Analysis
-
max time kernel
179s -
max time network
182s -
platform
android_x64 -
resource
android-x64-20240514-en -
resource tags
androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system -
submitted
22-05-2024 03:47
Static task
static1
Behavioral task
behavioral1
Sample
65e5f74e7191119fdd745f3cdad91369_JaffaCakes118.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral2
Sample
65e5f74e7191119fdd745f3cdad91369_JaffaCakes118.apk
Resource
android-x64-20240514-en
General
-
Target
65e5f74e7191119fdd745f3cdad91369_JaffaCakes118.apk
-
Size
18.4MB
-
MD5
65e5f74e7191119fdd745f3cdad91369
-
SHA1
cec85804c84b46f65a99150c48d3113cb0be026c
-
SHA256
f057384601dbfd965120a50d05c3d1adf4f7b2a76b3f12dc28b88d584faf683d
-
SHA512
eed8fa25da8e95f31924335f62fb914d406a9808265c4c9bd30cedc4a43fa0076de46d0937a1fdf1718d544f8a7452ea6b1c01496415b9d6fd1d04cb90135738
-
SSDEEP
393216:ivEL1LC2CPkNKHuedU7Lb7ufk0G2ighFk2qFJLW3W9YJz:i8L1LC2Cvkb7ufk1ihNqFJ19YJz
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 2 IoCs
Processes:
com.secondarm.taptapdashioc process /system/app/Superuser.apk com.secondarm.taptapdash /system/xbin/su com.secondarm.taptapdash -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
-
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.secondarm.taptapdashioc pid process /data/user/0/com.secondarm.taptapdash/cache/1582435991586.jar 5257 com.secondarm.taptapdash -
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
Processes:
com.secondarm.taptapdashdescription ioc process Framework service call android.app.IActivityManager.getRunningAppProcesses com.secondarm.taptapdash -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
Processes:
com.secondarm.taptapdashdescription ioc process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.secondarm.taptapdash -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
Processes:
com.secondarm.taptapdashcom.secondarm.taptapdash:servicedescription ioc process Framework service call android.app.IActivityManager.registerReceiver com.secondarm.taptapdash Framework service call android.app.IActivityManager.registerReceiver com.secondarm.taptapdash:service -
Checks if the internet connection is available 1 TTPs 2 IoCs
Processes:
com.secondarm.taptapdashcom.secondarm.taptapdash:servicedescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.secondarm.taptapdash Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.secondarm.taptapdash:service -
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Checks the presence of a debugger
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
Processes:
com.secondarm.taptapdashdescription ioc process Framework API call android.hardware.SensorManager.registerListener com.secondarm.taptapdash -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes:
com.secondarm.taptapdashdescription ioc process Framework API call javax.crypto.Cipher.doFinal com.secondarm.taptapdash
Processes
-
com.secondarm.taptapdash1⤵
- Checks if the Android device is rooted.
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Listens for changes in the sensor environment (might be used to detect emulation)
- Uses Crypto APIs (Might try to encrypt user data)
-
com.secondarm.taptapdash:service1⤵
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.secondarm.taptapdash/cache/1582435991586.jarFilesize
9KB
MD5e8e0527a01aefdb89afd2c508f131da1
SHA1f1103e6b260c657ceb3d95f1b023af3fda8b133a
SHA256f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce
SHA512fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34
-
/data/data/com.secondarm.taptapdash/cache/com.parse/applicationIdFilesize
40B
MD5755f2ab578c203e0a125b89d7c227c00
SHA110b9926fadfa088513d3de42593a35bd92d4e6c8
SHA2563b3200868fb359b08e668f2e9912bd6527738beb9689b225f4357548a6510c64
SHA512ee25f387fc6ccb2b66f2320f67e45c2c6fab27ddd91f9a2c1666fa65d2771d1e537f6abffdba88c10f68dd1b4fac66cef571fa0f34ddda2252585eb047ff74a2
-
/data/data/com.secondarm.taptapdash/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/664D6AD200CA-0001-1489-2107A7380188BeginSession.cls_tempFilesize
77B
MD5e52e41c167b9bc56698baa0d0b3f437c
SHA18b8721acbd308a28dac681faf6fe5171793359e8
SHA256b811ab0a5d3eb51ac0198b6d086885bb84f00ec80299fd40b4410d236396a64b
SHA512a7a62f5856ac2c13101833984f96de2b84c55807267101b955f192b3e83a519dae084cb5c33ecf9e3f3c5fa974ce03dccfaa21a1fa0be26b13700a389a371871
-
/data/data/com.secondarm.taptapdash/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/664D6AD200CA-0001-1489-2107A7380188BeginSession.jsonFilesize
132B
MD53b44ae8c3e2277351c715b1aa3e0eead
SHA1a5e1defa7ad3b08e1063366329fdf6763190513e
SHA256356e639e12f59ddfbdaca88def3f4122b4f4d636b5953c08c5185cb4ccb0eec5
SHA5129c9a8256f246369594dcb909d4bddfd051a884a6bc39c8e8a225efc8318672fc8369cef3b65383ad57afb650cd58238bb0f42319f825265afcd9eb868d8261bc
-
/data/data/com.secondarm.taptapdash/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/664D6AD200CA-0001-1489-2107A7380188SessionApp.cls_tempFilesize
121B
MD5e76bdaac7fa089b27c66fc671b26d0d0
SHA1dcdea697f802511e836ac415c780a30e6ebb4daf
SHA2567497674411977d84b9fdf1d0939c9723cefb349e9f606b6bd5e5632e6b72c1e3
SHA512f426a689f4a4b74766a7bfbf92a63774c41c0cd4ccd346ac12ed8d0b2f59719af2a0ad2a07b8867b64088a1dc5432483b8bbd27ce63dc7cfaf9450347dede37a
-
/data/data/com.secondarm.taptapdash/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/664D6AD200CA-0001-1489-2107A7380188SessionApp.jsonFilesize
235B
MD550603ea47937c185caa59b73655d3004
SHA12207601de9bc3a6aaf26a13aa94281147e31bcd1
SHA2563a18470882409c7143e13b88536a5eb7afc0d15ff78f831c09ad1dbf7b3520ca
SHA512a08d36fe0a82a2ebe9aaeffc0524d9672fe9ead60683ace53cc85379718f424fd5cc1bad9c71aa6b715c1cb5d2cb982be50a7854a4b539195ed4557e92156771
-
/data/data/com.secondarm.taptapdash/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/664D6AD200CA-0001-1489-2107A7380188SessionDevice.cls_tempFilesize
90B
MD56f9858c234d5830c924b3adb50c969d2
SHA108a6cfb25ed2da2d16aaa05e4a5baf8fbd7b8d32
SHA256fb3e46db06af8d54120462cef642340ce1cc5de16b1a7712695da605138bf92b
SHA5126870c4db3de6c06d137fe6638732b3ff1683586959f58441d971901d3c58962cf09bf61c3d5196d20bfe608559dea61d11c507432b7b9552a33890023efb3b27
-
/data/data/com.secondarm.taptapdash/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/664D6AD200CA-0001-1489-2107A7380188SessionDevice.jsonFilesize
204B
MD5d5b53116d49071009e657fb04c54ea14
SHA1cf39b7f418fa61288d7545d65c3dc261a5cf2686
SHA256b3fbc1500da59bd3c5839e2522ce3aaeae3c60bad6764691edc019c011d07efc
SHA5129d4464a563f2fff1156eed1ba6aee077ce8e3846963ed421eaa7f38ba5eb4a0c4a37b4f98bb996bf39ac1b9ae4fd4b35c904c2f64db2c94e4a81ba71741d63d5
-
/data/data/com.secondarm.taptapdash/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/664D6AD200CA-0001-1489-2107A7380188SessionOS.cls_tempFilesize
15B
MD52566d27ce8c28d8961f082c375d7535e
SHA192fe585b1a2c9c523d2fa1f65ab5c1b6a1a6edaf
SHA2565acdb54ddba2e264f6822fbdbc4e9b5158f57d43785c2f01d981956b18f7a90a
SHA5121c70679bbd25a57f9ac02083d5af0fe72b1417cf3070a195497f03d6f492e87b1ed3f570de7ea7c814c995a1530e32610d9570f31a480648f4062e8d3287be8f
-
/data/data/com.secondarm.taptapdash/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/664D6AD200CA-0001-1489-2107A7380188SessionOS.jsonFilesize
55B
MD55caea4b68c57072f7f52a5a41720566c
SHA14d9712f1702c7238949da43f7d8ae6efb233a666
SHA2563223857b618b924c2b0fbc7bfb373a1aacf300a7b5ab585e18fffcf19039f363
SHA512fe1455d21c521aeae3292bdcc386f6d2005dc253930c03e44dbcb972f96b849670d2aba039ea59e1a5ebc0350e6315151d17bcda55c161a62987d4bb01e91f9f
-
/data/data/com.secondarm.taptapdash/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/log-files/crashlytics-userlog-664D6AD200CA-0001-1489-2107A7380188.tempFilesize
3KB
MD588ecf97b1a2379d440d8acfd7d6c2085
SHA114675a88aabd5debb6ae0f095fd414aa7cffc4b0
SHA256e7ff6df79e11376c7b58c16f889d17084fd3450d7346a6b08450f64ec8f65053
SHA5122da028ff8770a13c630529c569f2be56443edd3cbd08a06280f81f1721ad19ed31132be55fcce6926d81325259d85a7af1185168cf7de207ee6f2317e335b106
-
/data/data/com.secondarm.taptapdash/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tapFilesize
1KB
MD56b7970e41e713684c7cc9fa8c13d3b1c
SHA17ff8ccab166609ab280d982db41cacd5121d586b
SHA256a10dd53d436dda49389bb02c479d9ae7c831f734a3e48848b8e385e759e8ed52
SHA5128635afddb3c4efc60f5714ae70c2b688a647896616d71f3f5d4cea680edced9c71fecdef76c1eb2a73de317c10f6340b72c102439935b9372498ae0889400ed6
-
/data/data/com.secondarm.taptapdash/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap.tmpFilesize
16B
MD5c33583fae4e0b61cde1c5b9227963237
SHA1fe2ebe4d27469af1460f7e852031a04208ef629b
SHA25635c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
SHA512fa09047004bec791b23f0dade0b64f8ab9bbd67555505e0d0818f6e89dfe56f474df80db0786d081d36adf23a5bacea40275ba043444a3a85d3d9612575bdd1e
-
/data/data/com.secondarm.taptapdash/files/.YFlurrySenderIndex.info.AnalyticsData_JWSMRPCKFVG83C9ZFYDD_211Filesize
88B
MD5f46e556069dc3d14faa5b8ef2969570e
SHA14c330f719604012f1847905a8f6e782683e452e7
SHA25600a544cfb2a0c209bccd2802827fabc459b63cad752019d759ae9a630194f3ae
SHA512825d96b4c8df395f26a60b77f39c70422890dff74776fb2bc183d8d608beb7813c4f61d6917c59ee52706124cdec7b1224b1b7330525e3fc2b076c942820ab25
-
/data/data/com.secondarm.taptapdash/files/.YFlurrySenderIndex.info.AnalyticsMainFilesize
72B
MD5e6ab0c491832e46f1a0806a071c17085
SHA182402cebde95c3bc122ce62c3f7e38ba27ebb941
SHA2560a95663388533d88401025d64e944d7196384bd750fd28764c6071b6b081e443
SHA51259523673121682886e2e63f4ccd63efb6ae8174c1e932c8256f70171f46c05c54daaf1e79102fdf689d046125a8ad9eb82825808b9b9b59c95da27d31766ca6f
-
/data/data/com.secondarm.taptapdash/files/.yflurrydatasenderblock.5aaf97a8-ce1c-4d53-a091-0ea8f237e7a6Filesize
345B
MD594153d81d61b08264fea554bc386c08b
SHA1bf0de757216bc3cb050438c346fd2c5f185e58db
SHA25619fc005a51e901971224b757221f87396b78744326f6eca633acafbee3bc5d50
SHA512639133bd7bfce0584906ed96ad558fa4f5abae2207edc3b75280bb7a64f3b7259dddd29f3bcb04d1e2921ea4142e54c76fe49298edbbc710832657528cef0f58
-
/data/data/com.secondarm.taptapdash/files/AppEventsLogger.persistedeventsFilesize
402B
MD5bd90db76cc07976b95c321393200b079
SHA10a3f17ee5eb11dcd61cd5858c1e3b2861926d4f9
SHA256975d3c75b3c200710abd9e544fbc86ebce358c84b6ccabb37904edb4bd4cbd83
SHA512267aab2f4a92ae271822b17d158cee1605cabebe904f3042fd4a4ce78780846807a5bb77594fe57c6580325d348d71f745065a5ee1993d680b9fe194b714443f
-
/data/data/com.secondarm.taptapdash/files/Chanel.datFilesize
42B
MD5b4760d812bd5e723911d3f346611c8f0
SHA182753987ee0d5612816e761537987d81b6cd2fbb
SHA256bcf66c18a619b76916ca263ddd2503bb18cc4685eade8534414f4ef90c0c6ad0
SHA5125626e97418427b3fc7f592165721a00eaf40e3b13c92b717020242be30084b1f9720500547fbd4c7d48695c744525940bacd04ac65edeed1f7aad429b9b3af89
-
/data/data/com.secondarm.taptapdash/files/UnityAdsStorage-public-data.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
/data/data/com.secondarm.taptapdash/files/UnityAdsStorage-public-data.jsonFilesize
54B
MD50f19f285ee596727b6dc0c8066ba19a4
SHA1901c43fea1f82aaf397cbad13e54f367190e7cce
SHA25638e10461ce3f0c2fb0569b289b863011de488d297fedd538736e58d77439e01c
SHA512ff79a9b9d653bc2cadf43466975bf15d34eb92c6c213d311f7b08eae27c7725eda5d603999f20443c8f67d32feba4b360642fe69d7e8e9371a58bceb5fb46e03
-
/data/data/com.secondarm.taptapdash/files/drptcache/inner_self/103-1c7ff990-664d6ad0-6.ich_tmpFilesize
413B
MD5b2f8c987dabe6eb0ae1db56bd286e0b9
SHA1d97548b55128f3e12e478631340c7524253ad27c
SHA2561831a9ca0af70a63661df888f8126e7a8f136c823fb31a6e43a4ea2354905d72
SHA512c226b2cdfddc72282317afd0d4b27341cec0ac4a00b9160c630f670d291c0c626142689fc6e09c6c9234288773a848251dfe2a0d003f64a1f77c4d869b3563a2
-
/data/data/com.secondarm.taptapdash/files/drptcache/inner_self/103-43cf5ac8-664d6ad0-5.ich_tmpFilesize
413B
MD50db739fcbffc0d58119c52e1a74a396b
SHA1e36ae598efba3c71d5d668ca397b5e662076af3a
SHA2566f7bffb35cc76dbbfa9271b4f94540ffa0ed5afbc4d886f4bc0788ed640559c7
SHA5129b61e246ac4110b4dfde78419cda4776a76ec4c7302688457cd5e83b20eab09096e9b2e6892eb4be67edfe265117f204b83ae3e7d370163a940d080e0cef71fe
-
/data/data/com.secondarm.taptapdash/files/drptcache/inner_self/103-513eba70-664d6ad1-8.ich_tmpFilesize
413B
MD53281844fff44d38dad8c5aca7a0f1123
SHA1c0c0e4f75ee282d21e0d4fe4d28eadd0aadafeee
SHA2562af83a31f32032022f5e7e2322a2c1e4686b71114d22f9c046c383b70844993e
SHA512d2503976ace40671106dab7662d8aa431afc9a89f9f84029c63e3edc38385138ff8a3c3b6497a2b07d63522931625d7bc9bc4b45e6416dd0d9823bac5f091884
-
/data/data/com.secondarm.taptapdash/files/drptcache/inner_self/103-6acaa741-664d6ad0-3.ich_tmpFilesize
54B
MD59f2efa4094ad4f883e223c59c5e7b99a
SHA1057fad403f346e4abf31c933490edaf709d0600f
SHA256898c29cc10389988958e532b1968d37274d5ab4fc2fccacb3c725f70084b1a84
SHA512d31ecdb095f9fda966affdd710c6180bb6f04fa597c936dbe4d110642d2229f954679eb6783d829b70d907af40438a9f93172e008d5018a190b5dc7eb195d2a7
-
/data/data/com.secondarm.taptapdash/files/drptcache/inner_self/103-a31ebf20-664d6ad0-4.ich_tmpFilesize
413B
MD58405327abc3ba01899ef7b1b473f67ab
SHA1cddc668f97f7834f09d89f58020f8458cf49b426
SHA2569f5a0bfca1801c2ba6f3ec7ca2c82eda03b469689f929c2d0641d8e5bbb7679b
SHA5127905d689dad083ff0615f2ecc30425fb51ed3a5c413695b05ef308b684e3407d18238a4b3869a1558edf73faa38c0e691daae00b8832411aca195e8377f4777f
-
/data/data/com.secondarm.taptapdash/files/drptcache/inner_self/103-e67cd1e9-664d6ad0-7.ich_tmpFilesize
413B
MD5ac3cb9a6af12ab1f2d654ff459c3c960
SHA13cf66f435de571deb2c83045fd9673fe736d1558
SHA256cf07249ae0b173dd190ac45514eed20ea8da6a76da2dbf04992ed4ef565b5a38
SHA512b79eb90d2f206384a0f7215a940f3adc25841d02a3d910d1024f6563185cc3e33e9ec1dd6c61dd6a7709d0ec0df6691ab3862f5a2f550efdcb11c8ac95520a9e
-
/data/data/com.secondarm.taptapdash/files/drptcache/inner_self/104-df635321-664d6acf-3.ich_tmpFilesize
413B
MD59202ad590f4b893da6eebfd67d75ff6f
SHA12a1616a5c80a1ca26e036f8db585f1e363b5ee82
SHA2561e0739c619f0956ef28e816fbe469122075b7e6d79a2268d607ebf7d65f4a428
SHA5120e66b8397efba76881b55b5ae90b74ba6a9580eb3d61c433f81b1ace03eaf6f7662fc19bf455ab414a92256d10ce149d4a7d8ea3cdcb6eb9fdd4f9030103f73f
-
/data/data/com.secondarm.taptapdash/files/pnofb.pngFilesize
6KB
MD54c21a4ae77f1608be7a249c59f20d48b
SHA19cea951cf96fb41cdf83c682d74d34c27098fc8e
SHA25678fa11a9707a333d30f9945b725d3601d29aafba1294df39ba5c66113b0c6622
SHA51218310e92fa27e2f08436349b73a94c14e7c2ea7ab7727ae0fa335e4b145ae5c6febaf38c0dd5aff8edecdeeb35f22626ffbb228284df07f8a7ffdee4b4254dc5
-
/data/user/0/com.secondarm.taptapdash/cache/1582435991586.jarFilesize
20KB
MD5fde2ee00cbd121cfab5290b078aa3ceb
SHA1e2b77d5320e155e413d040a8c20020962065b2f8
SHA2562897b0812077c654a9b3fbb0b6303d5cde681eeba7ad9981de65716c7810d685
SHA512a9326aff8e454a2b4ac09984ef2a65fddd4dc146b4c44d839035549bff8c9fdaae490326d0b018f76c1ca2e4fb25426d74f550ca0950982fba632a023af99a56