36f7fddcea9b92869a582e43772f86e17d996d73b9f172ff5be834c1f8649a18

Analysis

max time kernel
69s
max time network
167s
platform
android_x64
resource
android-x64-arm64-20240514-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
submitted
22-05-2024 13:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6777d1c63e11aeafacfb47a0bb505672_JaffaCakes118.apk
Size

1.7MB
MD5

6777d1c63e11aeafacfb47a0bb505672
SHA1

adc269db01b7a96da27459c5f3652ae9a5947dc6
SHA256

36f7fddcea9b92869a582e43772f86e17d996d73b9f172ff5be834c1f8649a18
SHA512

dce9e1e5cc4f8c4668cac8e39c4b52f5a2560220aed94cf972d29ce2fbe34fcc8e9ef340f7de29491b827af099ec7c5ae8a7a82d9e72eac51fbeb359e42a098d
SSDEEP

49152:VVni4ZT5MQdRL/2dZb5aWivyWGwyLY8Xt3HOPIqGXSh5:Ti4ZTaQdIl5m6lw0Pd3nK

Score

8^/10

banker collection credential_access discovery evasion impact

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs
evasion

T1426

Processes:

kx.app.notes.diary.memo

ioc process

/system/app/Superuser.apk kx.app.notes.diary.memo
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

T1418.001
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
evasion discovery

T1633.001

T1426

Processes:

kx.app.notes.diary.memo

description ioc process

File opened for read /proc/cpuinfo kx.app.notes.diary.memo
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
evasion discovery

T1633.001

T1426

Processes:

kx.app.notes.diary.memo

description ioc process

File opened for read /proc/meminfo kx.app.notes.diary.memo
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
evasion

T1407

Processes:

kx.app.notes.diary.memo

ioc pid process

/data/user/0/kx.app.notes.diary.memo/cache/1582435991586.jar 4594 kx.app.notes.diary.memo
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
collection credential_access impact

T1414

T1641.001

Processes:

kx.app.notes.diary.memo

description ioc process

Framework service call android.content.IClipboard.addPrimaryClipChangedListener kx.app.notes.diary.memo
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

T1424

Processes:

kx.app.notes.diary.memo

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses kx.app.notes.diary.memo
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

T1421

Processes:

kx.app.notes.diary.memo

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo kx.app.notes.diary.memo
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

T1471

Processes:

kx.app.notes.diary.memo

description ioc process

Framework API call javax.crypto.Cipher.doFinal kx.app.notes.diary.memo

ioc	process
/system/app/Superuser.apk	kx.app.notes.diary.memo

description	ioc	process
File opened for read	/proc/cpuinfo	kx.app.notes.diary.memo

description	ioc	process
File opened for read	/proc/meminfo	kx.app.notes.diary.memo

ioc	pid	process
/data/user/0/kx.app.notes.diary.memo/cache/1582435991586.jar	4594	kx.app.notes.diary.memo

description	ioc	process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	kx.app.notes.diary.memo

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	kx.app.notes.diary.memo

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	kx.app.notes.diary.memo

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	kx.app.notes.diary.memo

kx.app.notes.diary.memo
1⤵
- Checks if the Android device is rooted.
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4594

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/kx.app.notes.diary.memo/cache/1582435991586.jar
Filesize
9KB

MD5
e8e0527a01aefdb89afd2c508f131da1

SHA1
f1103e6b260c657ceb3d95f1b023af3fda8b133a

SHA256
f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce

SHA512
fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34

Download Submit
/data/user/0/kx.app.notes.diary.memo/cache/1582435991586.jar
Filesize
20KB

MD5
fde2ee00cbd121cfab5290b078aa3ceb

SHA1
e2b77d5320e155e413d040a8c20020962065b2f8

SHA256
2897b0812077c654a9b3fbb0b6303d5cde681eeba7ad9981de65716c7810d685

SHA512
a9326aff8e454a2b4ac09984ef2a65fddd4dc146b4c44d839035549bff8c9fdaae490326d0b018f76c1ca2e4fb25426d74f550ca0950982fba632a023af99a56

Download Submit
/data/user/0/kx.app.notes.diary.memo/databases/note.db
Filesize
24KB

MD5
f2135f4c0f603d86cd3b961519aa816e

SHA1
db9ac1cad795a01cbeee6b1a9211d7c09a6a64c6

SHA256
10c1910344a3892b41748da29af4207d2c741654f3b4fab62e436f8b6213efcd

SHA512
6e7a5faaeee104f9b8f8dfcd520f277855b883a3392a4c969d96483915b8e30932e0cc88744076b594cd9003cb8d9a68ffc8944c7f425c7eb1f43a21a74c668f

Download Submit
/data/user/0/kx.app.notes.diary.memo/databases/note.db-journal
Filesize
512B

MD5
6ecd009d753813543787aa2ed48f9b6f

SHA1
74073b1e38d766a7115343aad5268467fa5bc5e4

SHA256
546869c80af2b32771ed4423d3c1d3ab9d22215cb61cbe6f708dd0c9005e1d16

SHA512
27438124b98f22e3d9bdd905e0cad3e7e5b9d1c61b8f4f4cd7492659ca4b8337a618954343d4cb5947750b866199cd9e70e184459eed8cd722b5b86e86e9151f

Download Submit
/data/user/0/kx.app.notes.diary.memo/databases/note.db-journal
Filesize
8KB

MD5
ae44b1de99d48928819e7d2d8d8f24bb

SHA1
5e2dbb979f087993b24f647d7aff9ee32bc2edf6

SHA256
bd2f8babf279a4b364e90511b258fbcb692c8c1fd233a426df6a3352c7dcc79c

SHA512
2a24be47e1c66f98bdc58449d01db441e22a8489c5c584e4ed24d114f05314690a25a5e54773e5ef70b3b68194bbdda7fd468f06ba52225b3e3a071a16bad410

Download Submit
/data/user/0/kx.app.notes.diary.memo/databases/note.db-journal
Filesize
8KB

MD5
6bb6085694798d2cbb1b40bb15d9395e

SHA1
28609597a9de2ad5a01cc414ef0faa023746dc52

SHA256
f364e61e67e5302b5fed7351d5e94a197819f16dc031f4977c9e76cde96115ef

SHA512
175df50961e7463f3ddb240adb8a7e649fe1b88d7384f2dcd6e0ea7f65376bd7da760f2f4c455455116a70d0687d0457501f249c48b4711d89037aa562aa1072

Download Submit
/data/user/0/kx.app.notes.diary.memo/databases/note.db-journal
Filesize
8KB

MD5
e2dd5eaa8b6745b866ee6364cfdaf00f

SHA1
6c92dfc39a8ceeb010c0057d7b85118982523a4b

SHA256
21780bf0538ea9b40a2a7eb96e4cd20a8f4c8d538e4b4b2f52f1a57a29ab02ed

SHA512
a4c69b8298b710429ea3d00c234d14925c50553e0073ecb0ed536358b9aa1fbe39357107cd562c5097a5f8c85746c7b79f562d3c4fea889552d3d59f4d67cf9c

Download Submit
/data/user/0/kx.app.notes.diary.memo/databases/note.db-journal
Filesize
8KB

MD5
ceb655e85e1c5ca374dc5068147b2492

SHA1
80eb7c19bafeceffb38ee3feaafa2989ae12adb3

SHA256
d34aa036e11c8896a57a6535880a4b7b39c2bddbab60f66024f8f3c0e67f349b

SHA512
e6246a3577bce4df9655465111e2753fcc40ba69f8ada8f187c804898a4bc2cc2cb1c7bfb05cea69e108548b9177bf95a51b779c3e696a94f08e017929f27490

Download Submit
/data/user/0/kx.app.notes.diary.memo/databases/note.db-journal
Filesize
16KB

MD5
9e5c30509bdc9147520707cfa9b21a65

SHA1
04d82c8f5bd79c600853d2b946009eabbf454218

SHA256
4967d7338b5582d79569d9fe93f978ef73f810ebc19d2594115fd0fb04f5c0b6

SHA512
07cc538d572420d147537743a03154d44949b96b89e1c07be286eed5bf9bfbc848a00f9045b410e273d44778eb8975e5a60bef31808c011219ac230c558f5abf

Download Submit
/data/user/0/kx.app.notes.diary.memo/files/mobclick_agent_cached_kx.app.notes.diary.memo
Filesize
121B

MD5
2b06178ef102980cb19812c901b57217

SHA1
1790fa0b15b16903983542ea3353ad431470fb70

SHA256
1d9decf198d100f1c0cd4cc8094643ddc2d32263ca920ca9d472d5c604894e2f

SHA512
5a8c30a1c40253227b213372db51d9253526227eb8a8b44308f5007694428d1fa746b89ef4b35f8b8993bdc469e09ae942d6943b6e6914f32863a771fe2e2702

Download Submit
/storage/emulated/0/gift/hd.camera.photo.gallery.editor.cc
Filesize
11KB

MD5
a1b1da22ed0adea0c34b1a81e082880b

SHA1
b1c4a343dee1038127055ef0a18b4fd564969144

SHA256
23dad30a05270483e0210a4a8baed816ef95b9c8e1a194fe829428f7385d3e97

SHA512
11baad8ca6e44d01d75d29debe7f8b833301fa565ee576a52ffb8b62b1b7978563302e82cb1f122150b8c105a6c1951f4f0ee8eadf5916b0b8cc4389a3a2b0cd

Download Submit
/storage/emulated/0/gift/kx.photo.editor.effect.cc
Filesize
10KB

MD5
b8096e8f6d3edeedf06e8547298cae3f

SHA1
5bb74aeaf80f6862419c2f329f81c94ee07cc9ed

SHA256
9dbc3d95191b8c68a7927bf55c1fd96d04c3b3901575126a700db26140904c4f

SHA512
1488d3525addfca6c6434fcb043d6b81753c32fe0d9b8b6d33476f24db8e2113cac887d31fbbedf24145a05e0b0816a433d7fbe3bb6b6adec20e03fd5ba18524

Download Submit
/storage/emulated/0/gift/picture.image.photoeditor.photogallery.folder.cc
Filesize
9KB

MD5
b2250924c9665c73a4c79486d3caa18a

SHA1
5d4789e6996f9ad1dc44dacf1b6f88771fbd7ac9

SHA256
d6d5ec7a6fc36d919b37fbd3f8e8ccda1a90433a346af69238efe9b7aff4b59a

SHA512
09c992466c3e47482da9f6d72102b013759ea3516cd43ef62821796bb514178e3b964a390e7f3d4134020daae551fe90b2c61744eea0b12b9f9130e7f4fd428d

Download Submit
/storage/emulated/0/gift/tools.scanner.barcodescan.cc
Filesize
5KB

MD5
5e976972ce82f1e658d82faa53d5b618

SHA1
1b045d168ab809d06c11b0913fb23aacca60f1d6

SHA256
8f83497e9b3872c9878b60e3f6ad6e1eb1a412c5901981e3f714c47bf7278636

SHA512
d6f3e0ef3c6681bff332e6dcffb5caa6c2b737d53dbc81bcdf1f5ba1a85ae7098e8f364531a839aab6036a8418051b11fb16df8cfd2ba41ce8054f5301691cae

Download Submit
/storage/emulated/0/gift/tools.weather.forecast.cc
Filesize
17KB

MD5
124277cc81b5e530a94337823341b4f0

SHA1
1d798fb5da3a5519fb7c16d77e4dd02891c8d3d7

SHA256
6012af15b7267a8d6a043eeadb62736c7527405e9369cd77054a8114b097308e

SHA512
19e98f6da29fdfb96396d2eedf06411ab95accc94f112d010201801c502c1c75cf2d907dcad257c090468cfdf4f6165071e3e4c3fe2fa6544953a03630ff0fd8

Download Submit
/storage/emulated/0/gift/yong.app.notes.cc
Filesize
8KB

MD5
3cfe50823d6c654b15093abfe51650d8

SHA1
8da72ff53d93d94dae662661da31207cb9b41c5c

SHA256
53369701378744d74da2d55676c6156facb58ec7be09e3bb51b2c77483c26518

SHA512
0ee10ab2717b0423acc48c953265339194277d4df795768c14866ed14abf098426c8e73d75ef10cdfa6b3a3cc2997e21e2a0c6b1495dbd2c82dba56c62d43096

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads