Analysis

  • max time kernel
    9s
  • max time network
    155s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240514-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
  • submitted
    22/05/2024, 10:59

General

  • Target
    67070043be312f7d7ae75f81dc825a4b_JaffaCakes118.apk
  • Size 8.5MB
  • Sample240522-m3glaace4v
  • SHA256 13ee3af45f068256f0834d1202d79f36328aaef59eee4c3962e1a25d14b32bd9
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Signatures

  • Requests cell location 2 TTPs 2 IoCs

    Uses Android APIs to to get current cell location.

  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

  • Checks if the internet connection is available 1 TTPs 2 IoCs
  • Reads information about phone network operator. 1 TTPs

Processes

  • com.baidu.news
    1⤵
    • Requests cell location
    • Queries information about the current Wi-Fi connection
    • Checks if the internet connection is available
    PID:4617
  • com.baidu.news:bdservice_v1
    1⤵
    • Requests cell location
    • Queries information about the current nearby Wi-Fi networks
    • Checks if the internet connection is available
    PID:4684

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        channel

        • Path /data/user/0/com.baidu.news/channel
        • Size 5B
        • SHA256 727312eccb9e85363a0e24d926c81f22b0350be7769f89dc0928a3ed0134b1cd
        • MD5 SHA1 SHA512

        news.db

        • Path /data/user/0/com.baidu.news/databases/news.db
        • Size 180KB
        • SHA256 2d515b56e0f0b4f22a5f983430da095506bd03645778db88cdb9df6837de9bd2
        • MD5 SHA1 SHA512 SSDEEP

        news.db-journal

        • Path /data/user/0/com.baidu.news/databases/news.db-journal
        • Size 20KB
        • SHA256 4e93ae7c16a145783f04d535aad7112b561b401ebbb01cee861aeb67f01984cf
        • MD5 SHA1 SHA512 SSDEEP

        news.db-journal

        • Path /data/user/0/com.baidu.news/databases/news.db-journal
        • Size 8KB
        • SHA256 9873c03b79c7aa6fc6ee1f8ffc36c825bf51592de474c0bf5be7709ab4a11574
        • MD5 SHA1 SHA512 SSDEEP

        news.db-journal

        • Path /data/user/0/com.baidu.news/databases/news.db-journal
        • Size 8KB
        • SHA256 4dd7c9a6c4e10b312e0e3007923fd5d55ee78a04164da4598dd8c1ce5dfa1a79
        • MD5 SHA1 SHA512 SSDEEP

        __local_stat_cache.json

        • Path /data/user/0/com.baidu.news/files/__local_stat_cache.json
        • Size 25B
        • SHA256 c8a6624f390568f0ddcb9841336aec6a564460fdaf6624e562b32935b8956f19
        • MD5 SHA1 SHA512

        con.dat

        • Path /storage/emulated/0/baidu/tempdata/con.dat
        • Size 108B
        • SHA256 7c61a8454fe2bf7160dcebd00e3e6e428c87d8e3eb29e1c045acfa568bb031df
        • MD5 SHA1 SHA512

        con.dat

        • Path /storage/emulated/0/baidu/tempdata/con.dat
        • Size 151B
        • SHA256 4072808afde5888df043ef18f5275a8706b903f20a9df575ef746863ff67e5a2
        • MD5 SHA1 SHA512