Analysis
-
max time kernel
73s -
max time network
134s -
platform
android_x64 -
resource
android-x64-arm64-20240514-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system -
submitted
21-05-2024 01:20
Static task
static1
Behavioral task
behavioral1
Sample
619699bc05aa8c38d67eaf6dde54571b_JaffaCakes118.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral2
Sample
619699bc05aa8c38d67eaf6dde54571b_JaffaCakes118.apk
Resource
android-x64-20240514-en
Behavioral task
behavioral3
Sample
619699bc05aa8c38d67eaf6dde54571b_JaffaCakes118.apk
Resource
android-x64-arm64-20240514-en
General
-
Target
619699bc05aa8c38d67eaf6dde54571b_JaffaCakes118.apk
-
Size
7.3MB
-
MD5
619699bc05aa8c38d67eaf6dde54571b
-
SHA1
4f614036e8c53016a0f8cab8b4043298b7c5f334
-
SHA256
b388990fde8dcfcde731b3188e59975d3c1f51f2f6678a23a4935259681018f4
-
SHA512
f520b30d2a3ca731cf4c69ad68411bd9a49f418482322303e72b05b6f4301f76cfae3098308b9c0ee8a8c5791b12df3026fa4745091626916dcd0885d384cee8
-
SSDEEP
98304:/vu7EUpGuvGuOWqe4gImR7lvDb+i3lyCkori+cGQxaTO:/WQU0Cqe4l+pvDbUCk9+cOi
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 2 IoCs
Processes:
com.nanoinfomatrix.Edu_Pathshalaioc process /system/app/Superuser.apk com.nanoinfomatrix.Edu_Pathshala /system/xbin/su com.nanoinfomatrix.Edu_Pathshala -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Processes:
com.nanoinfomatrix.Edu_Pathshalapid process 4591 com.nanoinfomatrix.Edu_Pathshala -
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
Processes:
com.nanoinfomatrix.Edu_Pathshaladescription ioc process File opened for read /proc/cpuinfo com.nanoinfomatrix.Edu_Pathshala -
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
Processes:
com.nanoinfomatrix.Edu_Pathshaladescription ioc process File opened for read /proc/meminfo com.nanoinfomatrix.Edu_Pathshala -
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.nanoinfomatrix.Edu_Pathshalaioc pid process /data/user/0/com.nanoinfomatrix.Edu_Pathshala/cache/1582435991586.jar 4591 com.nanoinfomatrix.Edu_Pathshala -
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
Processes:
com.nanoinfomatrix.Edu_Pathshaladescription ioc process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.nanoinfomatrix.Edu_Pathshala -
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
Processes:
com.nanoinfomatrix.Edu_Pathshaladescription ioc process Framework service call android.app.IActivityManager.getRunningAppProcesses com.nanoinfomatrix.Edu_Pathshala -
Checks if the internet connection is available 1 TTPs 1 IoCs
Processes:
com.nanoinfomatrix.Edu_Pathshaladescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.nanoinfomatrix.Edu_Pathshala -
Checks the presence of a debugger
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
Processes:
com.nanoinfomatrix.Edu_Pathshaladescription ioc process Framework API call android.hardware.SensorManager.registerListener com.nanoinfomatrix.Edu_Pathshala -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes:
com.nanoinfomatrix.Edu_Pathshaladescription ioc process Framework API call javax.crypto.Cipher.doFinal com.nanoinfomatrix.Edu_Pathshala
Processes
-
com.nanoinfomatrix.Edu_Pathshala1⤵
- Checks if the Android device is rooted.
- Removes its main activity from the application launcher
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Checks if the internet connection is available
- Listens for changes in the sensor environment (might be used to detect emulation)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4591
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
2Suppress Application Icon
1User Evasion
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD5e8e0527a01aefdb89afd2c508f131da1
SHA1f1103e6b260c657ceb3d95f1b023af3fda8b133a
SHA256f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce
SHA512fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34
-
Filesize
20KB
MD5fde2ee00cbd121cfab5290b078aa3ceb
SHA1e2b77d5320e155e413d040a8c20020962065b2f8
SHA2562897b0812077c654a9b3fbb0b6303d5cde681eeba7ad9981de65716c7810d685
SHA512a9326aff8e454a2b4ac09984ef2a65fddd4dc146b4c44d839035549bff8c9fdaae490326d0b018f76c1ca2e4fb25426d74f550ca0950982fba632a023af99a56
-
/data/user/0/com.nanoinfomatrix.Edu_Pathshala/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/664BF6E803AE-0001-11EF-0E2EC73CCB1DBeginSession.cls_temp
Filesize77B
MD59a99ae1209600f3594924aeb29acab40
SHA1db4a2ca30fd2e0884ad86b1b97028bac150a1be1
SHA256c74d030a70341c9979a7310b1686204299c230a70e822f506a1f767df7edf2b0
SHA512dd29304a9d4bb899387e4461b744848d09a93d85e3a476e45aacd3d047988aa2a337f3b8bc6e9bfb0a0a0829529ccb3dc390c77f20a591b5f5b0ed733d358211
-
/data/user/0/com.nanoinfomatrix.Edu_Pathshala/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/664BF6E803AE-0001-11EF-0E2EC73CCB1DBeginSession.json
Filesize132B
MD5bf5fc2b291b7ec3a9dae8a65f3c0e2d2
SHA162d4cdb26803438bc86ef9c961fd7e0e1c363219
SHA256c1dbaccf958c326615d6292a8f03754ac48a59d5fc217d13fa38b0b1bc330e34
SHA512831ffce90dc821fce336321a89396990b56c1230c7c84e8f0f70ab5deab69cef73bf201948ba665c293d7f6824985d8c81bd293a43ed973bb023208531491edf
-
/data/user/0/com.nanoinfomatrix.Edu_Pathshala/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/664BF6E803AE-0001-11EF-0E2EC73CCB1DSessionApp.cls_temp
Filesize126B
MD5bc2ea2c2d45fe8de12f34090ac3d9a6a
SHA14f396affd727d6d67e91522de5671273bd979bd9
SHA2567ffb84d43f23b0d7d20a0c22ad2422cb30a8f579ccbd83d27bc7b54ac9fca08c
SHA51273a42b0a071efb31e0a97d578f9b44a622ffdf1378587deeda25ae8be513141fa8af55476d51e60da1372d89bd79414562c4ff8268da464042b78cd50214aba3
-
/data/user/0/com.nanoinfomatrix.Edu_Pathshala/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/664BF6E803AE-0001-11EF-0E2EC73CCB1DSessionApp.json
Filesize240B
MD54b07d8c8909cd8cb3856da20d935c3d9
SHA191001c59b995de2071d7450fd938ec70169f445c
SHA256e82fc2d6a05fb559e2f3b14891c0415713123690ba040507b08b2ef0a578dd50
SHA5126543c2853529b0412e6e3c9465eae5a54ec3f33da118a8a5a09c81f3d15038ca427b22a4dfb33be3835d00fa9c3934f93b4720785a147c614edc3f71d192522a
-
/data/user/0/com.nanoinfomatrix.Edu_Pathshala/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/664BF6E803AE-0001-11EF-0E2EC73CCB1DSessionDevice.cls_temp
Filesize70B
MD52209a06d89f4cb30cd4d4c77fa928c7d
SHA12f2b8946538a4a79686d911c91eafbcbd998ff07
SHA2561eb87e1d5ce6357137e3e4883328dbb8cb5a09379bff2a452c2c9935ab132d3e
SHA512b650878c754bb4e51a3c9cf00847284c7a07fe6c4427de9a6bb45c631cd710bda3b140b366e56fa6f0cfa39a42e5c727cb4e2c15550c81aa7eac5b977f038a93
-
/data/user/0/com.nanoinfomatrix.Edu_Pathshala/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/664BF6E803AE-0001-11EF-0E2EC73CCB1DSessionDevice.json
Filesize204B
MD5cea190e17847586babb06db23116c75a
SHA13b3425579bc7e56ebf2d83b089c8c07edfc81e17
SHA256679c508891e72355ab13d2d8f0c861910aa8a823aa7d54167c5ca7c75170f622
SHA51244f674adb39e403fc4259c11bec7f25a952a1817f7735d91d068f037c4a11d4bdf382f67ddcd5203176406e6714bd8d5a2ad2136120b4274e8cf06dcaa7a26af
-
/data/user/0/com.nanoinfomatrix.Edu_Pathshala/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/664BF6E803AE-0001-11EF-0E2EC73CCB1DSessionOS.cls_temp
Filesize15B
MD5b3d9541cc92a9153d14e5160f8d8c008
SHA12e1ac80eb381dd82a03795b682f92020348c0113
SHA2561ead5b213c87f182ffce484c34f7d9f140ad3425c0f303f460492efe8a26c56d
SHA51278074409135a210ba4e1407ad9b3f784f5683e83aac4ce3482d4e8135425cf2b30db1ff5dd0041901c490a551a477237c6d255671c7b1fad74090980dcf3334f
-
/data/user/0/com.nanoinfomatrix.Edu_Pathshala/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/664BF6E803AE-0001-11EF-0E2EC73CCB1DSessionOS.json
Filesize55B
MD5fc1dcee4e422d77e7fab7c08c8a41344
SHA1d5340127e9d5f735b9d33b9dc61c772fb0e2dc15
SHA256b843f05ed78cd137c272ba7f0ce8ede3aa853098a856863e51d5c223b58f21c7
SHA5123ec07617e3e1008572f6f2528de9d4b827050cc5a7cf19a1604c961f9ec370ede6f5fd83bfcc252c0ee286fe244ee6734046ef1aa638dcfc689cd4407a6a8f61
-
/data/user/0/com.nanoinfomatrix.Edu_Pathshala/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap
Filesize1KB
MD562ed1b5e8e30f44528384a365b74ccca
SHA1bca825bec5dbef9aee959589dd47107b938b92cc
SHA256a0a0f49ec795e5dd3b77a4baf3176561d62ea1a560908f0fc5c82f0418b68bb1
SHA512f50658eef1589caae19a29f7fda9ed06d57237b47d3eb3d1a0f5504fb5462975dbdf3670bdd2f194543f00bc6cdf1ef8a1d1dd41157c81c3dc94f19446bbd2d4
-
/data/user/0/com.nanoinfomatrix.Edu_Pathshala/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap
Filesize475B
MD534f9958c333062c26fe58f82e28c7f01
SHA15e518afc445c07e21a2a9552193cd77d33c6bd37
SHA25646490ad7db701067ad2acb4234cd03c7b0e367ed1a18f7451b31eecac4deb076
SHA5128af99a81f88ea0acdc2140b482d7714f83b99978547a2d1ea28b29ab194320fac5cdf7f29d1b7397d556fb800bb71fc30e64b3b9735f44ba8231775e1d38d92c
-
/data/user/0/com.nanoinfomatrix.Edu_Pathshala/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap.tmp
Filesize16B
MD5c33583fae4e0b61cde1c5b9227963237
SHA1fe2ebe4d27469af1460f7e852031a04208ef629b
SHA25635c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
SHA512fa09047004bec791b23f0dade0b64f8ab9bbd67555505e0d0818f6e89dfe56f474df80db0786d081d36adf23a5bacea40275ba043444a3a85d3d9612575bdd1e
-
/data/user/0/com.nanoinfomatrix.Edu_Pathshala/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_364e889d-04e1-401f-949b-ec65b6bec5fc_1716254457521.tap
Filesize446B
MD5f21d41932b8691e81d4a09794d8bb726
SHA10d0fca878a42ed56bd0d423205adad95ab9c2c43
SHA256d38a6efc42cf2c2682f396b0ac502f526f0037b72d785460d4fcc78b22d08baf
SHA512fc453b20dbf7367f953394052c8529f16cca7acb3d7f79eb4b7899b54b7a98dc999c00dd85dc811706e1910b54b4da642404c91b202662e41d3824ef68c00f9b
-
/data/user/0/com.nanoinfomatrix.Edu_Pathshala/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_c510c8ad-7208-4fb0-a869-11c75ec44620_1716254441349.tap
Filesize374B
MD51ff07b4b4a81462d303d6683f8767388
SHA1ab5df35dc30f6489b96b2834c4175792c1d250f3
SHA256d9c15a2a4439da9cfd0f23e111a64f7874bd7218e2f0fa27bc7aa9bda74c0dd7
SHA512eebac554db1a6a53e272883c53efd721e8bcd133744531f1bc7a0307d25aa7cc918d9e263fd1c24ce065e125d8da5864f7770b9c6a72386eb2fe83c602c2a5f6
-
Filesize
36B
MD5cb7d32bc1ae34af6d33e6600ea1f0410
SHA10916bb16012d353a22401b6e1236f75262695dfa
SHA25696d2a86b6bba7a201820716392e86ce3645fd68332cb1497621ebbd07c2f8f13
SHA5127d568ce2dc6c89243ce8afabb267cdde96d890ed06ccf5c387a0b4a040e1e71c73effb4b8aadab256bcdaa9d1059b850286814f0e8fb8d91cd02f7b400b65130
-
Filesize
358KB
MD5823346d9cf7ad857698594efa439d03d
SHA1c4b3ed17fbaf5baaaa7cadd606490261a59ec6a2
SHA25661f2361d12d6e00f21b4f1a3b3da88e3a83be0377e65c114db8933aa4e8b7dd7
SHA512f1fa3b49932b7c8728d22980b8909b80fc7f74f1d235941c7fe335dd7d0b47b64b92cefedcdb1e68100b3c53f090916a0098bee13408b99778b77013e9962d78
-
Filesize
631KB
MD5e14aa374a3098d17bb1f2c224edf4939
SHA163020b5cf238c66265a673c402d5cd814e987da6
SHA25653233f371734357aaccb6c2648f61df974891430d0fb4c4289fbf02f05546660
SHA512599d9b2f4f23c2cf879fb29c89b5aa25e83fe749faf5f01933019d0f50974992da3c4dbf8180be4c194ed4b5cc5fdade273fe5f02290e13d50fe57877b777fe6