241361dee
-
Filesize
36KB
MD567c12933d1e0e63d9801a6aa43092ce7
SHA1b6936908554e4a1986b8eb08289e2d3545e8ff74
SHA256abda5dd4cc2e7dbb951637c4b49d6990f9f34411fab4dee1a387dbcc8e7eed40
SHA512db8b818daa3ff4ec7678645f84bf8b45c809bcbb758ea78b28982d071572655bba2d20e6f1ca4f0d057ab34fa655c5bc40457dc65050180351a2fc04a47175dd
-
Filesize
512B
MD54d153d71f4b6ba202489a50cf1845a13
SHA1caf6c440b726b1c20fa634b0320c7d8a1d7b3810
SHA256834029085a6a19b56e1f294f8446869f52abc7c52425fd8a032dcdd28e62f23c
SHA5125dfa543abd1cb1227a38a13e661fe949fdf1a29ad836967cc6613091fffddc5e7801eaeaa401c1a402bfb35e5cdbe1895f82bd7e95810d1987b53563afe01f4b
-
Filesize
8KB
MD5d77e9a74f5448f587bb366f9f0da3c57
SHA1a319d7abfb1fe24b5e0d8fd8f2e7559437b3b367
SHA2562451d7dbee5e435c34e7614ab1b51eb3b4c749a2b349617dcca6ce384475d24f
SHA512e0cc4cbc92070f4529581fc4241c2136c49ed8827afbd6333047fce9a2c0d3f3e4cf684b0bd7dd4e96b195bfeaed0f8c2f27a94051c464b49f1d8e2fe3c3f82f
-
Filesize
8KB
MD55f350859da237e85ebe206966297cb1b
SHA1e9180b978f9ff016732b7bff21b991a1517e731e
SHA256e6b1ac388a9aea3e7aab94f1a76a422416beb3c71856fb1507c6af395bcb14bb
SHA51241e2543506c7f27f4cf4ceb4b1aee957200e4e8d316473a87e842bf59eff89c86ac9c87337c8197825f9656f6003bd78910f18e69624d145642a8d2f354b1ca3
-
Filesize
8KB
MD54dbe314165326150d1ada2344a6a7478
SHA1141320107a6e626d38981ac7f0f2fb4a6b728598
SHA25636a881758f6ebba9e4f49aa49bfdeedc9cd584ba9f3f8099583213f61472b081
SHA5125c11fb30aff4021f728eb8cb188f91e9ff525d3155c5c8e74b1130ed3ee1736ed42b7a0ea963021c71cac07e351c5a164889a7536a52f7b9ef28bd55985ab247
-
Filesize
8KB
MD564cfd1dc7124ed8aa81654bf323f52ed
SHA1329b26d0e98aee899dab15fedcea65f95bc782d2
SHA256b7a9b921b7b7a8c8a56c0971520be05d4bbfc874a54c17febead967c926106df
SHA512bbc7667a098de205f78b21648a14a73f57dedc2156395cfe4caabf813577501e96ec8652543fc5021da0d82c11a5fc6cd263c32aa76c2aee92e97305a36a1a6c
-
Filesize
12KB
MD5a9bda70e68f35ec1ba4677e19bc6b8ff
SHA1a167b235d06f12c9e438f27bc2dc5320c6d5b953
SHA256e96481cc7933a93eeb2a5bb1ffa6b079d6e7e68034b6161bed6a8eb51a372d37
SHA5120648c385e10de7c24b44a9dd7d1308edde4b18e1880cc361d17c5229d97edeedef9176d9575e069abbf027764400762b2281964af28c622ca8c29297b38eba65
-
Filesize
512B
MD5c2a60f502d87c3c19413fb8cae68e464
SHA1a5ee694080813aadb183d253169e6b5f42e8e41f
SHA256d985002c6b9c0f327a8897974d416b8b2ab84c372a761907f638fa0ef2cc286d
SHA512b6f3b8c16005d028197e65864cf044e1b5d5140358a1878306909305460f471fb98ec7bdf703b40a1121f2f8ea968318545848ed9ca159ddbbac1b3e5737ffc3
-
Filesize
48KB
MD56f1e2441de3c27cc53b424c0d9d7d719
SHA158bd2bff8d163e0579b7c9179929a7d382471d29
SHA256d0576b9add3cea0547c0fd665472613733329f461faa828d59cae4ad96845a3f
SHA51295f9b952308e2c66f6e674306fe08e3f0512c60128327cd4355458c406dc21d39b5a06ec7bace54679111d3bd6c68826c6169a6cee3ac3c9030d1637f28a5f0e
-
Filesize
512B
MD51bd3bb5688e35104ba6c0a1116b855e0
SHA1c1661a1b8171a458c0868772ffdfddefac090bf8
SHA256570a294dea3b12afeccfa9abc2f67600e95e4dfa124fa8389e9daf46b6468303
SHA51280bfe65dc78fa352bd8c841f12523165346ad4cab542a35d07c4f6fc6989ad36727f5c542f0c0090bdadbd45a528dd35f9bf91a5016eedbcce250b62f24d646a
-
Filesize
1KB
MD5b02b82ae88c21e4be49ef2b42fe9d8cb
SHA1f8cddbe9042a46ea2ba0408b03d0742c18abf292
SHA25670db37a6b1696982d6912fdf34c6d20c5c499c74787c1b73ead1f6a8d5a25943
SHA5125eb5633071f4da00fd0be92bff24a9298b7402eb7ec6888c83c86029946541cee8f1afc0a8c3a704e8028e8d2a91a24a37a05bba60289b85d56ad7f5169b9191
-
Filesize
162B
MD5d622fea049ff5383a79decd1db1df4a1
SHA1cd6985e9fef74bfb36eba03e198b23492bf2abd1
SHA25699b6f8a55e90e2a45d066e858b4615b3eca2c9768a19c0f9ae9e60d2254f80c2
SHA5126eae9dc7efda497c7b64488215efcf458a02299bea49e5a86d2958b58a64f2ddcbce7b60d441f52fe9b0fe1d2b0d32c1b6c194dd8ef7ce04fa1a0b1f150a49c8
-
Filesize
37KB
MD5946030dc1b7504d381e2eb55fc9ea1a6
SHA1e8b30cb8cc9d8cd55d3c91562dbd9b3fe12910bd
SHA256548312f81ea740d69e67ebbf60f35bb32f27db88147b1cee1ad6fa4677880d97
SHA5120ab2536ef060f9df37666e0c00d24ad948289e46d409dba3b27bf735496f134d597e928f814b848f981a88a6870f494546b7fc89fc055d11b01ecaa767431ac5
-
Filesize
8KB
MD5249ede0bcf571823e752f01e037b3bf4
SHA19e67300b4f331423e2cfb281c863082797d18baa
SHA25634934584bde295c9729597a54c9bb29e91850105db0fd64d9e7916f7efb192e9
SHA5120421300940c27732aa74c887eb8bbab1488638ec8c6804eae8d6d094ef95b018029c6ac5be0bd5b87ad7f6ee4972cce13c9f3e275b4c4d38ac169de05d94e5ce
-
Filesize
210KB
MD5a06c1c0d2888684d7895817bf1b2f7ae
SHA148b89c24de7b535224034a7bf5c5b5d7aaeafdc6
SHA2566580da1fc47dc30d3d825ca3487e5be98c661ec7e47f50bf9d96347a6b727675
SHA512fc3f5b1a3fb06d9ec9f92e9b11b62d03547314355cf7953c23905577c3a64dec6cce5f2447a848aa5a16303f429dfd2716b97bdfa4a4e49f195daab2cc671dda
-
Filesize
8KB
MD595546303626e75943ee436de9912a8d3
SHA1d4e5e553fcf6de7026a088867485ec027ab6d497
SHA25619b362f0e203cb6703a5ca738845d8fc4682d015d345051c83e827454bf15e0a
SHA512d6cff9c2f769648518dcb69b9913c792d74dadf4d2713ab9067dad864b42a843dc4d66725f4a1ba5afa80e5741e254653c8075ae9b12e6c0ae8f9c74b8f91e34
-
Filesize
9KB
MD5352590a1a3019e7f7cfcedb6bdf25659
SHA19a1de643009ab1d0211b5d29dcdca7a63cb1132f
SHA256df115baa4c6ab97216ec5dd5d3f22485ac9f2566f9d09633f475de0cc20b8c88
SHA5122ab82d3c0cdda803e707d9cb43a4803ff8c98c5eb497d4de77d243bb29566f7613a19dd31f60fcee54f4b2c3fcc75ac6b8fcfad299c08d02e02fceab5644fb41
-
Filesize
32KB
MD5bd8e61a6986ea71b70a976b75ae25347
SHA18c9e57881351298279ac5f59f124276ebec52995
SHA256ad3e8fd1b2746b2d3f0489fdc61365fccdf4cd059f8f7d64ab703c626dcd40ad
SHA51251df80cb54781acaa2661f1b9b377f6609ce1fc446b0d43d41c1ee0b2fb8e49522f6c809f9f6897b18e8855fa8056e9d1cb1ac8c169162b38d107144fc80d644
-
Filesize
1KB
MD56646cc91e321e74a6e2be5b7e8124412
SHA16bcb27fce4d4dc1e3b214a37f23ba2ce5e980091
SHA256c2a5c867546f4e1328d342704cb7b950ecf493a95657242795750e1474377b37
SHA512b0a19ed4c2cad4e46ba59443a485ea2263d55e672d51a288fc70994d3c946e2cd63a46246836255056115adc1e409647bd4afefb7bf9849581ce42c655a074f4
-
Filesize
26KB
MD5347574349d6f93ee25fa1a5add5281bd
SHA15e8c79480e5161c0f59dd60a1c50f700a627d332
SHA2561b2a3224fc3ee72a02e3384f7c02062d494874a8de32ca2f3a6026da4f27cd31
SHA5128c00ffa1af2b5a7eac6774e067c994352af159eb6680945eed035bbbb4e17fa2dd7ea9dfc1b968a814522eabce0b9fe2a049043f71c4de88d57849db2af3dd96
-
Filesize
10KB
MD5fe43a3ce94f97fb27ff79da15c3a515b
SHA162ce5e125c8d199b625e97c18dc4b2b416d97619
SHA256fb9a9d428a843b49ee3e7cf4e07e6e9653d25982109fe0772da38147cd1f3793
SHA5120acdc740f80b2e7b5996105c625bdf8244d8d4213acf83862e83c188f45b82d1c439b9fafb2ce7efc9d90463ab819adb6a75cec341bca795109be373fc503df6
-
Filesize
46KB
MD5630dcba86ea6ae022b5b0ec60c1fc26e
SHA1479cd1b418c6f675ced8540f2f222caca62a5fc1
SHA2560b56d2959c851ea63b96d23fccf6bd2003d3d35681cf806dcbf9782b5e26a068
SHA5120fc63111a9f35a2a60f9f73a50265b5e15048f3ac6808681744549b3684e0e3b09fe941c8578076564b3459153ef120dcd831c7097c1bab818091050e3d36979
-
Filesize
1KB
MD552dbbeb73ea1eb43eae20cce83abf9c9
SHA1945c26255dda4d4f1dc53e080bbed91484d87a9b
SHA256e613d71151b2c01b697f662e3f194bcd60265c767bef9bd49766bbd54f24b019
SHA5127cbd9a4f3cb3a70d0b487aad9043b357dfddfdc975d830d8e2bee8363a96263c885671a72adc98bf64e2627108bb47bfdb03b27003ba2b24233b41c49017c30a
-
Filesize
28KB
MD564b395ec1c4fa9fc66d402223840d37f
SHA146144c07a30c6170b4d9928b87ccca2928486f4b
SHA25679e3c1188aa296c7eb6b34842a707ac4de087c45d8ef70c1a7cb8a84e0cc88ef
SHA5122992a9f00f77c043ca3edf4ffbd57cb24c4d8be4a1b53f6b65cfa9321976050556d58af697c2667b1d691f55ac8b51fd6c1315f361644f32b686ec49ebf3be7f
-
Filesize
335B
MD5585839d66722cfd02e40cb740cccb633
SHA1374c19200fee201b26d0153487a281a934615884
SHA25686a9bb4985cca6c9636c4fd071bef4b70ba7b3a5eb51af869a1299dc2b1574a8
SHA51209bbe1bf1455861fd4732f2d1945c84bac34090906ac2fab75d144c22ffcf6bc585c8209e94a2b1919c8402df53966081a1af2993e12261ae4c4ac5568667d88
-
Filesize
435B
MD597ab3f8c53c49bc79bd3ddf871589c21
SHA1cc9623b0b23e1fe25752909314695b974175e887
SHA25661fea39e72d7d225613e49319b7fe763354989cb0a6bbf27f0c200e9a890f3d8
SHA5128af5f60f77b86cdafd93176e528bc126f5a45683d2b239032fe6898470ab9658c04c8649d581618835d98e8923249664855dc9e765536621cdc27bd665f3c5ca
-
Filesize
8KB
MD5bf2b9a5c9a745e633002640d2d8f046a
SHA1fa569ab3371ec63843c393bab2d0ff0657c4431c
SHA2566312d2a5111778aaaf4fec6dde9d0ddaf23c34b584e73cd6a47b5e8f401120c5
SHA51271d28fcbbd5d4f590b476f8bacbde39555620ad3822ac2aa3440f656a0fd028b0b10b743b4f69b7d7f0ace70f7b80fa39b3041edcb913d8eb59cd7f68eed2dc8
-
Filesize
8KB
MD56797f30f6f345431e14e249d2a79434d
SHA10e930d354c787243d616cd25e3e4e62da3081e95
SHA256db4684ed4ddcb0fa880020b4e686316c2bcd7239dd40e5c67511c8e8eb2af040
SHA51231968b7ecb1dc8f4de8d0a5aef4e632c90eb0578ab143b0d031818dac099341896152c6733717a1d920b5ee0bb9eae598074244a014930271a248ab207c455d1
-
Filesize
8KB
MD53c576b39d59ca07b94e22fea647de7c5
SHA1a21b9895b986c904c06a7ff4609c86b0a144fa8a
SHA25627547f50eedf2ff0da73d23396d8ed6909d3a7ee44dd90ba2869df0e8f5b7c3d
SHA51277facb609c5c7ea54d17fbdef15e0509ececf98762bca8e9bacb24b5e2e1b751bdc4e2ac2ff7f2613c61bdf0b50a310877da2146b1321d05e8e0cef0ee14e74b
-
Filesize
8KB
MD5a4db91026b158117f91b8a78c9330f35
SHA1b4a3e023fb7976b37a6f240b4ab6e0429376785f
SHA2567a78e9a86e03512c147def56c00fea220224bd1b10cd52ccd7a28eddceca9591
SHA5123919f32b1ae75004cdc86642f045a71210d2022e83967a9f610dbe52c6ae2b8b489fc53901e549372d8c93a4c8282fa8ce6242f14af00decc80ec807d9ac451d
-
Filesize
8KB
MD589d622336c9602fba5280b35f302e019
SHA155ca41b79ed2fd5a6903c2ce229f9de87ab7ae0d
SHA25658df7e63ef2ef03ebc16a280ead1f78333e60f57d1396617f9f7643fe9b094f0
SHA512f82fc1a4181560a42db8c972ae42cf050328b9dd378ac1cf82d336898862a2ae7674ba9f875a36b0681f89440350153239d4166c807481ec97b191c4cfe3836e
-
Filesize
32B
MD57fb2f384af29103385d786dc0f0e2ca8
SHA142df36e370e72e39392f7907197125ab9a885efc
SHA2561ec8e378ac5b0fb54d3700377f20e923568c09ad0b922f036243565dc61822c0
SHA5126766dc9e40b924ce936722dc3e21e57d17c6e0093681f0f53a70272264d2a5d074e3a58f88dbdf7e701e2f6603f7f131cd75a9636b2996940185894c07494e1d