d5529b45ac01fb976a4e99c254ffb7b8302aed9443ea66193d39d834a0c9eade

Analysis

max time kernel
8s
max time network
149s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
21-05-2024 06:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

624835b3e814541d75a434dfa857c2b4_JaffaCakes118.apk
Size

146KB
MD5

624835b3e814541d75a434dfa857c2b4
SHA1

0c091657631e52a1345b1fb0edc673fc65956bce
SHA256

d5529b45ac01fb976a4e99c254ffb7b8302aed9443ea66193d39d834a0c9eade
SHA512

bbfb26784a4c6963215338cc82d37f3949dbc3c0b076bda2598a3b2b3a74066f74e4da1fce56e9269e63484474957344fa663c6851f636225f15dbef9a1e939c
SSDEEP

1536:TXGBNvIgNkMGDTXJG1fdUpB41PFAlzO5rm5NoIJWJx5Ir6oN5uHqtI3vE/2+go1x:QdGxbA+q5m5qIAloNEHb/wGIt8Pu

Score

8^/10

discovery evasion persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

Suppress Application Icon
T1628.001

Processes:

com.barbaric.pineapple

pid process

5187 com.barbaric.pineapple
Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

Foreground Persistence
T1541

Processes:

com.barbaric.pineapple

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground com.barbaric.pineapple
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

com.barbaric.pineapple

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.barbaric.pineapple

pid	process
5187	com.barbaric.pineapple

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	com.barbaric.pineapple

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.barbaric.pineapple

com.barbaric.pineapple
1⤵
- Removes its main activity from the application launcher
- Makes use of the framework's foreground persistence service
- Checks if the internet connection is available
PID:5187

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Foreground Persistence

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.barbaric.pineapple/files/a5f0467d-699f-4e1a-b9e5-d75746fec235.dat
Filesize
376B

MD5
897ee430f3f471a89a83229401947692

SHA1
80dde4fb47f67e2d25e197cce4ac036a6175d23e

SHA256
741a0ced924256955ab17a3689c7e46379c172e71d685ec165d1ef5097f3b9f6

SHA512
9978480fe98ce6cc60ba1a0781e272865c1c71c0a06091e9bc4be71ce7b3d04c7869c7cbc402f30381f563465eea4b76a4b515c9049f3e2dda56612307e3a3b3

Download Submit