Analysis
-
max time kernel
173s -
max time network
189s -
platform
android_x86 -
resource
android-x86-arm-20240514-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system -
submitted
21-05-2024 16:35
Static task
static1
Behavioral task
behavioral1
Sample
63fb8ce3ce49a7fabda30a8756708171_JaffaCakes118.apk
Resource
android-x86-arm-20240514-en
General
-
Target
63fb8ce3ce49a7fabda30a8756708171_JaffaCakes118.apk
-
Size
30.7MB
-
MD5
63fb8ce3ce49a7fabda30a8756708171
-
SHA1
02370f4e32513b15dde01db05f92598f3ffcc219
-
SHA256
29a663c769085e9ac6e27a84f333a9b74063150091f7a6e940829095975f2094
-
SHA512
a17a275a57e7f07c346ce39ff3e8584b29d5d7da04c642e8d5e38c86c99f11b342b7c664f9c8c4a25059a699798a012ad812fbe2e8a008be78cc89d899a965d7
-
SSDEEP
786432:4PAjT0e3My5HBHK2n4SZVgKIZcY9uKVkKPhPCPzZiZgi3:4PAv0oM2HNn4sOK3Yuo8zZq
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 1 IoCs
Processes:
com.babychat.teacherioc process /system/app/Superuser.apk com.babychat.teacher -
Requests cell location 2 TTPs 2 IoCs
Uses Android APIs to to get current cell location.
Processes:
com.babychat.teacherdescription ioc process Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.babychat.teacher Framework service call com.android.internal.telephony.ITelephony.getAllCellInfo com.babychat.teacher -
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
Processes:
com.babychat.teacherdescription ioc process File opened for read /proc/cpuinfo com.babychat.teacher -
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
Processes:
com.babychat.teacherdescription ioc process File opened for read /proc/meminfo com.babychat.teacher -
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
Processes:
com.babychat.teacherdescription ioc process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.babychat.teacher -
Queries information about running processes on the device 1 TTPs 2 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
Processes:
com.babychat.teacher:pushservicecom.babychat.teacherdescription ioc process Framework service call android.app.IActivityManager.getRunningAppProcesses com.babychat.teacher:pushservice Framework service call android.app.IActivityManager.getRunningAppProcesses com.babychat.teacher -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
Processes:
com.babychat.teacherdescription ioc process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.babychat.teacher -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
Processes:
com.babychat.teachercom.babychat.teacher:pushservicedescription ioc process Framework service call android.app.IActivityManager.registerReceiver com.babychat.teacher Framework service call android.app.IActivityManager.registerReceiver com.babychat.teacher:pushservice -
Checks if the internet connection is available 1 TTPs 2 IoCs
Processes:
com.babychat.teachercom.babychat.teacher:pushservicedescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.babychat.teacher Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.babychat.teacher:pushservice -
Reads information about phone network operator. 1 TTPs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs
Processes:
com.babychat.teacher:pushservicecom.babychat.teacherdescription ioc process Framework API call javax.crypto.Cipher.doFinal com.babychat.teacher:pushservice Framework API call javax.crypto.Cipher.doFinal com.babychat.teacher
Processes
-
com.babychat.teacher1⤵
- Checks if the Android device is rooted.
- Requests cell location
- Checks CPU information
- Checks memory information
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4343
-
com.babychat.teacher:pushservice1⤵
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4441
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Execution Guardrails
1Geofencing
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
230B
MD535494692cef97a69e5b8691e98005312
SHA14c08133ee08775df9877fc53f85d4b0ef9546c05
SHA25670f3fd46b0ed3444a0b2145c3e88bda8e5b4f0ba1daec0dc8857219f48896fbf
SHA5128bc9bfcb008992b8143b595ea66a14cf283c1dc709f138475b5f9f01f278b16898cbabae474d8111aa0bc78655c15b6503a30bb158a5a5543b08de842cbafd09
-
Filesize
58B
MD50d210bfb2a0e1f1b4c082a6a0f79de07
SHA1bb8ed9e364db79d1d9f2fcde3f15091893222faa
SHA256988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
SHA512536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1
-
Filesize
32KB
MD5cd690c6c7e38edf92974ca1fcc3027e4
SHA1fa59da7a93153b71c205792b07d33460891b272d
SHA256cf17ade4fa9ef03a9016b174fcc87cb2f1dd6c2099c954eeb8e6863bcae0c067
SHA51266b65fa5e69c0dee2d2014258c05fb63501b77cd8eb2ab4b349cb182acdb18510f5a2f3a56bfe705a2f5bcf850c56fc86a63420f9cf155fef4e7f2a77aab6e13
-
Filesize
16KB
MD510f7c41741c8432d27c419604d1fb4ac
SHA1628045597d53d63c452052a166d10c8dc8e6cc95
SHA256c965fb5afdfd74f1fbabf715112c191eff5d33e958818eee5c637dce84d1949a
SHA5125fb01e5b76814bbd7c25101d9030f390247180457979463ba1f3e50d527fc1ecab8df021b93e5e7ab74361338b588ebe3b08d5f85286d7774c169fe51c5bbf19
-
Filesize
32KB
MD5d604a3bf1f8d992cc320ea5b1f7609bd
SHA1247f88df0b55c7d523ea5398637711a0e4a483a4
SHA256329940b4d46326d58e73c842dd099704061d0ef7338777bf31ad895f29013c17
SHA51267e28f6713cb5c238a9664df128f01a89a2efb7c8c9330c1e45bc0d40ebab81fa20df5166743d84d81dc0386a89ff0329f022281c098339baa2e851ff0a1e1ab
-
Filesize
512B
MD5a861e0e50fe838bf664a55847025454d
SHA11a35541d5ac092eb5e16bcca3de522001d4d15bd
SHA25619168ff9b5986c4ebd562468fc8c544273864ac8d4dc8fd678bff4988f4628c6
SHA512c274bed1eb1e14bddbd149a0a80321b73aa795bb837e919555ebd9e6d4888b56b6e533298465bd9856b7ca8e5b1736cf742c8caeaa6095aa69d0434b8a7e4fec
-
Filesize
56KB
MD5c02e4a8e4258f0a6f7eb226893002610
SHA1ededa062098e1628009b78b74e1ec94bb1d123c5
SHA25675960c50eba6aacf2c43a766552decd95b9837e1626752fab923df042c1a4e29
SHA5124875dacbc48c49dbce394cef5149980a31abc09b0caec699ef7df4791f4ae45b63bff1b13d172cb3160668586f55221577d3886f81a47ba2325747716529784f
-
Filesize
12KB
MD5655309477761ef126e358315e8acf90b
SHA10c5137c2de044dbc7e0e1ff8c41a9074656b39db
SHA256b41e7b89574708439c353de26c9303b2bdf41b8b9e32e991cc8bbf5e287d375e
SHA5124346f13256a6d0d2f83283dac8c39659c9c96d1eefbe87c0fd99520ce86dca6de64e472e299fd93f684a29476a75ab21bffeb3a23d8c297ea2936c884ab40049
-
Filesize
8KB
MD555c6c062280b915a7c03c842c7a18062
SHA1a2e0fe23d300c6b9d13f09a5c3a791293ab3d7d5
SHA256708df85fc388eedce9da723d42308064437c0ea99dbb43a38a70a16f10e90e24
SHA512c4ad3e6ee9d5b46563b20dc9caaa3ec2dea0be18a14454bb585a9b37b7e354eb7da95808d583a1bd63fbf2fa526857b24c17f8bfcb1743dd6e4eb0b6ebed5be0
-
Filesize
32KB
MD51c4274aa7a9a5cac8c6d1df71e4588c6
SHA1abaecd685e01cc68801292e3dc7085654a22feba
SHA2563f6cd5f480ae69859b7841450f3d032c528ba385ebf9f371b9c8fdc6eb4231be
SHA5121adb95935798607bd36cedcd183924d3068f50097d017b278da7caee7771532b61ec3606f6189b6dec8426eb038fe40be75079ce35894b1a8e0d1d815261150c
-
Filesize
512B
MD5992e867a62e669172875f823a9279e61
SHA1c8187f3b97e15f8471c13b27c83caaf72851e315
SHA2565ac7bc38a2bb073ccbe3757c2edc2c49e88e2b9a9aa40f646312604efb82e13c
SHA51297187a63404d1c21aab69d5d52ae4969f946708a0169f3ebae03f86d2fe1acce7a815a1b2c7038bb6fc08020ae93be5a62af85210fc63ee568869e98488647f7
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
100KB
MD59c3af93ec3c5fff59a0c1bff969c6d30
SHA1a15f079a15ba83f6fb31674a0091b0353ff97961
SHA2568e284f1c205dfc1a66cc68b679285f330a20e53647bb19577e59ae7bc32204ed
SHA512bf7e43c735db7ddb9df62c585ee2c470adb5929300dfde0d6b01922d715c3a84c6e90ef1191d6fc6bf277cda81360b9bb8f300b2b8a9886166ac4003626e85b2
-
Filesize
4KB
MD582de3f9a64b4164d573dd61ba8a4bad5
SHA1b50586e2d2a05179e93e4e29b8ee78bf8f2b4737
SHA25629b7f04c28769fbea9f3e1791a4136c81f70462c7cbadb1729f17de40555a373
SHA5123cff834e6655a330e4a272489ee2487d0a514fd67aedcc128259dfc082926f08ce8af2695ea8484b695588a23eacd41a60452b0dbaab87d47eae3bc42e27b2bc
-
Filesize
512B
MD53fb4cc0d8826a931c14c919b83a2d25a
SHA176d048cc26b09893f647c54a2c456ca3ec0cb553
SHA2560c8869a083668cf3f6144f3ecb75f6b9208abe0a8dfdfb38b84b826773326a72
SHA5124ca8e62d0d00e40d95c874e13f88ae95b2bd2219bbda459510817b934d93aefdcdf4ec98695f939acdbaadd7f601bb03a2343af9068726a51e5324ec94d5b2c7
-
Filesize
20KB
MD59fe7018877ab2105925ee1ff1b551337
SHA19e92fc5e69fa392a53becc1cef64d6c7e643e3ef
SHA25630410ec2040bc911262bca92ab75767f579ff840d662944e23099872377b3108
SHA5125e6477be18a535b0f8afe00a268d4816715a5e518aa6ec7ddfb8e3cab016041ea767b7cd7195e51424c74753cd10cc0711c054b84319e85c76b32200879c7670
-
Filesize
4KB
MD530283ccf12c87edc4c955ca68d0a2b3c
SHA134cd87e086985bb2e6d9cbfda12130b097da30c8
SHA25687dac878d3e7d8b47a4348a3beff8e72cffcf152826deb6e93c48e334bc904da
SHA512027d85462cfc4bac950253c0fd4d18f024e773558ba68737ce5f7a0e51222047d32476efc98c09daeba5cc049cb1f53568ee6a45676f4555e7074f7204116ac1
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
197KB
MD58e7a99b2b9950cd16a544a5204572450
SHA109c28c68e105ad3123da4e957cf668db06ccc87b
SHA256b0e1c7b0e5787442d58204c2c0b9ba47f81457e5f8f36ab2ef2ebadb5a0c2928
SHA512b8098fece76fa8196c17df50457f9b460af6d825228f725387c8f3c73eb0b31c53bdc04cbc6a3105f006d75109331d9fd29b96c5cdeae350df319eb415ff025c
-
Filesize
92KB
MD5241a24d438d1aa399ea2760b604726f9
SHA1a4dc725095666e3836c7cbba41ba49d3eda0541d
SHA256a71f56655cf9c9bc1b5a678f28b5b04bbe9d5ca41dc204ca4dc67bafa5373e05
SHA5124130e3b86fd3a6474c63ca2bb8adf6cd778b9f937237d996f78c5642b022faf7cc45ae2c92c14ffb2637cd2121cca6ac2cce6648e9c18e95489750a3b59d4737
-
Filesize
512B
MD5d2523dff2108b2e76e7a790ad88cf65d
SHA1cfae378f4d6e20f6b639ec7135193751c2e27d40
SHA256e4ae64076749d9494029f9ebac315540d1d225265256d9f86626fe0497bfdf96
SHA512fcb6a2d1340f695d00164262394c874f1b93904b31f6c13df945e3bbee25c041a38b9db1ad5de36a441b2fd8a2bfaef57d18e1f7a040aa69ac81ebeef5c3aca9
-
Filesize
80KB
MD508446d744e4e673d3ff32e6f973955f2
SHA108c70af78bdf767637e57ef2480b6aeab4f3eb29
SHA256c22653a92be5982e68cb550741890a02eda2f1c5d8ea8eea7698309f9aced449
SHA5126de1a88dd8ef77c7f2dab6afbb91cb64b0c7a3cb76eb2b0f87195364bf42ced0f57188ff03a5ed1b4c10cfb9c31203e1218769fa0073e18b41ae8a93a5dc0cd2
-
Filesize
36KB
MD55d7ea1a23af19b4340cc8d90f28297d5
SHA14cfe95b23a9e98378d69c4290af81b51fbe76aea
SHA256474c4a54534ed96beacad7cc9a805a3f53ec9c0522fc7bcc59771cf500a6a0da
SHA51233071f4c92da0a3df01c4a61dd165df7c7e0f4f37753cafe02d19fc876a5e7fcbb01c069c804e140ab8bfa0644a55f50fd1373646d1c439f817baa5ffbd47f7b
-
Filesize
36KB
MD5ce6135aa1b1fe4f2c2db2a546d2a5558
SHA179b59582154017aadab783dc266fcb158c252940
SHA2567b45f576c08c7f78220168cca4a0e33198b13e9bdc8b1da406ddb6887412000c
SHA5122839075fe374c8567c839ae35ce2d33ec72fdaebf170aa7d224b555e5b0e74d4a43f2f67d17ed806dae841da883e9620d788ea052d06152678afa927307c7ce4
-
Filesize
512B
MD539e159db897d4efc6e45b82e7d080aeb
SHA135b7dab1ea05107f2fa2192f20272c58f5634d5d
SHA2563aba72fb8d6efd069c2d94dd0137e7dc533ba0f6f5e8fc646b0f675e62b4606a
SHA512cb271f61f3e0c60452d00e310c209bc449687ee3ca2fd4422723b6d66cf6ae9a50cb1016201dba8fa2f4aa3d59fe918e896e84cee31b105fa1d36458d98a2d51
-
Filesize
48KB
MD5746bddea7355a513c7d1d2879946a4a3
SHA1efff403ea2fcf1b4ca32b70c7c2d33624ddd9c14
SHA256dbbcd699c0687cdc7ac0f2724a0a98946b3743ffc8717dc9db5790e6ab8b4f0c
SHA512876293b4f5a79e8542fd7f61dc173dec4cc3686aec7cb0a0ff8e16fcfc4b4a7d2e059f7f006b31e94a06331331aa0530d3d53c9aa9fa378505b78f86be9cf368
-
Filesize
16KB
MD5cadd4bbefcf82a2c0cca07d586dc6523
SHA19428625d3c251aa04f2f749f7ecb9b5ef0de57cb
SHA256f2fbfb773fa044186cb44c251154c3dd3d9c8de55938c265cdbb7948dc5a703a
SHA512ddd77d6134dc8942e500d6fdcd83f9a0c7c2600a61328ad17f59952280ea1938e08c1acecaf7aa06541608c115c3eee5d59a9c20a40a83c3d40671638c2adb3f
-
Filesize
1KB
MD5bc9685a443da372a5802b90a2e4c5ebc
SHA184ac3370f5379cef9335abc0ef14f1f43b738406
SHA256cc2a5f15cebf53867a5a025cb4045510fc1eb523b2eb10a84ae5344da2a89d89
SHA51239bfef6b132c470b4c0d2ee71fbf354fc82b346d2fdec7658ee84407b6ec444072932fab087460d17f8ce56e9e67377b3f546cb3807dc7d219221729947b3358
-
Filesize
162B
MD5b0beaa22b879abf073f0065f8d472fcf
SHA11a269c63ec3cf659c313ba80b4cb38865861f628
SHA256cb9a1827b6ffc7c210a737b988f46e2cd92826324312df8c99a8866e01c7a7e4
SHA512e65763f6f59cfb165a5e04f6a7a872c7790e073180e5266c3dae74c1405349391337bca0e4d912fdadd3c511574666d818a6adcbdde8f915c835effdc46e4714
-
Filesize
56B
MD5c20ffa6450274189f5febf00691a0c47
SHA1cc7951629f5b01a52db15e0bcd39beefb2d2243b
SHA256aae1c82be3983c08e11cd2702abdbdcf8305cc0583fdb9a8d2e011ead243e09b
SHA512b252546f359f64a8e1e08c2ca5a7ecf000028799df13a5be01a3ec20dbf27eb705f71ce76cdd94d85ceb84aa832c9b1db117e3396b9e42759eb5a487457ae9c7
-
Filesize
91B
MD5b7cef972ba0fae5d41349c7e5a8f7639
SHA1b30f3204673c20fe5040b23b94462368a453d9d2
SHA25621442645a74a8ff36d9ded280f80aecc3d7a693c99fed44a1a87f24bb77847b5
SHA512925aeec7a7845f7cbdbfee041a0dd5d0f7fccd4c2cab290b0db628f92f47cf0cad5cc1eea2d92c551ac3e232f4bb48c96c98053afbf1292d850ffbc1e867b8ef
-
Filesize
93B
MD5b266647e84804c520a89ba0fb51ffdc9
SHA18c5de8fd9450b1c7da3565ed2e39e49e39ecd395
SHA256769bc33acb9a96c7f699f4c870c7f5328b95dbd030fcc806a9f15600cca428e5
SHA5122093c1a89992f3d8f87154a7cc18fec7a0ed6919f2564fd06f0ca39df39f58cbbe973551125eefcafcb156b3999582355fda9c998bc2a923d34d8566abdadacc
-
Filesize
146B
MD5279c16cf381b3428cc02dad59ad521d9
SHA1d665ba7a5014ff8f8922558a4cf7306f36a17253
SHA256341f48bbeddeea9ccd935c195534e0df69f00d8cfdfcb0415736c615caa68bce
SHA512ca26e327d6cca40ba078cb3f9f6dd5630582e9062656e2de4540aeaf4b4d4cb2062de9775f70951fec92d2b64731e04b5bcb4007a6ed797518aa6427d87ba7b5
-
Filesize
415B
MD5a8f83626468994d41463109b752ad8a0
SHA1139e7ef6f91c208c656361e25be909285b8dbc05
SHA256f90986001ff6671e615830ffe05307d9256cbd668a754a19cd8e9d602b87f8bb
SHA5127e4d0429df41acd2a1e19d3ee8f791a9f3f29ab13ac3b60e595ff7a83fc29052793a9b39f8adeb451d05eee9b9f92e2f23aa8ed2972931d674745b384e3443b2
-
Filesize
172B
MD5bf8e72227cbd9f7dcfadf52c85ede1b3
SHA10a19db869d7bb62fa33f8f1b1436411e0c7d8d2b
SHA2563eca72971758f383981046e088a872a53152ce802701912298334823db4a8312
SHA512190097a93e95b898da99af6d75608bf879a91e63360ecdb23c91341197b9a9cd00f02b4ccc8f60d288be9c5d7cd80f7757d6b7fdc566889bae479bd9e3e8dff9
-
Filesize
85B
MD564bd35a5a68cdfaa3bdcd1c867ad36e9
SHA19c58c346667e1c98c419de1d008ece8db64bd672
SHA256575179880ba5253b1f36c62ebd2defb4c7c27d6dd6f34da9919f3ff0818328ec
SHA5124679cc1763b00e7d9c65b7f8baa9a9b03081271969ddfcc7cdce459ae6221dadd0d3694c27a51582882184acff02adfc092e4751dcc6450e444f6f7b6baff423
-
Filesize
82B
MD5cff939ece43edaa56d7da1b72cccd774
SHA1e45b8e58faa94546d802d7c2ebdc7630b687c3cc
SHA256697cb0c52b3e61df59da590065819ae0c70c5010b4c049f93a0b1267bd6edb9e
SHA512fb8746db55f10eeaf485dc523ea34064cbd211b05b0ab29e1272783af88d2626148bd343fe57931b2dc28b5d9bc388959632e4a4d0ac6a4a3d4c6b0f318679c7
-
Filesize
113B
MD587f5380e19d389238779ca9597c25cbe
SHA147eb464523385efa575a6bcdf1bcfe025bef5a10
SHA2564fb5ca857f4b20adb199b8727c84d3ee64d7c93ef0ced34fb9660f6cbfdf9d8b
SHA512b4f4d4a1d7ed327aeefef8f62b242746b047d0c5be2da578fee57a18edaaf4edc995df65e6e898238d8188381b751b88fbd1d48702a2629e4649377bf6d24f3c
-
Filesize
17KB
MD55e441b67ee6d30388e09d29d6210ea7a
SHA19fba0d734c65e609794c282863b009d9271d4227
SHA2567215290d527de1babb81e2a2cd9ff7dfb789c09212c7f5624c3211be08983662
SHA51208edfc4a9565d1d91ce5c45264e3638a02bd08aa669ed9126070efca72a37da5417cced0c65a43d7e31b6032df7a200995a22ff0c60a45496b1f16b7e1bf8060