aec59b898df119246fdcc159a0b4b07738a073a02ac59c9d2eb920c2a717bca8

Analysis

max time kernel
46s
max time network
170s
platform
android_x64
resource
android-x64-arm64-20240514-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
submitted
21/05/2024, 01:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
619ec51a31bafd08dbf2d46ac33a0fa3_JaffaCakes118.apk
Size 12.5MB
Sample240521-byrd5sec7x
SHA256 aec59b898df119246fdcc159a0b4b07738a073a02ac59c9d2eb920c2a717bca8
MD5 619ec51a31bafd08dbf2d46ac33a0fa3
SHA1 cc276f65da959a39c7b69b906790db6f7c43b8c5
SHA512 5d96af996f522ab31a698c25a756327ca834aec2bfc575d96186abba35d4dbcdec407e7d47d9b51837703190c84172d4e6690056d729e016381e36833486c890
SSDEEP 393216:unsRF0Dylf80uUue4yZmJl6+3hXxJ85Pc/1p:6/KoeMJl6q/6FM
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection discovery

Malware Config

Signatures

Queries account information for other applications stored on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.nebula.mamu:playcore_missing_splits_activity
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.nebula.mamu:pushservice

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.nebula.mamu:playcore_missing_splits_activity
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.nebula.mamu:pushservice

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.nebula.mamu:pushservice

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.nebula.mamu

Checks if the internet connection is available 1 TTPs 3 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.nebula.mamu
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.nebula.mamu:playcore_missing_splits_activity
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.nebula.mamu:pushservice

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.nebula.mamu
1⤵
- Acquires the wake lock
- Checks if the internet connection is available
PID:4627

com.nebula.mamu:playcore_missing_splits_activity
1⤵
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Checks if the internet connection is available
PID:4705

com.nebula.mamu:pushservice
1⤵
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Checks if the internet connection is available
PID:4750

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1424

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9369d2cc3c6a49c0381c32d90a5ef51d.0.tmp

Path /data/user/0/com.nebula.mamu/cache/http/9369d2cc3c6a49c0381c32d90a5ef51d.0.tmp
Size 526B
SHA256 183a30fc8819fd53a45d478ba20f175b169078af36d125b1b2e38e4b057b8947
MD5 2fcfa585b79befec033b9aad44e98b22
SHA1 5edaafb2a1dc4a3ef33f9e30ba6f8a20f32b089a
SHA512 6fd4eaf9e19a43d4ab543bb435a0f9f75e67a0e5f01bc46e9bc63a58cef33ba4593a17631d4103b315e4301f14b155d831319995d1a944101ffb37aa3f2a7df9
MD5 SHA1 SHA512

Submit Download

9369d2cc3c6a49c0381c32d90a5ef51d.1.tmp

Path /data/user/0/com.nebula.mamu/cache/http/9369d2cc3c6a49c0381c32d90a5ef51d.1.tmp
Size 317B
SHA256 2503a13ca7e71c3ac1cee65b0f168c6c3d7aaa1a1c48cb66d85dda35a51975b4
MD5 b353bfa9b44e916882fc97d8d483f48f
SHA1 8d7666bcf5f1790e28cdcd6cd11e5a3761b044d1
SHA512 feffd787ba24b80fdb0ba8d31f7f137f6d465b2f67e3d32b4328904771c15b1d33e8ff59b9c81b9f97363c915b876d198245bf04471fbe9e72b4e05fe1d6874a
MD5 SHA1 SHA512

Submit Download

journal

Path /data/user/0/com.nebula.mamu/cache/http/journal
Size 122B
SHA256 80def86814046fdb920a2b008775478dd5091118bfade27567cc642f61894e75
MD5 9fab70635f1efb6b2d4abb1ede4435ab
SHA1 e6fc7eb3c1f4d9f564c83199f15b84cefc5192a6
SHA512 f7981d97f2efd2ea2a8c56fa8f191de3f116fee27b6a089000189838cdf9ee0b5c8876d32594b8272bb0816067bb0af8df981ec69694a50bc7d5f305c3cb9afa
MD5 SHA1 SHA512

Submit Download

journal.tmp

Path /data/user/0/com.nebula.mamu/cache/http/journal.tmp
Size 36B
SHA256 7080cb592d5149c858b206d3fd0d5e3e7d601f120af00b2616bee928ee1291ca
MD5 37e8e716e0e2f4a0b05cd9571d95b84d
SHA1 f8d068f6931707bddb8cd69f706f2224ad1fea3c
SHA512 e62b850901835fdb73fa6224618422f721dd765861d42f6bc2dd013413e96bd910ac5313afd9b4f63da74beb12a15fac81b5157456c9caa3031862dab84423f6
MD5 SHA1 SHA512

Submit Download

geofencing.db

Path /data/user/0/com.nebula.mamu/databases/geofencing.db
Size 28KB
SHA256 c868403f9d24d714f160615185a0007a01b12595106593e2c05d35574549f32d
MD5 7ed68d9bd74d3e805b930aec2e262a3f
SHA1 25b73beefe15e25917a413f108828d9e715df5f1
SHA512 aeef05c1ba41fe1907ff1fc6d761415a31978efc53c5f936a8db2d6098ea59280a027756ee51bdf252d6188010b1a7cdf35a786e6423e52f7f0394495427d903
SSDEEP 12:TLZRufRzHalD9n6+4DOwR5VwgQFODFORQuObrR+Ge+G7KrHPUJOmsRmBEyPbGtOJ:TL/uf5OmnQFOFG/+e57gH+GSiI
MD5 SHA1 SHA512 SSDEEP

Submit Download

geofencing.db-journal

Path /data/user/0/com.nebula.mamu/databases/geofencing.db-journal
Size 8KB
SHA256 f6d3dd00292bac7ea49c203cc0d0e16cfa0d98b5011bf6ee556f11c400ea895a
MD5 687894b6ddc17460760fe0cc1744d8d8
SHA1 b91b9f0b605bec96a95f1c1283fd61dea3f75569
SHA512 9b8678318983721cd04fe489ebaf6a6d9168b2b5ffcbe039ed0fdcf13836fc620b8767830c30456f5af9e7ba50750c9b38f8caa2a35fd106fe403774a4fd9225
SSDEEP 6:7+/l9K4n12g9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKr:7+tEqLiuWdYRmBEyPbs
MD5 SHA1 SHA512 SSDEEP

Submit Download

geofencing.db-journal

Path /data/user/0/com.nebula.mamu/databases/geofencing.db-journal
Size 8KB
SHA256 549beafb940937c9dc7732edebfa406ac8b8146ea087506612840ea10faf5228
MD5 b21978aa496b944003b11cd4e1ab1dde
SHA1 e6e4a6dff62bcf60df8166852337df2449393487
SHA512 21dde05ee435ab16a92959d067b65d48279f110b0508a73bb76875a511c1428f7615850b0ed60f86029afe2fa8499c6dddad623a338c6ed1482e88fa181e39fa
SSDEEP 6:7+/l9zyGPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKm/Li:7+tVy6qLJdeWRmBEyPblW
MD5 SHA1 SHA512 SSDEEP

Submit Download

geofencing.db-journal

Path /data/user/0/com.nebula.mamu/databases/geofencing.db-journal
Size 512B
SHA256 46ceb21236c924902677c28f89e68135d54131d523f50f9bc9b2dc788af4e442
MD5 004ccafac7afd29888ce0191e08dfa56
SHA1 a39dfaf0ff1de8b0fb8227d81c5a0de95bdb527c
SHA512 1a9b5c297f73441aeb088cb98ac0599b66853033110e81ec99d608ce076b85ffa886b7ef6552eb9c23340741d0d1f95959fc97b54b84574fc2bfa5dc165417dd
MD5 SHA1 SHA512

Submit Download

com.nebula.mamu:pushservice

Path /data/user/0/com.nebula.mamu/files/com.nebula.mamu:pushservice
Size 371B
SHA256 8f07f23a333f2d1ccb0f8d16d756f78bdd457517b2adf8359816c8a00aaed2f0
MD5 cee4eb8635dc739b2551f74158ba5e7f
SHA1 1b63186c9271c9d3fcc16bd833050c289bb7f3b5
SHA512 9e178cca55a3a84a47db53be305d36e4159583e4ebfad8ff116d6263e2d3d970273af1c23441af63583d265b76909bcd3c69b7def7bdd7e37d7b9cbaeb577dbb
MD5 SHA1 SHA512

Submit Download

com.nebula.mamu:pushservice

Path /data/user/0/com.nebula.mamu/files/com.nebula.mamu:pushservice
Size 1KB
SHA256 deba38b3debfcc45d235648c89f83bdedd9c0c1a0a3ffecae1d056ccf36d157a
MD5 96f185ad3cece8b953337b0b52437fc4
SHA1 0f2db6a55a69680bd1a47f6c07b17003fb3f36c7
SHA512 914d1c0131a3e2d5b92fac7101530b53b0971b61d162f79262e44f702ef567abfd2c77dd2d34c86b0b998e52d9f6001f85b96e46b6ff6919c1f00256332b545a
MD5 SHA1 SHA512

Submit Download

mipush_region

Path /data/user/0/com.nebula.mamu/files/mipush_region
Size 105B
SHA256 567700820a51f29b933a446999c09200694df84fd8d06572336c0cb6e86361cb
MD5 36464b607975068b0035c8cc6bc2db57
SHA1 a9e9399c451fe051f68cf35f3aef3755d9a57ab4
SHA512 ba9c56e231565d73d9b039dc7174f3ee37c7b80df41d014101e983ed5c056cff406764b81aa5a5b5acbbded2cfc51e9c08e0fcb192697e86684bee821af67ef4
MD5 SHA1 SHA512

Submit Download

com.google.InstanceId.properties

Path /data/user/0/com.nebula.mamu/no_backup/com.google.InstanceId.properties
Size 2KB
SHA256 3c690259a2f2440bcdca41cd6d20e99b8199d86c70b04a8a82af2ab2ea78e538
MD5 076da11b726521685580c66ccb52cd2d
SHA1 5a11cabf4d7d276db209b6e41c7fd1ee46114ed8
SHA512 8623249ed616363f78d416a83fea782851aa1f979df90d5c9dc9bdda60a2998ee4ff275f6be7c0ba2aa8cda4360991f90f2dd916d1681c7405ddf3ddf49b4f09
MD5 SHA1 SHA512

Submit Download

log1.txt

Path /storage/emulated/0/Android/data/com.nebula.mamu/files/MiPushLog/log1.txt
Size 466B
SHA256 b48c7a6ab9df68714bbf47ffd2d98cda04f0317d5b767b960fc373c959cbdc3f
MD5 0c9c54b7da10712a516c8944ca89ef1d
SHA1 3291c16671718db27af99a24fb627516a82d675d
SHA512 1d85de7884173eb0569cd482deddc826d18465fb874878b704d79f5be0dafefc0cfc8e37a6e6f127d862cf2ce008ef503e3f5fee4860ab0bd4fa9428f3978041
MD5 SHA1 SHA512

Submit Download

log1.txt

Path /storage/emulated/0/Android/data/com.nebula.mamu/files/MiPushLog/log1.txt
Size 295B
SHA256 995fbbe3a00ef814a870defc652d410277125eef2f98d34088300ef3765d8470
MD5 7fc8330d57ff081c97721e13767a057f
SHA1 977fb7cdca2ff46064039aeefec6d090ff8549bf
SHA512 44eb78c130287ad8b1c81908a65ee959c6267cdadd55cee44f227bab629383990d803efa4284f93cb6e92ccd5d8907016b4e37862d20e1f0d8af6c01d8cb9104
MD5 SHA1 SHA512

Submit Download

log1.txt

Path /storage/emulated/0/Android/data/com.nebula.mamu/files/MiPushLog/log1.txt
Size 1KB
SHA256 fa6ed0c51e543e78fdbaa8c2125c9e58da1f2d5c8d2ee76cce89cbc567abe5f0
MD5 333e5c9cfbef83eadb0506df5557f77f
SHA1 85ea9b05bc92021a59036522a10b24f687b2bcee
SHA512 f1e058161f7ba3a3ac374024bc2b1547c18ea5a876d51221d627653a8efc0ae16f80a11308e335e96babd1cc0fc6041dca7f3cf113c4eed946b325211fac9bbc
MD5 SHA1 SHA512

Submit Download

log1.txt

Path /storage/emulated/0/Android/data/com.nebula.mamu/files/MiPushLog/log1.txt
Size 501B
SHA256 d46131589a1fbdc065ac10b83915f3061f423f431d304ccc3398287ce22e1398
MD5 fb2aba381a3708c02ec135b0058fcf4e
SHA1 5512c296e94884a23e41f43a1d64f8ce4f919eba
SHA512 6a989929a384bc12113c5759a550cda9887f76fd22280fab8286e3a3db9461a1c6970b7f0751a6d83e4d1494a4b40650f3826b8860552553acdfeca7e35c86c0
MD5 SHA1 SHA512

Submit Download

log1.txt

Path /storage/emulated/0/Android/data/com.nebula.mamu/files/MiPushLog/log1.txt
Size 288B
SHA256 4a17bb263df53ab650b8f9e82458dfd5ea1db2b6dea8a913d0d0f31ff4a3e596
MD5 5a7896000dad4596d227d053643f626e
SHA1 008f28167a8df0b1c67584ecfa682057a0238b7c
SHA512 053da7822811b33f78b53ae8e82b6d0cd13ae2c9b77397c9e5ecdf4e796dbc12b6bb07c1997131418a787143b5a4cefa33ace22ee48ae43d49c4a53266ac7d02
MD5 SHA1 SHA512

Submit Download

log1.txt

Path /storage/emulated/0/Android/data/com.nebula.mamu/files/MiPushLog/log1.txt
Size 105B
SHA256 ff8401f248402aced7a15aad67eaa3a126b92c230937880b7039638c999ad9ad
MD5 2bb5ea239d2eb5ae6a5ca0a8f42ba243
SHA1 611f1fee2621fa056d90af85ad56bcb404896205
SHA512 a497e131a9b9f8ee6ab617f74f3466a3dd56fe3ebf3b9463427bad8e78981a982e3a26c468533b16958064143ba063f34120d45cf8b3f967d1b3df2bf754bb54
MD5 SHA1 SHA512

Submit Download

log1.txt (deleted)

Path /storage/emulated/0/Android/data/com.nebula.mamu/files/MiPushLog/log1.txt (deleted)
Size 734B
SHA256 7183adac2feab65db384f679e71263141057e167463df7820ff05fa848885fc0
MD5 5b6e0ce23d6650e3b2424fd773ce6432
SHA1 cd637287e5c4e2f2f6d567960250048e8aa5d439
SHA512 9e1624b6d787754dd83f75283b1195c824513e1e5ba76e6aed2296d9f27f8becaded9ff95b56e7dac8d8145522573c50472c5b68a4c26fcc42b236e159121ff3
MD5 SHA1 SHA512

Submit Download

lcfp

Path /storage/emulated/0/mipush/lcfp
Size 33B
SHA256 9299b9d9c69f7c9758f3f522e3fd5b517e5485e092ea215d8390ad984de8f71c
MD5 50a0d11f02d8fdcb0ee5c5975fafdf24
SHA1 e4624ac657e0e76844ce637d00a125ebead1c446
SHA512 85e1b5e1679ce9defb77c88da3094d341d14095a7a0b94c55848a974218ec3be6e37120d30286a28ba5887e7724b1778a381ab4648a045d3a03e1c5f891e2fad
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads