36f7fddcea9b92869a582e43772f86e17d996d73b9f172ff5be834c1f8649a18

Analysis

max time kernel
69s
max time network
142s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
22-05-2024 13:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6777d1c63e11aeafacfb47a0bb505672_JaffaCakes118.apk
Size

1.7MB
MD5

6777d1c63e11aeafacfb47a0bb505672
SHA1

adc269db01b7a96da27459c5f3652ae9a5947dc6
SHA256

36f7fddcea9b92869a582e43772f86e17d996d73b9f172ff5be834c1f8649a18
SHA512

dce9e1e5cc4f8c4668cac8e39c4b52f5a2560220aed94cf972d29ce2fbe34fcc8e9ef340f7de29491b827af099ec7c5ae8a7a82d9e72eac51fbeb359e42a098d
SSDEEP

49152:VVni4ZT5MQdRL/2dZb5aWivyWGwyLY8Xt3HOPIqGXSh5:Ti4ZTaQdIl5m6lw0Pd3nK

Score

8^/10

banker collection credential_access discovery evasion impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs
evasion

T1426

Processes:

kx.app.notes.diary.memo

ioc process

/system/app/Superuser.apk kx.app.notes.diary.memo
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

T1418.001
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
evasion discovery

T1633.001

T1426

Processes:

kx.app.notes.diary.memo

description ioc process

File opened for read /proc/cpuinfo kx.app.notes.diary.memo
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
evasion discovery

T1633.001

T1426

Processes:

kx.app.notes.diary.memo

description ioc process

File opened for read /proc/meminfo kx.app.notes.diary.memo
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
evasion

T1407

Processes:

kx.app.notes.diary.memo

ioc pid process

/data/user/0/kx.app.notes.diary.memo/cache/1582435991586.jar 5106 kx.app.notes.diary.memo
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
collection credential_access impact

T1414

T1641.001

Processes:

kx.app.notes.diary.memo

description ioc process

Framework service call android.content.IClipboard.addPrimaryClipChangedListener kx.app.notes.diary.memo
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

T1424

Processes:

kx.app.notes.diary.memo

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses kx.app.notes.diary.memo
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

T1422

Processes:

kx.app.notes.diary.memo

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone kx.app.notes.diary.memo
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

T1624.001

Processes:

kx.app.notes.diary.memo

description ioc process

Framework service call android.app.IActivityManager.registerReceiver kx.app.notes.diary.memo
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

T1421

Processes:

kx.app.notes.diary.memo

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo kx.app.notes.diary.memo
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

T1422
Reads information about phone network operator. 1 TTPs
discovery

T1422
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

T1471

Processes:

kx.app.notes.diary.memo

description ioc process

Framework API call javax.crypto.Cipher.doFinal kx.app.notes.diary.memo

ioc	process
/system/app/Superuser.apk	kx.app.notes.diary.memo

description	ioc	process
File opened for read	/proc/cpuinfo	kx.app.notes.diary.memo

description	ioc	process
File opened for read	/proc/meminfo	kx.app.notes.diary.memo

ioc	pid	process
/data/user/0/kx.app.notes.diary.memo/cache/1582435991586.jar	5106	kx.app.notes.diary.memo

description	ioc	process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	kx.app.notes.diary.memo

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	kx.app.notes.diary.memo

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	kx.app.notes.diary.memo

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	kx.app.notes.diary.memo

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	kx.app.notes.diary.memo

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	kx.app.notes.diary.memo

kx.app.notes.diary.memo
1⤵
- Checks if the Android device is rooted.
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:5106

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/kx.app.notes.diary.memo/cache/1582435991586.jar
Filesize
9KB

MD5
e8e0527a01aefdb89afd2c508f131da1

SHA1
f1103e6b260c657ceb3d95f1b023af3fda8b133a

SHA256
f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce

SHA512
fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34

Download Submit
/data/data/kx.app.notes.diary.memo/databases/note.db
Filesize
24KB

MD5
1bb88fdcdd191c3a638cd6dab200303b

SHA1
90652eceecf5190a54b9a38225ef9b65893d1ea9

SHA256
b21e9015d9ae4caa48aa809460dd1c286805002f80b9dbd0eb1b6c94bfb1c732

SHA512
4606e4dbbe1a59329b9aca7a915af8a62ab67abff57ccb59e33692a44ceb68ba9d0ff64145b4520dc6fd1586fc15244310c98b501f18f26465fb163b018ea057

Download Submit
/data/data/kx.app.notes.diary.memo/databases/note.db-journal
Filesize
512B

MD5
dd89bfc91cc1045a4f6a728667b37fab

SHA1
aa8277b0e0a8e40eda0cca4682b2b50ae0f60ca1

SHA256
140045fea2f18c267bc9b48ad0f083558f99588a4bdbdc7ea8fdbb29ded972b3

SHA512
1898b70d64bb7453f6da587bbf243b1e5fcb43fac1b940ebd6dff0df31f346032a2d52ef975a1070587d4bf311b0fefacf7bc00c4595d27464dbc1a7b3f48224

Download Submit
/data/data/kx.app.notes.diary.memo/databases/note.db-journal
Filesize
8KB

MD5
848949d39ec404608f8ddffc1402ce8f

SHA1
1e23980d9297424e6d8c32c2230c818a2a291521

SHA256
a1114637ecb5691f73f02bf7f37b5bce97cdae0cc9e6d926db20ee238cdd054a

SHA512
9266ffd882057ead31cdb212d82a5f9029e7e395301efe86a47b006a080b2476c254e1f8a48cdf361eccdca368573972a8b100cf537281536f17e20e1e333eb5

Download Submit
/data/data/kx.app.notes.diary.memo/databases/note.db-journal
Filesize
8KB

MD5
ebca62ced08ef924203073b0b6dc38f1

SHA1
c0bc059bfb3c37d2de4ee07d3fb3d6fdb9652e6c

SHA256
f997583879b19785389162872766790f0e1e3c07ea6f2971412594cdb2b97e34

SHA512
505e5abf50ddd4f04824fe741fd57a8e8402a7dd081941d0f053b0a86d9127d046e8a2a21863db134e50d9c7707e61633488980d1a56b64d4d586d7dec9f412c

Download Submit
/data/data/kx.app.notes.diary.memo/databases/note.db-journal
Filesize
8KB

MD5
425b2fb115ce76e7cb389f52d5c3fab2

SHA1
24a2be36a931146cba7e77697de9f5df80c540d4

SHA256
4c8f9d11a70fe241a11f4129e624f1741e306dbd7e1a5444bdc9e29d5ca12d8c

SHA512
bb9a5df065a812ccf9f120ecdf804531cd4f23237fde8b77310357c2cfbdef5c7a87fb04c0bd54bea21546a02ce9d81dd7c70b2de77aca6a8c209786795b47ee

Download Submit
/data/data/kx.app.notes.diary.memo/databases/note.db-journal
Filesize
8KB

MD5
f8c1bb9e3a1d6fe46e7b24d934ddc83a

SHA1
9bb163671b2332320b48d33b10bb88075648e8db

SHA256
fcd0ac3bc14168581f2a79e3c801f22a7b225645b3d6eb1886a5da16482ca23f

SHA512
e1dd6209d7ca4848f4d21c409eea2a502ed40b00cf4b196fc2c4c3d4af39e46dea9faa1628176fdcda2bc50e7ffb85fec49b85ab2910858e69bde0912dcb2185

Download Submit
/data/data/kx.app.notes.diary.memo/databases/note.db-journal
Filesize
16KB

MD5
a1dc199d7655e4eb76cc81e1c8809061

SHA1
6d62dba5260d7c77ce3169100b2a0c2a37d68f52

SHA256
00affe9b86c8a4ec166c1f31d97672f0a08924d27fa5452551dc7ff827472b6c

SHA512
4f9a022da57cbef52b729f098fa16103176c1531b9b59974ae1326b3a76aa133591a266c210569aaad0e97e5f8775cf5e4148b36ddf24a8854d3371d26f44f6f

Download Submit
/data/data/kx.app.notes.diary.memo/files/mobclick_agent_cached_kx.app.notes.diary.memo
Filesize
121B

MD5
8200a9ed15977dadfbe35bfcd5f37eb3

SHA1
74f890744ded7831353a7e323dd95b5eae49279c

SHA256
07f9b9a99a152fb9c2e916d126d5eeb4fb33a888b9c9f9882906cafd30cfcdad

SHA512
27bd33f83d91c804c68f001b06e783ed8a9781c975e24bdeb15d4352425b459effcf412a83d39b2607d9b9c1d5df8d2d8af69845a52639b3a5b060648e47fa77

Download Submit
/data/user/0/kx.app.notes.diary.memo/cache/1582435991586.jar
Filesize
20KB

MD5
fde2ee00cbd121cfab5290b078aa3ceb

SHA1
e2b77d5320e155e413d040a8c20020962065b2f8

SHA256
2897b0812077c654a9b3fbb0b6303d5cde681eeba7ad9981de65716c7810d685

SHA512
a9326aff8e454a2b4ac09984ef2a65fddd4dc146b4c44d839035549bff8c9fdaae490326d0b018f76c1ca2e4fb25426d74f550ca0950982fba632a023af99a56

Download Submit
/storage/emulated/0/gift/hd.camera.photo.gallery.editor.cc
Filesize
11KB

MD5
a1b1da22ed0adea0c34b1a81e082880b

SHA1
b1c4a343dee1038127055ef0a18b4fd564969144

SHA256
23dad30a05270483e0210a4a8baed816ef95b9c8e1a194fe829428f7385d3e97

SHA512
11baad8ca6e44d01d75d29debe7f8b833301fa565ee576a52ffb8b62b1b7978563302e82cb1f122150b8c105a6c1951f4f0ee8eadf5916b0b8cc4389a3a2b0cd

Download Submit
/storage/emulated/0/gift/kx.photo.editor.effect.cc
Filesize
10KB

MD5
b8096e8f6d3edeedf06e8547298cae3f

SHA1
5bb74aeaf80f6862419c2f329f81c94ee07cc9ed

SHA256
9dbc3d95191b8c68a7927bf55c1fd96d04c3b3901575126a700db26140904c4f

SHA512
1488d3525addfca6c6434fcb043d6b81753c32fe0d9b8b6d33476f24db8e2113cac887d31fbbedf24145a05e0b0816a433d7fbe3bb6b6adec20e03fd5ba18524

Download Submit
/storage/emulated/0/gift/picture.image.photoeditor.photogallery.folder.cc
Filesize
9KB

MD5
b2250924c9665c73a4c79486d3caa18a

SHA1
5d4789e6996f9ad1dc44dacf1b6f88771fbd7ac9

SHA256
d6d5ec7a6fc36d919b37fbd3f8e8ccda1a90433a346af69238efe9b7aff4b59a

SHA512
09c992466c3e47482da9f6d72102b013759ea3516cd43ef62821796bb514178e3b964a390e7f3d4134020daae551fe90b2c61744eea0b12b9f9130e7f4fd428d

Download Submit
/storage/emulated/0/gift/tools.scanner.barcodescan.cc
Filesize
5KB

MD5
5e976972ce82f1e658d82faa53d5b618

SHA1
1b045d168ab809d06c11b0913fb23aacca60f1d6

SHA256
8f83497e9b3872c9878b60e3f6ad6e1eb1a412c5901981e3f714c47bf7278636

SHA512
d6f3e0ef3c6681bff332e6dcffb5caa6c2b737d53dbc81bcdf1f5ba1a85ae7098e8f364531a839aab6036a8418051b11fb16df8cfd2ba41ce8054f5301691cae

Download Submit
/storage/emulated/0/gift/tools.weather.forecast.cc
Filesize
17KB

MD5
124277cc81b5e530a94337823341b4f0

SHA1
1d798fb5da3a5519fb7c16d77e4dd02891c8d3d7

SHA256
6012af15b7267a8d6a043eeadb62736c7527405e9369cd77054a8114b097308e

SHA512
19e98f6da29fdfb96396d2eedf06411ab95accc94f112d010201801c502c1c75cf2d907dcad257c090468cfdf4f6165071e3e4c3fe2fa6544953a03630ff0fd8

Download Submit
/storage/emulated/0/gift/yong.app.notes.cc
Filesize
8KB

MD5
3cfe50823d6c654b15093abfe51650d8

SHA1
8da72ff53d93d94dae662661da31207cb9b41c5c

SHA256
53369701378744d74da2d55676c6156facb58ec7be09e3bb51b2c77483c26518

SHA512
0ee10ab2717b0423acc48c953265339194277d4df795768c14866ed14abf098426c8e73d75ef10cdfa6b3a3cc2997e21e2a0c6b1495dbd2c82dba56c62d43096

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads