Analysis
-
max time kernel
47s -
max time network
132s -
platform
android_x64 -
resource
android-x64-20240514-en -
resource tags
-
submitted
22-05-2024 09:35
General
-
Target
66d009b47bcae4402f92b6dbd06815e2_JaffaCakes118.apk
-
Size
2.1MB
-
MD5
66d009b47bcae4402f92b6dbd06815e2
-
SHA1
4add0e894c8b465615c0b82f95066745c99fe885
-
SHA256
a17894f1f8f612a1518ffec42df26d0aeafa5114811441c920baade5bca040ec
-
SHA512
b8d19a197e6870f9ed1d5534817c20cfd5c9b54e967f8c56eda7eacb42323060308c78157c14d6987be1e1af36842067d2ecbda5a716e6e0b97ee8320812bdb0
-
SSDEEP
49152:eb4a2A91dj+ht4LEiqlxLLEFXEahz4UGFzqeQrx2KnOaqrr:epr1djOmLEiKLchc7tAV2jrr
Malware Config
Signatures
-
Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
-
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks if the internet connection is available 1 TTPs 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads device software version 1 TTPs 1 IoCs
Uses Android APIs to read software version number for the device (IMEI/SV for GSM devices).
-
Reads information about phone network operator. 1 TTPs
Processes
-
com.nbblabs.toys.singsong1⤵
- Requests cell location
- Checks CPU information
- Checks memory information
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries information about the current nearby Wi-Fi networks
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Reads device software version
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Execution Guardrails
1Geofencing
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.nbblabs.toys.singsong/files/__local_last_session.jsonFilesize
97B
MD52d0836f65fca719ac372fdc39d63f629
SHA1edde58d8b76e2bb37cf329da2856d990945b8832
SHA25665feca5886a28e24ab12f6e0012d46d0323e616bce841c491f1d1cd0e43abe3b
SHA512a1963a17a6bbc23e67404f534e8cc01ebdd5eb07b4face82785764265ed48b45dc99ebbf80dd2e35b49ff6826788409c4a597bfe7c9289f85c119dfac9a60367
-
/data/data/com.nbblabs.toys.singsong/files/__local_last_session.jsonFilesize
135B
MD52566418c563231ba484fb385a9a23dcd
SHA1c35795fac92640f900937e18b5bf934aa0e8ec56
SHA25620b411761895230161cf25489688f75588856f86f2f1fe2fcb09d27918d7b330
SHA5125c32a3c1b71031bccf94e208a4e15a462b9e47fdf596139c09c0b0ac542e22ddd821a0c3512c1840020e6e2325631e33109fe82028b994d42155ea32ebfefedc
-
/data/data/com.nbblabs.toys.singsong/files/__local_stat_cache.jsonFilesize
25B
MD52d805b13f2f28dc3ca9bbcc000f49bb5
SHA19eac165b4d81258fd3967cde5cc53b53b1dabcb1
SHA256c8a6624f390568f0ddcb9841336aec6a564460fdaf6624e562b32935b8956f19
SHA5125db8c57bab36bcf9db698c1dce70318cbffc156dd1d1c1e09e5b7ba60aff07b598ebbf26c4bd8a2b03bd6e59ef2dde2d944a22a8d8a19ecc8378e83afb7c83b0