Analysis
-
max time kernel
178s -
max time network
131s -
platform
android_x64 -
resource
android-x64-20240514-en -
resource tags
androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system -
submitted
20-05-2024 02:28
Static task
static1
Behavioral task
behavioral1
Sample
5cb9efd6353cc7be470364c79ed5e40c_JaffaCakes118.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral2
Sample
5cb9efd6353cc7be470364c79ed5e40c_JaffaCakes118.apk
Resource
android-x64-20240514-en
Behavioral task
behavioral3
Sample
5cb9efd6353cc7be470364c79ed5e40c_JaffaCakes118.apk
Resource
android-x64-arm64-20240514-en
General
-
Target
5cb9efd6353cc7be470364c79ed5e40c_JaffaCakes118.apk
-
Size
602KB
-
MD5
5cb9efd6353cc7be470364c79ed5e40c
-
SHA1
e25edb85613ec9eb997a2b19ec6e0b21626cee69
-
SHA256
136c126e5946181bdf194d219b882c9d2363c9952ec3e6ba8e0b7823e838a5f6
-
SHA512
0c12a8b266a15c49888f5b92ac137ef28fb6c3077614bcb9b70c7662de8de25b607143a570cc572ca83ccd240268b289560fd71099f2350d5d23d1e5b63a3313
-
SSDEEP
12288:XEEaFZvkGGNUuWW1NVwCKn6GAx1d9H1BY+0aTBpqSol2KpEhpX79l:UEaFmFN9v46flH72wOSoMK69l
Malware Config
Signatures
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Processes:
feifei.shasha9.meta.facepid process 5061 feifei.shasha9.meta.face -
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
Processes:
feifei.shasha9.meta.facedescription ioc process File opened for read /proc/cpuinfo feifei.shasha9.meta.face -
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
Processes:
feifei.shasha9.meta.facedescription ioc process File opened for read /proc/meminfo feifei.shasha9.meta.face -
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
Processes:
feifei.shasha9.meta.faceioc pid process /data/user/0/feifei.shasha9.meta.face/app_ttmp/t.jar 5061 feifei.shasha9.meta.face -
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
Processes:
feifei.shasha9.meta.facedescription ioc process Framework service call android.content.IClipboard.addPrimaryClipChangedListener feifei.shasha9.meta.face -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
Processes:
feifei.shasha9.meta.facedescription ioc process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone feifei.shasha9.meta.face -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
feifei.shasha9.meta.facedescription ioc process Framework service call android.app.IActivityManager.registerReceiver feifei.shasha9.meta.face -
Checks if the internet connection is available 1 TTPs 1 IoCs
Processes:
feifei.shasha9.meta.facedescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo feifei.shasha9.meta.face -
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes:
feifei.shasha9.meta.facedescription ioc process Framework API call javax.crypto.Cipher.doFinal feifei.shasha9.meta.face
Processes
-
feifei.shasha9.meta.face1⤵
- Removes its main activity from the application launcher
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:5061
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
1Suppress Application Icon
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
607B
MD55a2df6fd8221b404071737f975dd6fb0
SHA1d14af32b57c6f2d77226a8626804b37343d55ced
SHA256838c6e906a4ac739b2ebc9ea615b4ac11240ac56d378ed1360c9635f4a711098
SHA512942e3d53f9071f6db897b45ba3c4ff4dcdc4f372b81fcb677a6dcf023e3ed3752e4cc522eaeb1922b7c4bb373b6c4c4538929360c6f8b89ae6f354834836b2ed
-
Filesize
276KB
MD59aaea567e0c93e51718ba7eade0e83df
SHA10005116aad1779361b70093db00fed5ac090ae23
SHA256b30a95dff6f65f444472971c8aaf895ffc8e66e0117ce242ec4cb8a8a519a5ec
SHA5122aef1034335d8752f4e25ce6c5823ce03019536cc6e51ee61b5291c77a0f356a2517e0cbe7f2c4cc2d897115dc856449a342cfdc247c9d34d313187d15b2f890
-
Filesize
72KB
MD58a12f5acc416e88148d826666642781b
SHA16bdb9e3d51fd75cddd26c911852b6564264916e8
SHA256eb6e811c32575fb63f98b035c5bebfda0527a4e4a1f8fa3424d77a39e53f1ffd
SHA512f56ad0492a4b3787cda1ba77046c88a149403274369312bfdfa93400ec064973340763a3e37e280484cd8e21b1c29da2579e7fc6557c1cfcf965b15a8ff21c00
-
Filesize
512B
MD52e51c3e0e05d6c8403c12cdee7f7861d
SHA19e89cb402833486f26b424a6fb0b3c240b2e11b2
SHA2567f753e52567cd867e381a8f6f7a7234072733b852a0eb87fac11580ab0eb899e
SHA5121bdbc70e6c69fbc3918fe60a0ddaedeefa7bad19a5dc3063617389a7883dd5b463d9612d520ed80b84f91305e7a0fa5d926394e8794a6cea3a8b2709170a3dc7
-
Filesize
8KB
MD5527dbafdec582c732bcaf66c034583d4
SHA180644f6b24adef1651c706c82f5229a5fb1c49f1
SHA256d5b50d6b2e6b4fd62406fe692ced396e84404797503a9c637b32250547e74877
SHA5125bf02479b742404cc3c4d02537c4f4edd311c8ec21ee65035b82b5ce643002bd924781de4fa5db83ef1e433967325884f107cfdbe810a41a6ce0c221fcb1d324
-
Filesize
8KB
MD5c12bb8b5cabbf8e2bc4bb54fe93cdcdc
SHA18a286a5a0aaf835384cea8e813814054ebfc65ab
SHA25649f78c0d06ce66630b410919d518c59dd7e836755cebb4ae5fa2a2f001dd8c07
SHA512c68a5f6e18a0670bb2df710be1e1a84a75d315525dc0922daa9d95e135e1e03866d6670322ba6865cc5b588b7d83a98c0238c0d8a1f637dbdf2ee3fa81044448
-
Filesize
12KB
MD5a64843018f8c3c209700191668f209e6
SHA180b49b2870f2a48d13e51f7c4ca79c9a2b108bc0
SHA2569c772c6aac5697eeae332b449ffc0ae65964cc17da2c88af57c9161fe345b187
SHA51212ba530292c72add3f953193bfc024c52484f5899e8727e217a3f0da1ec28ea9c1d22c10e8f4a11f409c726ba1834d7e1ef63e501f4b3a57563385cf0e7cd90e
-
Filesize
587KB
MD5f72c3d07507c3e26d317e9117ba757d1
SHA1cdede4739e9dd9fd95243aab5e44c24f93f825c3
SHA2561c65834d9ca018c6496a8b9957589d0e94657911b6635dc21a448d78f9238887
SHA5123420714252e7503abc13c99274d767b0bc08671d769460dc61823ab9470e145fb75c5dfaadc617d3a05cf251ed5ecf38ea7e8c1d7b343bca4d7e8296f1b805d4