Analysis
-
max time kernel
164s -
max time network
130s -
platform
android_x86 -
resource
android-x86-arm-20240514-en -
resource tags
-
submitted
22-05-2024 15:04
General
-
Target
67ab44fb67f45fd713052be204fd9d98_JaffaCakes118.apk
-
Size
10.3MB
-
MD5
67ab44fb67f45fd713052be204fd9d98
-
SHA1
b51d535ace0c847673fe7a64a00a5d415b94341e
-
SHA256
06d8866ee62a1225aa0296d9d05062c255d5e06f767670f2109cbdf7de1ae807
-
SHA512
4687967091f72d0520428c02f9558d2b441a31534ef694afa84273ec949d575a933bbbd8821bed0a16d60a3120c751b422dea48bf16a2f684a264a4be8f78330
-
SSDEEP
196608:rS+hsu3loQ8hFSGEFTqrS0dtIycKVT92fpfjrpUKVrJoSBADtYFeZfawcCzyP:HoQgdEwu26HVF6Jk6awcnP
Malware Config
Signatures
-
Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
-
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks if the internet connection is available 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.tixa.industry.search2c9480b752e9680301531134431114e11⤵
- Requests cell location
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Queries information about the current Wi-Fi connection
- Queries information about the current nearby Wi-Fi networks
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tixa.industry.search2c9480b752e9680301531134431114e1/files/__pasys_remote_banner.jar --output-vdex-fd=51 --oat-fd=52 --oat-location=/data/user/0/com.tixa.industry.search2c9480b752e9680301531134431114e1/files/oat/x86/__pasys_remote_banner.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.tixa.industry.search2c9480b752e9680301531134431114e1/databases/IndustrySearch.dbFilesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
/data/data/com.tixa.industry.search2c9480b752e9680301531134431114e1/databases/IndustrySearch.db-journalFilesize
512B
MD502020d35427695b2c933f598082bd541
SHA18b2028f21d7173638e37ba23dfcb8f0843195ea7
SHA25636c9ec8c5708a0bed631757316a03d332306329360ddee6f12dc7c157518e4e8
SHA5129d81e6193b7c756c02bc403d575a1042381dc08ce705f8ea9cbd77496a16f37c2f89f55d66cffa1343356ec61dd879c64193d92914573afd3d61c6b453692ac3
-
/data/data/com.tixa.industry.search2c9480b752e9680301531134431114e1/databases/IndustrySearch.db-shmFilesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
/data/data/com.tixa.industry.search2c9480b752e9680301531134431114e1/databases/IndustrySearch.db-walFilesize
48KB
MD53b4d999505b6717e70c58aa393838990
SHA10ded37afac0649c462f5dc0ab39faa819ca01968
SHA25688eadbcce699052b344c10a33199b3741ae80b282dd811a1b4870c66fd12cfe5
SHA512dddcda4c59459164b93904244eb9f9fc1a1acb7f5f98ea0e410f60388707e86e1c8f40dba32a680718458758166e024f47e48442385cc571a7e910b2a0a2fc80
-
/data/data/com.tixa.industry.search2c9480b752e9680301531134431114e1/files/__pasys_remote_banner.tmp.jarFilesize
295KB
MD5289aa52188b4a1eb9a3a5904b0638ada
SHA13efe010f8832bc5ee7df88152e01ef1f446663c4
SHA256947be2e29c43127ccaa6ab05b2600405cebd5aef985204a4cf2e17ecf7cfaa91
SHA51234078ccf3fc42c63f338bb9f62eb139d953ad9e0e5fd813465d9f4d37f708fc20d7309897919cdf6be37acbda2669fd6d32ff4a233279e2cd6e2a0ba62cdc47d
-
/data/data/com.tixa.industry.search2c9480b752e9680301531134431114e1/files/oat/__pasys_remote_banner.jar.cur.profFilesize
156B
MD563852d3031ca8ec7284bd400c36877e0
SHA1099de54af2a84601d7c2dd203311ac2b7b947913
SHA256ab5a6e7385a6787fba9c0d795435b2131d02ba683f65e4b3eefd61427d3b4a84
SHA512d24567ae0913dcd605fdb295e39044856d266bf7a19c41420e110f1c7eb587bf6606d06e27394f1240aa8a388bdef99124a57d18c300792c912e2b95480ca582
-
/data/user/0/com.tixa.industry.search2c9480b752e9680301531134431114e1/files/__pasys_remote_banner.jarFilesize
417KB
MD5981c6cf9b7df281081e05c808cf0afd5
SHA148aabea85a9693f461f87e1bdb9f8e76a8b45c1b
SHA256639cf990e6246c0418adf545481ca1549a3ac1b443bb3ad3f5a3552400e41f0e
SHA512b6e668c33021b64adaa304a4e085a2c5c88c16c99e811a4c768534fd67cd6cc380e125e960de511c3abc33c7b842be1441a7dd48aff83c2928d62ebaf65f6adc
-
/data/user/0/com.tixa.industry.search2c9480b752e9680301531134431114e1/files/__pasys_remote_banner.jarFilesize
417KB
MD596d208e818748da0a0510994de5be961
SHA18f093544c3ce04ef1dc323730d2937f889c911c6
SHA2569fab83f42fe2573d80524e4b91caffaee37f2ca37f56f6a97a2c626fb7927215
SHA51255a2b0c3a86ed751f31f96774aadebcf9068a4c3b828f0e1f4e30f0a5acd7a66ef14df7361ad2d9cccfe8f560db8e8cb2c67d9a459a75d24fbf762528f32bbf8