Analysis
-
max time kernel
23s -
max time network
156s -
platform
android_x86 -
resource
android-x86-arm-20240514-en -
resource tags
-
submitted
22-05-2024 09:35
General
-
Target
66d009b47bcae4402f92b6dbd06815e2_JaffaCakes118.apk
-
Size
2.1MB
-
MD5
66d009b47bcae4402f92b6dbd06815e2
-
SHA1
4add0e894c8b465615c0b82f95066745c99fe885
-
SHA256
a17894f1f8f612a1518ffec42df26d0aeafa5114811441c920baade5bca040ec
-
SHA512
b8d19a197e6870f9ed1d5534817c20cfd5c9b54e967f8c56eda7eacb42323060308c78157c14d6987be1e1af36842067d2ecbda5a716e6e0b97ee8320812bdb0
-
SSDEEP
49152:eb4a2A91dj+ht4LEiqlxLLEFXEahz4UGFzqeQrx2KnOaqrr:epr1djOmLEiKLchc7tAV2jrr
Malware Config
Signatures
-
Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
-
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks if the internet connection is available 1 TTPs 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
Processes
-
com.nbblabs.toys.singsong1⤵
- Requests cell location
- Checks CPU information
- Checks memory information
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries information about the current nearby Wi-Fi networks
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Execution Guardrails
1Geofencing
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.nbblabs.toys.singsong/files/__local_last_session.jsonFilesize
97B
MD5c04de80e43c84bb4d891e816b5fda152
SHA145f503868c2aa3aec350939b34d8fd1a6861ed78
SHA256fc2c039959b0fb7b9e7eec923e3854dddd329e201281744cab03dd7e1ddc33a1
SHA512dc700b5cde1f9a8b59c3a7c35fab4026a358e119fee80722646fbab9ec6b239895c2c1036d47f2eaafcf1c0d65d100832e2ed078ab926740f558f52d1adf3e83
-
/data/data/com.nbblabs.toys.singsong/files/__local_last_session.jsonFilesize
135B
MD59bd254ace35b4bb93e42f0ecf9968eed
SHA1b7e4609fa292dcf6e46b7a47e85a7842ef77218e
SHA25618d50dbe60bb0089de0940841d1b8f38002d766669e3a21a760edb492aba54cd
SHA512df96a800984e38398af99e12c34737d23fe61a1852fbb323bd96cf8668e80d40341e6865f7925d8c28ff2e0001b7d6ab11dbe621d429a2746c259aff1241c06c
-
/data/data/com.nbblabs.toys.singsong/files/__local_stat_cache.jsonFilesize
25B
MD52d805b13f2f28dc3ca9bbcc000f49bb5
SHA19eac165b4d81258fd3967cde5cc53b53b1dabcb1
SHA256c8a6624f390568f0ddcb9841336aec6a564460fdaf6624e562b32935b8956f19
SHA5125db8c57bab36bcf9db698c1dce70318cbffc156dd1d1c1e09e5b7ba60aff07b598ebbf26c4bd8a2b03bd6e59ef2dde2d944a22a8d8a19ecc8378e83afb7c83b0