aec59b898df119246fdcc159a0b4b07738a073a02ac59c9d2eb920c2a717bca8

Analysis

max time kernel
50s
max time network
150s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
21/05/2024, 01:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
619ec51a31bafd08dbf2d46ac33a0fa3_JaffaCakes118.apk
Size 12.5MB
Sample240521-byrd5sec7x
SHA256 aec59b898df119246fdcc159a0b4b07738a073a02ac59c9d2eb920c2a717bca8
MD5 619ec51a31bafd08dbf2d46ac33a0fa3
SHA1 cc276f65da959a39c7b69b906790db6f7c43b8c5
SHA512 5d96af996f522ab31a698c25a756327ca834aec2bfc575d96186abba35d4dbcdec407e7d47d9b51837703190c84172d4e6690056d729e016381e36833486c890
SSDEEP 393216:unsRF0Dylf80uUue4yZmJl6+3hXxJ85Pc/1p:6/KoeMJl6q/6FM
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection discovery persistence

Malware Config

Signatures

Queries account information for other applications stored on the device 1 TTPs 3 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccounts	com.nebula.mamu:playcore_missing_splits_activity
Framework service call	android.accounts.IAccountManager.getAccounts	com.nebula.mamu:pushservice
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.nebula.mamu:pushservice

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.nebula.mamu:playcore_missing_splits_activity
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.nebula.mamu:pushservice

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.nebula.mamu:pushservice

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 3 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.nebula.mamu:playcore_missing_splits_activity
Framework service call	android.app.IActivityManager.registerReceiver	com.nebula.mamu:pushservice
Framework service call	android.app.IActivityManager.registerReceiver	com.nebula.mamu

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.nebula.mamu

Checks if the internet connection is available 1 TTPs 3 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.nebula.mamu
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.nebula.mamu:playcore_missing_splits_activity
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.nebula.mamu:pushservice

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.nebula.mamu
1⤵
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
PID:5216

com.nebula.mamu:playcore_missing_splits_activity
1⤵
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:5292

com.nebula.mamu:pushservice
1⤵
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:5339

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1424

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6f04d384ca28e37db6adee2d6c8a0d00.0.tmp

Path /data/data/com.nebula.mamu/cache/http/6f04d384ca28e37db6adee2d6c8a0d00.0.tmp
Size 526B
SHA256 188acc6f84812ef08544f9b85135e64874ea661f64b7101ee816098fc990f8a7
MD5 7f66ced0f041085d0cfe7f9a304f8fc3
SHA1 1eb7ea035f4fb02b86f8fae7df2493a2b42db11b
SHA512 89f30d9efd92193a6ab40a3e41ebbf3fe47f095ef04180a977ad73a6c474be6fed4caa4391a7ba27f71948df500f22cca0bed9796307cc7f3c7fcbf149912c61
MD5 SHA1 SHA512

Submit Download

6f04d384ca28e37db6adee2d6c8a0d00.1.tmp

Path /data/data/com.nebula.mamu/cache/http/6f04d384ca28e37db6adee2d6c8a0d00.1.tmp
Size 316B
SHA256 a0154a6c2224406d35e987d678d4882de997e72e03469acc91ed88086cfdee5b
MD5 655c73e27d762a1c036166ddbbbcc9b1
SHA1 7176205a39bf0d6787bf5e62606d49b2e7f67bec
SHA512 fc7c6588f9f10087d7d5c473ed176ed13901cf3969d107f0b37bd207e3490a7ec0e43a9154dbbcc6071d4bd1842321cdc3aec7e0a605cb4aa20c099bf5b1d58b
MD5 SHA1 SHA512

Submit Download

journal

Path /data/data/com.nebula.mamu/cache/http/journal
Size 122B
SHA256 9e48949743419b245d4d8c17cdec1049736702b17ec9153d628c90021d5ad6fc
MD5 728d9f29646da0964b256c3a68fe22a2
SHA1 1ae918e32089ee8911d12fb98736c08f7e328353
SHA512 626293e3ba538bf7004f04fa69e904cd9e6b0a47d120748ab5b6a7c222819d04c7ff98c90dd308df377ff506a2ab361104dfaa45f8c05886faab027f2960d7d9
MD5 SHA1 SHA512

Submit Download

journal.tmp

Path /data/data/com.nebula.mamu/cache/http/journal.tmp
Size 36B
SHA256 7080cb592d5149c858b206d3fd0d5e3e7d601f120af00b2616bee928ee1291ca
MD5 37e8e716e0e2f4a0b05cd9571d95b84d
SHA1 f8d068f6931707bddb8cd69f706f2224ad1fea3c
SHA512 e62b850901835fdb73fa6224618422f721dd765861d42f6bc2dd013413e96bd910ac5313afd9b4f63da74beb12a15fac81b5157456c9caa3031862dab84423f6
MD5 SHA1 SHA512

Submit Download

geofencing.db

Path /data/data/com.nebula.mamu/databases/geofencing.db
Size 28KB
SHA256 bb849c39f9a2c72b4b34520ff09d1eef151a053e7c9b3874ca80e8d378a12b9c
MD5 cfab1313b6bc4be5c38f024fba1d7195
SHA1 bd3988e3c05d66889d311e06cd577c05a88a4cb6
SHA512 60394e4bb665c2c629bd5ba938858e896355de7850f958b9d9a1bb9beae3b17b281e937cf8868ae252f6dcc46d10985ffe00d2b7bd3adc8a3c30c2052db52099
SSDEEP 12:TLZJufRzHalD9n6+4DOwR5VwgQFODFORQuObrR+Ge+G7KrHPUJOmsRmBEyPbGtOJ:TLnuf5OmnQFOFG/+e57gH+GSiI
MD5 SHA1 SHA512 SSDEEP

Submit Download

geofencing.db-journal

Path /data/data/com.nebula.mamu/databases/geofencing.db-journal
Size 8KB
SHA256 7a0478383cbb38ce8a34ba1ba0105cdfdcd43d8a439b3a4502f3957abffb4a2c
MD5 d7b769c1568efda4a1a08257308f8123
SHA1 48a83b1dffc14859f3cc88fe7dcb2050ef55882d
SHA512 7b8eba6b9c9d898f70179b4226a4c234866b7c76a2fbb07f379064293e1b4d29641b07dc1971aa7220b9302f8e887f6d19b8e2c9f935683d3694c56541ede976
SSDEEP 6:7+/l9zu4n1Kfg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKoJK:7+tRutqLiuWdwRmBEyPbTK
MD5 SHA1 SHA512 SSDEEP

Submit Download

geofencing.db-journal

Path /data/data/com.nebula.mamu/databases/geofencing.db-journal
Size 8KB
SHA256 94b8ad3fff63d4ee9e6c56dcf3a013aab7d0a4be92c576302059ca219ab5fb3f
MD5 e5bdc9abfc1b111f0c847c3911ccf568
SHA1 ebea55db100a4b9498262a665a6904a74e34f2df
SHA512 7739c99caa3414de64c65eb7fd9ba5f8cb71b608a0295b340f3e1a5460f119df29e33798c365df86ebea8fe96806324312f29ac31809dd9e592c8ef2c81f62ff
SSDEEP 6:7+/l9pPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKC/y:7+trqLJdTRmBEyPbFy
MD5 SHA1 SHA512 SSDEEP

Submit Download

geofencing.db-journal

Path /data/data/com.nebula.mamu/databases/geofencing.db-journal
Size 512B
SHA256 e90ee20c581c0edcbee21034057b6f3c578e931583f35efae93e857707f8b8e4
MD5 3dca7028e9a261c7d7c4f300c45c0ba6
SHA1 a9af2b6e81c8dd257cbb3aea37a0324de1a27f09
SHA512 956f326b5facf30aa586c96b6a94b7ad7731f53b26ac17ce283556512e67f22a82d93d583c867553bd957ebcaea7bfef9d29643d905057291ac65560fb406bfb
MD5 SHA1 SHA512

Submit Download

com.nebula.mamu:pushservice

Path /data/data/com.nebula.mamu/files/com.nebula.mamu:pushservice
Size 371B
SHA256 b169dd330d8dee67ca0ab0262596adf9b792c4f2f5c547ef35ff75ed6d1e7a22
MD5 0e8394f2ec01cc65ef7ce155f9e95276
SHA1 7569ddb6ba970355ce981a01c84040a081968aca
SHA512 009287074c54018f9bb97b6a65a8a4b55cb29f9a5f6c1da8704e5b2f19a805afaeb7dc616b74a307ef564fb7b778b8b7c453eb92b9f6f3b300ce5289fd56d2fd
MD5 SHA1 SHA512

Submit Download

com.nebula.mamu:pushservice

Path /data/data/com.nebula.mamu/files/com.nebula.mamu:pushservice
Size 1KB
SHA256 df359b217a9bc32944497962b628e0d3ad644d0d5f9d7d0a6e46977c13a11cae
MD5 3e56c1e1754c20073d02c50b1efce6bd
SHA1 481e2ad47ddf53bc8b549b3e4f4f0afd9615694f
SHA512 53a2e113b031687d0ed6f69d5a20d0cefcf7678dfc7d0d7a63a72b1484ef2cc3bd507f04ef49bf1375239e3b5755dc90f40ce1aa8a79942b22138752c96e5468
MD5 SHA1 SHA512

Submit Download

mipush_region

Path /data/data/com.nebula.mamu/files/mipush_region
Size 105B
SHA256 b25644a0e7973e3231f22c699577b058bfbf1e4e7b7e5243ca94ad405cfa897b
MD5 e5e0b4efa9eaa7bceaffee70fc0cf2a2
SHA1 10a44e2d049cf0e41055a6216f29c16c055160b0
SHA512 6262e96b4aed656e4e62ab7a10d51c2319aef41a0f22ace46aaa785ceb2e26aecea61c034a0b80f10b09d1936ea2644c91295087ed5473315ebdb8a7d4c01485
MD5 SHA1 SHA512

Submit Download

log1.txt

Path /storage/emulated/0/Android/data/com.nebula.mamu/files/MiPushLog/log1.txt
Size 539B
SHA256 bef92a079cb545f24751963dba924a06c63e576ff33bcecbc81af5a0dff9ed0b
MD5 12cb3116b740d6c8ee497edcfc837a07
SHA1 44f86700bd09a7421f2d55ce67245e64a88abebe
SHA512 23522a0db3ada935a1f6eb92746754d4b8fe89d4890c89f55f7fb1c2efafef6585a3fa2559970ecc5746f16ad7f67719cd2d06e1a1a605ddf040fb31592b0b05
MD5 SHA1 SHA512

Submit Download

log1.txt

Path /storage/emulated/0/Android/data/com.nebula.mamu/files/MiPushLog/log1.txt
Size 557B
SHA256 ddf82b7fffed83126cf09d9209f4b43615c699d744a7fd6fe475604a035a36f2
MD5 55ef571f1c9471308aa2a0ce69401b8a
SHA1 6ecff3aaacab7b07ed5f82cac70954cf8b1512b0
SHA512 983e7ad5fcc38e067bb62c54c8d903815c237bb35385cca5bb8d036e371a4657c396fc0b35fb105a935fb2e1a10783e404ec7471a80a87af1b05171d8d141a07
MD5 SHA1 SHA512

Submit Download

log1.txt

Path /storage/emulated/0/Android/data/com.nebula.mamu/files/MiPushLog/log1.txt
Size 405B
SHA256 307f4337263388086886396a09b1d53dd7b9b872ce89b6e2b04a39d5fb98fbd0
MD5 9be6d8fc64b9eb96f19c8b804ca0dc68
SHA1 6ca7a95bd30d3ea27642cdd882b38f56adec93c2
SHA512 29f2842b41ec19a7e5d90db67b201d94577ee0dce1e303d9ba3d30afedbd9be823a62d19ecaa56231bb5a4e1d9707adf87e1152363e8f49d8d4bc62721a46d96
MD5 SHA1 SHA512

Submit Download

log1.txt

Path /storage/emulated/0/Android/data/com.nebula.mamu/files/MiPushLog/log1.txt
Size 343B
SHA256 58053ecc57097787bfe42c201b61000ccd04943f6da2cad71e35e2f741b4f047
MD5 5d0e96531d4b28752f80fe369c2813a6
SHA1 502e285a77d035d3acedc58597a53e7cfb79f0c4
SHA512 6a686508ed09c0028c070e3b82dd2a3b318253fd8dd492867fde54e621366f8a5468c2a3ca8a3caf24ff73d4491ae92fdb1ec8de2fb511f2f3fdd3cb1a7b49f6
MD5 SHA1 SHA512

Submit Download

log1.txt

Path /storage/emulated/0/Android/data/com.nebula.mamu/files/MiPushLog/log1.txt
Size 105B
SHA256 e7ba0e6a3d71efab190a11054aabf51f8f1038fdbd32c80bb3286d344f0d6d32
MD5 0e34faf16fc2cd3ff2a622bdda75097c
SHA1 0179fab57289133cfd8f9e56b9db91480fb86a4f
SHA512 d6a656a411dc303e5c092da03863f47386af941275170e4b79fa17de0168b066daf8646c40cecc6ba9c7dc00d28becbaa366ef41ab742d8fa17082c100f54978
MD5 SHA1 SHA512

Submit Download

lcfp

Path /storage/emulated/0/mipush/lcfp
Size 33B
SHA256 f6a329e31d8815ce5e492973c3d797e29bb54ddd2fab9a729e9a218c7b1ada54
MD5 3098f097e6215abf804a5261c84860a0
SHA1 fb08555e103b1a35518d4d0fca852109aa6a5207
SHA512 273ddd556d00f1e2d16f350a5989c70db4711aefa6c4f1a74b9d4c3f3e69fc87c005fabe557d06d708b89a05f97af6b0e913e5bbd11e7b116ea923c99e705501
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads