356a69da919fdfa7d0e6464da01e6d748d6f92e3dc47f40f10b16ae6b9108e8e

Analysis

max time kernel
156s
max time network
170s
platform
android_x64
resource
android-x64-arm64-20240514-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
submitted
21/05/2024, 12:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63411a0144b7258f6cca05bbb0a87477_JaffaCakes118.apk
Size

2.2MB
MD5

63411a0144b7258f6cca05bbb0a87477
SHA1

cdc31c6c35c965c48e6d632482303b56d0337db5
SHA256

356a69da919fdfa7d0e6464da01e6d748d6f92e3dc47f40f10b16ae6b9108e8e
SHA512

ded0d9b77c3633ce253766ea4ff9ec1c6e14d7cab346d5b7da53d3a4794a241beb684a7e6723c3f92fe61a3a04f751dd167653de6420e68245db76e33e194bbb
SSDEEP

49152:psF1quCWdHCsHdgBnw4u0XJlyQjqUkzI57Hol+9m7:sMei7xw4uKJkWpN57s

Score

8^/10

collection credential_access discovery evasion impact

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.meihillman.qrbarcodescanneruy

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.meihillman.qrbarcodescanneruy

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.meihillman.qrbarcodescanneruy

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.meihillman.qrbarcodescanneruy/files/com.djsjdf.djaid.dddv.jar	4596	com.meihillman.qrbarcodescanneruy
/data/user/0/com.meihillman.qrbarcodescanneruy/cache/1582435991586.jar	4596	com.meihillman.qrbarcodescanneruy

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.meihillman.qrbarcodescanneruy

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.meihillman.qrbarcodescanneruy

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.meihillman.qrbarcodescanneruy

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.meihillman.qrbarcodescanneruy

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.meihillman.qrbarcodescanneruy

com.meihillman.qrbarcodescanneruy
1⤵
- Checks if the Android device is rooted.
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4596

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.meihillman.qrbarcodescanneruy/cache/1582435991586.jar

Filesize
9KB

MD5
e8e0527a01aefdb89afd2c508f131da1

SHA1
f1103e6b260c657ceb3d95f1b023af3fda8b133a

SHA256
f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce

SHA512
fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34

Download Submit
/data/user/0/com.meihillman.qrbarcodescanneruy/cache/1582435991586.jar

Filesize
20KB

MD5
fde2ee00cbd121cfab5290b078aa3ceb

SHA1
e2b77d5320e155e413d040a8c20020962065b2f8

SHA256
2897b0812077c654a9b3fbb0b6303d5cde681eeba7ad9981de65716c7810d685

SHA512
a9326aff8e454a2b4ac09984ef2a65fddd4dc146b4c44d839035549bff8c9fdaae490326d0b018f76c1ca2e4fb25426d74f550ca0950982fba632a023af99a56

Download Submit
/data/user/0/com.meihillman.qrbarcodescanneruy/cache/oat/1582435991586.jar.cur.prof

Filesize
153B

MD5
f9431a0cde5766b6a47fe517f0dbe91f

SHA1
41ebffb9e03db4e211961286e6c233726d1c704f

SHA256
48409024aacda3669e2112419ca8742dedca12f5310521730db60c8387710616

SHA512
3102a350b8cdbfe686564eb79892a609f3cccd74d4b420f831156b1c57b736853f1cba0988d4dea7bf728f341e3ed2b997274684726afa2d97d31115e5213382

Download Submit
/data/user/0/com.meihillman.qrbarcodescanneruy/databases/barcode_scanner_history.db

Filesize
16KB

MD5
fe5e85761a120e8049f5d4f8494294a5

SHA1
29fa0dbc9ffa2286fe82fc9b4084a69fe5c9b87c

SHA256
977d69586a5f3e6e55b5fdaf975c9ef8191bc418e715bd8ac7753d6d1e6342d2

SHA512
d82fd451bc5401a66e0e9834f20bf98b60ba2c1aa394deb3663b5ec3ca059646c718e6c3733c8ed26fa6bca3a4ff842d773ea2eb0ebfd757d8d470090c41b6ff

Download Submit
/data/user/0/com.meihillman.qrbarcodescanneruy/databases/barcode_scanner_history.db-journal

Filesize
512B

MD5
76d63d1f686559d444822aac2b97abe1

SHA1
14a0c4fc587699c4b6be911a08bdb8efbf18aa51

SHA256
aa1fca11e73010478cf675d2d8ab91bc42d2a9a4ce36d454746b0d4f7da08799

SHA512
bd0f4b167c6a0f2f83f014e9125dca8b37f1d025dd3e6866463eb303f11a1ccee416d614097e5a0c04dadeac22656982d1a877d155c9404856671e410bf7d8f7

Download Submit
/data/user/0/com.meihillman.qrbarcodescanneruy/databases/barcode_scanner_history.db-journal

Filesize
8KB

MD5
8f4167e85ee2210b9342d1631ae12798

SHA1
67ecc63d412655e95b7ebd402d68bc2b15371f32

SHA256
ff0f39caf409bb728686efbd78c70478526de6848fa88c1cb2079a582a5ce872

SHA512
0cb0b37f6f1725e11388a017916cd8035fdfe8cc5c1df81c0cf1ecb49bab5c9c3762ab975328a337a32cc6660537a9fa3a2b9323305c10163269ad6c6a19e803

Download Submit
/data/user/0/com.meihillman.qrbarcodescanneruy/databases/barcode_scanner_history.db-journal

Filesize
8KB

MD5
7759708f01ad363e9ca5ad6a55318bae

SHA1
dc952f898ad20709cc0df094ec63be929bba5922

SHA256
3d20548d818242b986111aea8c6e8a3db7ba2e98da3ee7d969510983c9a5e780

SHA512
59f8bbf2f5959f16a1a68994c6bba5aefe76c6144c0379ae5657359eba748ff6310ee4290029d69461e5e47ce9b9ebf91e8363d6a1c912881852005542660f2e

Download Submit
/data/user/0/com.meihillman.qrbarcodescanneruy/files/com.djsjdf.djaid.dddv.jar

Filesize
209KB

MD5
72951ce9ee75772009e1b92a6d34eea6

SHA1
3b6c89e1bd711b080343f469263a2bf78cf7a7ab

SHA256
c0c8d2b3e7a1633b01e496a5c7d27c45a43edd9d4858ae131d6e6e953f64d860

SHA512
ecf48792983301662d13c9cd0d0d945f92a80fa5cfe75f83f84f28eb1111c7e17963ea1f41ae310982688763fcdc70057ae569c58bf963a01d8f5f5d319cd526

Download Submit
/data/user/0/com.meihillman.qrbarcodescanneruy/files/com.djsjdf.djaid.dddv.jar

Filesize
405KB

MD5
e33efd444d2f5ab1da0f1d0423558e36

SHA1
3561f2ed2a61ebfaf53e7134b5aedc502a4b5ce8

SHA256
4bcd054d58060d76af9ccee9718ad30e3905c5ab2c9f624c1d0d661d0baed744

SHA512
9ded5f8dfd3931e8cbb81df1b11538e9e977dfe8818fabed78d9ff47242e6287a60187a557ae860c56aaea450a7277884905be2a918936ac0d820a85ee1ccbbd

Download Submit
/data/user/0/com.meihillman.qrbarcodescanneruy/files/oat/com.djsjdf.djaid.dddv.jar.cur.prof

Filesize
329B

MD5
66c9501452fd780ff7e83380784a0ccd

SHA1
73a86b7122ecc697302a137caa26c53ba2826ceb

SHA256
0ce5961a803fd6812198d2b7af372e353a7e87509e1420306da16d5a09b0dd40

SHA512
5380581d37e528f44b2fcf9bf26f3106040a4a48c3308e47d6a6a76473f769dfe263389771c8369dec85213d321c03d82a96f2a63ae8aa808bba7a7f862265d2

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads