Analysis
-
max time kernel
176s -
max time network
132s -
platform
android_x64 -
resource
android-x64-arm64-20240514-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system -
submitted
20-05-2024 02:28
Static task
static1
Behavioral task
behavioral1
Sample
5cb9efd6353cc7be470364c79ed5e40c_JaffaCakes118.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral2
Sample
5cb9efd6353cc7be470364c79ed5e40c_JaffaCakes118.apk
Resource
android-x64-20240514-en
Behavioral task
behavioral3
Sample
5cb9efd6353cc7be470364c79ed5e40c_JaffaCakes118.apk
Resource
android-x64-arm64-20240514-en
General
-
Target
5cb9efd6353cc7be470364c79ed5e40c_JaffaCakes118.apk
-
Size
602KB
-
MD5
5cb9efd6353cc7be470364c79ed5e40c
-
SHA1
e25edb85613ec9eb997a2b19ec6e0b21626cee69
-
SHA256
136c126e5946181bdf194d219b882c9d2363c9952ec3e6ba8e0b7823e838a5f6
-
SHA512
0c12a8b266a15c49888f5b92ac137ef28fb6c3077614bcb9b70c7662de8de25b607143a570cc572ca83ccd240268b289560fd71099f2350d5d23d1e5b63a3313
-
SSDEEP
12288:XEEaFZvkGGNUuWW1NVwCKn6GAx1d9H1BY+0aTBpqSol2KpEhpX79l:UEaFmFN9v46flH72wOSoMK69l
Malware Config
Signatures
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Processes:
feifei.shasha9.meta.facepid process 4626 feifei.shasha9.meta.face -
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
Processes:
feifei.shasha9.meta.facedescription ioc process File opened for read /proc/cpuinfo feifei.shasha9.meta.face -
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
Processes:
feifei.shasha9.meta.facedescription ioc process File opened for read /proc/meminfo feifei.shasha9.meta.face -
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
Processes:
feifei.shasha9.meta.faceioc pid process /data/user/0/feifei.shasha9.meta.face/app_ttmp/t.jar 4626 feifei.shasha9.meta.face -
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
Processes:
feifei.shasha9.meta.facedescription ioc process Framework service call android.content.IClipboard.addPrimaryClipChangedListener feifei.shasha9.meta.face -
Checks if the internet connection is available 1 TTPs 1 IoCs
Processes:
feifei.shasha9.meta.facedescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo feifei.shasha9.meta.face -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes:
feifei.shasha9.meta.facedescription ioc process Framework API call javax.crypto.Cipher.doFinal feifei.shasha9.meta.face
Processes
-
feifei.shasha9.meta.face1⤵
- Removes its main activity from the application launcher
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4626
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
1Suppress Application Icon
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
276KB
MD59aaea567e0c93e51718ba7eade0e83df
SHA10005116aad1779361b70093db00fed5ac090ae23
SHA256b30a95dff6f65f444472971c8aaf895ffc8e66e0117ce242ec4cb8a8a519a5ec
SHA5122aef1034335d8752f4e25ce6c5823ce03019536cc6e51ee61b5291c77a0f356a2517e0cbe7f2c4cc2d897115dc856449a342cfdc247c9d34d313187d15b2f890
-
Filesize
587KB
MD5f72c3d07507c3e26d317e9117ba757d1
SHA1cdede4739e9dd9fd95243aab5e44c24f93f825c3
SHA2561c65834d9ca018c6496a8b9957589d0e94657911b6635dc21a448d78f9238887
SHA5123420714252e7503abc13c99274d767b0bc08671d769460dc61823ab9470e145fb75c5dfaadc617d3a05cf251ed5ecf38ea7e8c1d7b343bca4d7e8296f1b805d4
-
Filesize
72KB
MD50804140c03f5f26114e3a4cec727b615
SHA1a6cd716a9d24ae58c74d13ec5d51cea1168111b7
SHA256f9174d94f2e58e5decf5c0bd883902d438d185b625b6f2b99820edd8b74c2921
SHA51220777408ecf0c6384ac95c94f6b24b7bed5748bbf03ba6e562d4411e568b3e457312a884e1b26a51883db6bcba864eb82e49a5e2d84caa638681ae15f4ecc518
-
Filesize
512B
MD51426fff184d545fcc0a3e0ff5f1f7fe5
SHA1b9da8b97a9f873c4045290a5d211daad1b6e7708
SHA2561dd6ce5a5d60977dff3560e31eb9199af29eefcbf97197f8bfd9a0c14f4c4ef2
SHA512709a5f4548b850f0286b3ba02f237f9b583bcb3431b676fbb7011b638d0f4634ce4f622586583323048abc3324aff132f2da4888c9a4b70f53f56afc422ee753
-
Filesize
8KB
MD5b7d52530950f26511806bb8f88cc9d50
SHA1f8fbdda2460dc3a3f4e7b80e8bbc3b89b24c4891
SHA25627c3a3e07bbd43fd696088584cd6ab3c3ee5e3d069dd563fa83ca3c79108ea61
SHA512b3de4d50d1fb54557593f7828c0d99334ee00bb15a6c3714852ce43d220bfe42e7044c94e753a37088a77fa499abbae0dbef51ea2ab1adde1cf26a623060d248
-
Filesize
8KB
MD5a056e9cfaa35cc566793657daf8d0b22
SHA140f23250caf693b80a9ec96628824553199fc3df
SHA256337a0f40bf05a19b53b77e238b6956a63bf996ec06771d84a6389be686ec91b7
SHA512a2326c79b23cfb31dd7ddd50009e01725d15801d3f00db985d9b3262914c3cf31316af5122c8360b4dd677a3b4279c3b0a7c5a645eb457d661eefd4ff9afd741
-
Filesize
12KB
MD59d05bada3bf02aab6470e32a23eabfa9
SHA17f6e4faef0596b1eaba48ec2375837b854461536
SHA2567ad986c3c829d0b3ee6adf5967e6b36770737dd0910cb3b7e5d27718f1fa67c6
SHA512561b33fd6ed54e789212d6a878a093343c5bc82b56b8fde8efe7a5f975a91d1d23560a172889bbc84508c7e82610c7ff5a428f8054f3f65d9f74d85952a93b5c