aec59b898df119246fdcc159a0b4b07738a073a02ac59c9d2eb920c2a717bca8

Analysis

max time kernel
44s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
21/05/2024, 01:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
619ec51a31bafd08dbf2d46ac33a0fa3_JaffaCakes118.apk
Size 12.5MB
Sample240521-byrd5sec7x
SHA256 aec59b898df119246fdcc159a0b4b07738a073a02ac59c9d2eb920c2a717bca8
MD5 619ec51a31bafd08dbf2d46ac33a0fa3
SHA1 cc276f65da959a39c7b69b906790db6f7c43b8c5
SHA512 5d96af996f522ab31a698c25a756327ca834aec2bfc575d96186abba35d4dbcdec407e7d47d9b51837703190c84172d4e6690056d729e016381e36833486c890
SSDEEP 393216:unsRF0Dylf80uUue4yZmJl6+3hXxJ85Pc/1p:6/KoeMJl6q/6FM
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection discovery persistence

Malware Config

Signatures

Queries account information for other applications stored on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.nebula.mamu:pushservice
Framework service call	android.accounts.IAccountManager.getAccounts	com.nebula.mamu:playcore_missing_splits_activity

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.nebula.mamu:playcore_missing_splits_activity
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.nebula.mamu:pushservice

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.nebula.mamu:pushservice

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 3 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.nebula.mamu
Framework service call	android.app.IActivityManager.registerReceiver	com.nebula.mamu:playcore_missing_splits_activity
Framework service call	android.app.IActivityManager.registerReceiver	com.nebula.mamu:pushservice

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.nebula.mamu

Checks if the internet connection is available 1 TTPs 3 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.nebula.mamu
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.nebula.mamu:playcore_missing_splits_activity
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.nebula.mamu:pushservice

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.nebula.mamu
1⤵
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
PID:4213

com.nebula.mamu:playcore_missing_splits_activity
1⤵
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:4273

com.nebula.mamu:pushservice
1⤵
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:4353

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1424

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dbffe9a8c48a783127b7eb9c22b5a9b1.0.tmp

Path /data/data/com.nebula.mamu/cache/http/dbffe9a8c48a783127b7eb9c22b5a9b1.0.tmp
Size 526B
SHA256 194658e1d58aede2752c90391dc5d2acbef1ec6b0a651ad580a10709698704e9
MD5 f9536c43972184f85edbe914bc517259
SHA1 cdf871adab330c13fb098268e54dce0b0dea06f8
SHA512 da5f9def43ce0a72b6e6834008fc1f2d9139f4d291eef89cb017d4ed4580f9babe88284e3129b924eb13284ff437751b1353996a098c6ed213172d2addff5b9b
MD5 SHA1 SHA512

Submit Download

dbffe9a8c48a783127b7eb9c22b5a9b1.1.tmp

Path /data/data/com.nebula.mamu/cache/http/dbffe9a8c48a783127b7eb9c22b5a9b1.1.tmp
Size 316B
SHA256 a0154a6c2224406d35e987d678d4882de997e72e03469acc91ed88086cfdee5b
MD5 655c73e27d762a1c036166ddbbbcc9b1
SHA1 7176205a39bf0d6787bf5e62606d49b2e7f67bec
SHA512 fc7c6588f9f10087d7d5c473ed176ed13901cf3969d107f0b37bd207e3490a7ec0e43a9154dbbcc6071d4bd1842321cdc3aec7e0a605cb4aa20c099bf5b1d58b
MD5 SHA1 SHA512

Submit Download

journal

Path /data/data/com.nebula.mamu/cache/http/journal
Size 122B
SHA256 44fadd53fdbb0307ffc2f2578436db50529b09fe7d43c0c4908eeeb2f727b220
MD5 ef6d11bfc618859f00ce575cfa6d6127
SHA1 acd71030b9d0b7cce332828c8652594efd42c68a
SHA512 30915039790c48869d9b14e171cec71eac7d5c2284891222de610a0f957c56b17ec8ddfe34f449a094a4c77318480d6a0932113b7a6e0b697e638e6bd46df763
MD5 SHA1 SHA512

Submit Download

journal.tmp

Path /data/data/com.nebula.mamu/cache/http/journal.tmp
Size 36B
SHA256 7080cb592d5149c858b206d3fd0d5e3e7d601f120af00b2616bee928ee1291ca
MD5 37e8e716e0e2f4a0b05cd9571d95b84d
SHA1 f8d068f6931707bddb8cd69f706f2224ad1fea3c
SHA512 e62b850901835fdb73fa6224618422f721dd765861d42f6bc2dd013413e96bd910ac5313afd9b4f63da74beb12a15fac81b5157456c9caa3031862dab84423f6
MD5 SHA1 SHA512

Submit Download

geofencing.db-journal

Path /data/data/com.nebula.mamu/databases/geofencing.db-journal
Size 512B
SHA256 9b4c3d62228f664de5f258765dab930226026635aacb16801740162282c642a7
MD5 69ba81946de52f4e91ea63477cc3ef6f
SHA1 9f1fbacdd1e81144c1683b6d23ec9f28e4f8c6ee
SHA512 b4c19370064a411495a7e14b6c3b0a52c4c0bd4b6daa815ede6e368f6a15acdf6b9fa7e95446389157e248a0e932c867291cb2b89075d938ba8ba91ceeb63b19
MD5 SHA1 SHA512

Submit Download

geofencing.db-shm

Path /data/data/com.nebula.mamu/databases/geofencing.db-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

geofencing.db-wal

Path /data/data/com.nebula.mamu/databases/geofencing.db-wal
Size 40KB
SHA256 1e514dabf392bfa6641dfba119f667553b596e5c792a230a3bc7d502aea336ad
MD5 ea12eed4cd49f3444012e9c492c3eed1
SHA1 b5175d2e06eac2fe07f1a33b77269888505a289a
SHA512 c11d1845c932884e36fc1c7a7b4271b63ebba54dccdfc5b129b79dca4c6650deaa1cb4d99c2bc853dea8a31953b90d8db56a2ab90b906a70cbc2d5b46680bc3b
SSDEEP 48:OmzNSP/aF59ufPQq2+w7gHRSP/JvP4Kuf:Oe0P3wPRvP4
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.nebula.mamu:pushservice

Path /data/data/com.nebula.mamu/files/com.nebula.mamu:pushservice
Size 371B
SHA256 ef2fabcfbe798e6969a592ea53fc850271bc222c399fa6af3ae48a952a45e180
MD5 8ad716216e6044f77fcd512af68385be
SHA1 8b149eb0e989fabd3ae70f55f816aa7426fafa44
SHA512 d00f111204ef0e2e269d1e9aac22424c2d388f33d1933eb0a9f7ddd5c3ae391339e791c6754edc78be1c672be1c92ea74cda97563559499e1adc2f5ad5215240
MD5 SHA1 SHA512

Submit Download

com.nebula.mamu:pushservice

Path /data/data/com.nebula.mamu/files/com.nebula.mamu:pushservice
Size 1KB
SHA256 3f25c064ca4f077d6031023c4e07b463fc941dc2cc83cd52e7ea2c653448f730
MD5 62b7981f324440d38e3370212dca142c
SHA1 9b3b1b6c5b5fc807704fa60bb037ad15d06dc63a
SHA512 ed36792e2a7428b3f19eb8f036740aa2cbb7ec2f764c02c99d686858ea0d0e107f6a9df12aa175a871ea0ba37d60259da84a5d735b04e7089cb648cc4d4867da
MD5 SHA1 SHA512

Submit Download

com.google.InstanceId.properties

Path /data/data/com.nebula.mamu/no_backup/com.google.InstanceId.properties
Size 28KB
SHA256 c14b81f1de9ea7414f9ab576df19d63c1d4f22750ab37f0800a7a0ee6a15a70d
MD5 1deb6b895a2280f63ea2f3783f0a5ebd
SHA1 c01eee51a200d2007d3972b551e2515fc8f96d95
SHA512 269affd56d83a323141c44f786128a60d501d4e0ede0c4b7d9b5757a2e40851872c801dc1355c62c0607b95b1e42e2bf0b824d0230e1455655d1bb020c6a45e4
SSDEEP 12:TQAufRzHalD9n6+4DOwR5VwgQFODFORQuObrR+Ge+G7KrHPUJOmsRmBEyPbGtOwI:T9uf5OmnQFOFG/+e57gH+GSiI
MD5 SHA1 SHA512 SSDEEP

Submit Download

log1.txt

Path /storage/emulated/0/Android/data/com.nebula.mamu/files/MiPushLog/log1.txt
Size 107B
SHA256 fa86ad96e85b13abe3729392a4b7681d23a6f42e74ac5af95abae07a48267c86
MD5 5e3279aef0a16a28175c1e6977a2c570
SHA1 5b730924040a16ef481f98a259b7b66cc83c7a1b
SHA512 31fd8a93a0557a3f4cae105ef148dbb14e4cd48c9e57085b2d3ed7e105667a93aaaf34a275fe034c41b434e3e387067b9b0cc3743d3ae3ccc9489e0112c0a119
MD5 SHA1 SHA512

Submit Download

log1.txt

Path /storage/emulated/0/Android/data/com.nebula.mamu/files/MiPushLog/log1.txt
Size 382B
SHA256 8acf8425bf02c064b1f2a1ea4b81863e2d242ad87eaa8b43ceba1c79aad4b347
MD5 a17cc45f49f51b902827aaf90cc12ec2
SHA1 f10b8f26b53626e8ac1a5cac74a6f79f6803200b
SHA512 26491dc7160ca8d73beb1664e341d89993b9f03cb84d3c7b69520a46ed7cf1947cd3ba44b78f7e3ffa438077550ef4b89808c38eaa4098603f09b1a96a08da7e
MD5 SHA1 SHA512

Submit Download

log1.txt

Path /storage/emulated/0/Android/data/com.nebula.mamu/files/MiPushLog/log1.txt
Size 482B
SHA256 6e442253f1058700a1e076a3ab6acca3f2f7fada1871b1178d94f0003271302a
MD5 9d5e16489c9db6d72017099045f9e77c
SHA1 6e9208ad9c73e42048652978edf9477da84b8f56
SHA512 f2c77cdda6a4830027636021a16c4348af69a63f3ce67d5cd3b90779bc709e6c9a37fd9c065def4e87317130ff8dcb7f913e1b615ada144d37c73fee32625314
MD5 SHA1 SHA512

Submit Download

log1.txt

Path /storage/emulated/0/Android/data/com.nebula.mamu/files/MiPushLog/log1.txt
Size 557B
SHA256 398af8e7a4c6681bee64e19eda69d9d4faf263774a55e0a45a6a5a39b5964bb3
MD5 332a358ff99e94342dd4547a50221691
SHA1 ee9f0e36c12e7d34118cc4043d2293d7b5e3be0b
SHA512 f9f5d68f5b2bae6c77444517ace319f924c32bf0e5c204b8f910cd3eb639d323a2999a4061013bb1e5542985bfc317b6b163162782062db4a34fdabd5fb1a712
MD5 SHA1 SHA512

Submit Download

log1.txt

Path /storage/emulated/0/Android/data/com.nebula.mamu/files/MiPushLog/log1.txt
Size 210B
SHA256 0096558a1c0d70fc0c184ff3204ba6991309d983a2720bb23852e35a4fd54ad2
MD5 1a8d63e380a638b561ce010d6a8c157b
SHA1 69eecb6651a492ff2bcc4c976592ddd11ff2d7c5
SHA512 339e19b2481fdcca88db6a67951868a15d18dd037e434d0d385f29d4a6cd3acf31866c4ebc8b413a357b175ec5de6eeae1afc0894b3a83c50d737d06724a292d
MD5 SHA1 SHA512

Submit Download

log1.txt

Path /storage/emulated/0/Android/data/com.nebula.mamu/files/MiPushLog/log1.txt
Size 501B
SHA256 f77c78934d7e695f294282d4d8f33cc505a45520d1c4b7ab01a97f4ae5b43879
MD5 ecf0b01e765e3a1015fbfea6e00a1f8f
SHA1 d663c0bfb0ea47317543945b376fa293f9144910
SHA512 0c616beadb44a2e984193f246d2efccee553fffd9a391821b1a04a694c16af5dc251383bbfac68f82d8acb429217ce61635b5daebb26c65c37a9c1697c9f6c02
MD5 SHA1 SHA512

Submit Download

log1.txt

Path /storage/emulated/0/Android/data/com.nebula.mamu/files/MiPushLog/log1.txt
Size 557B
SHA256 e6dc6dff3bd8ac0ba9a8e15a764a186a76c43b1a6e71fc208a89d9c139d081cd
MD5 8fe833b8c22082ce071a6bc70b0ed1f0
SHA1 0186e15c19fd57268f7a2e645f142d777dabb08e
SHA512 82ef2774d643a23d3d67698658c6266c18a2b4962dac015dc39ec6030387c13e8e7a53dcc7ade6a8ca881ca684cfa655e65b4082dd8c93d1f7c879f417b2b22f
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads