Analysis
-
max time kernel
166s -
max time network
130s -
platform
android_x86 -
resource
android-x86-arm-20240514-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system -
submitted
23-05-2024 22:22
Static task
static1
Behavioral task
behavioral1
Sample
6c7293016701f9a5b735efa450ab51e6_JaffaCakes118.apk
Resource
android-x86-arm-20240514-en
General
-
Target
6c7293016701f9a5b735efa450ab51e6_JaffaCakes118.apk
-
Size
7.2MB
-
MD5
6c7293016701f9a5b735efa450ab51e6
-
SHA1
461c4518931e7c0e9ce840061c7fe417f16a92dc
-
SHA256
5420ce1f1221bca67dfb6ca316f14f57ebb5e7b3d0ea58bd96a37075fe33ed7f
-
SHA512
98aa32b4ff8dfaf617f3d005b28aa404078a03ec3e02fe3f683787792cbdaefba904ef93cb66ecc5259934dab84cc6036e5853d517aa2e33c945a8169baf306e
-
SSDEEP
196608:4ET6bFC5Oc096mhmb/YfxNyjN/O7EfraaP0aMYNDZlZrNkF1adCcn:1TEQ529jKok/AEfrUa3lTkraocn
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 2 IoCs
Processes:
com.battery.power.batterysaverioc process /system/bin/su com.battery.power.batterysaver /system/xbin/su com.battery.power.batterysaver -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
Processes:
com.battery.power.batterysaverdescription ioc process File opened for read /proc/cpuinfo com.battery.power.batterysaver -
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
Processes:
com.battery.power.batterysaverdescription ioc process File opened for read /proc/meminfo com.battery.power.batterysaver -
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
Processes:
com.battery.power.batterysaverdescription ioc process Framework service call android.app.IActivityManager.getRunningAppProcesses com.battery.power.batterysaver -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
com.battery.power.batterysaverdescription ioc process Framework service call android.app.IActivityManager.registerReceiver com.battery.power.batterysaver -
Acquires the wake lock 1 IoCs
Processes:
com.battery.power.batterysaverdescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock com.battery.power.batterysaver -
Checks if the internet connection is available 1 TTPs 1 IoCs
Processes:
com.battery.power.batterysaverdescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.battery.power.batterysaver -
Reads information about phone network operator. 1 TTPs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes:
com.battery.power.batterysaverdescription ioc process Framework API call javax.crypto.Cipher.doFinal com.battery.power.batterysaver
Processes
-
com.battery.power.batterysaver1⤵
- Checks if the Android device is rooted.
- Checks CPU information
- Checks memory information
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4306 -
mount2⤵PID:4771
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36B
MD537e8e716e0e2f4a0b05cd9571d95b84d
SHA1f8d068f6931707bddb8cd69f706f2224ad1fea3c
SHA2567080cb592d5149c858b206d3fd0d5e3e7d601f120af00b2616bee928ee1291ca
SHA512e62b850901835fdb73fa6224618422f721dd765861d42f6bc2dd013413e96bd910ac5313afd9b4f63da74beb12a15fac81b5157456c9caa3031862dab84423f6
-
Filesize
9KB
MD54a2706cced97b074002a17873314c498
SHA101e5a415ae6ad1143b8b35f442b26a05758816a1
SHA256ecfa35d4a6244a985f3b0d2732e5f330029bb7a0f6d22f5c0e52d0992930944b
SHA5123d4a05f936af886940241cf5a6eb5954930937582a0c7b2613f01d209bb36ac8efe658fc0f967d21fa194a9c5b12674d23d696f81de87e1a786076eecfd02618
-
Filesize
627KB
MD54d2b26a8365928bf65b0198624ab6a3a
SHA1638e862cf0bc06e6bb0d3e6aeb24f1f313b129c9
SHA2564aaf0bc98f9709abaaca9f328cc03c79ef3030580a0d29d9b52985253a0039e7
SHA512c3d81b2645592343cc852dd5f297f40e07e1290d926affaaf4436e2d216e5ecc1104e632a57f820e41a4e4919b6d28db05de5217cab4d62c9431ea411d483fe8
-
Filesize
3KB
MD5fab85a8bca2e2d1ef88c5733be3ec16f
SHA18d29fd5d7f1a2bdb96c23943f771447c571dfaee
SHA25647b6ee9c3a4d16c6ce13c496ca3d304c054b8e90450c6a9d8127f1292beab454
SHA512c1b1206a9a57d70448642493d371d65242e55d4c83f39581e6f2b52f30a79fc6c25b166c65fd38900f93b4def497ca77be98864a07543dac7fd0c5050b505fb6
-
Filesize
15KB
MD5a6e4d720f4c10188a3d91af3cc942628
SHA1d9345e3fbb1c386c630c3a69b707b278de28ef06
SHA2567bc5cea36c267cb79602e23f5a0ec10ee9ef48f13ab438cd4f4be48483c4f80b
SHA5126103c4cb9393a7238300b8320631870e3bb18fae00aeed2bfde1f2f15101b30e57ba05af5cd1ce14baabbf7acadeeeeeedf2b6214919c0845adf026fc546c0ae
-
Filesize
629KB
MD51cb7fe06b45156d678bd1907bf63cc61
SHA1d86853a80e2d763cd3a74257727a6f2683fc3a1f
SHA256d7aefa3bc7513e88a70c48366ba76950e372457f4fd086a203d1ae320cdd3144
SHA51230234b4b9d553e4287f5743dc264a296d223634922b5bcc65ba64328065142101d04156b8c28e59582e1874638e3522835f587d367131e17bc7fc4c2d2f322b5
-
Filesize
15KB
MD569c19d97ce2e26b9d720734e0909dbab
SHA14660c469e35edbb9f6b70e198f8cdbcf0a6e172c
SHA2562e808e993c91529267a273c932f810d40dbe3a8e6cdecc589234779e71edad89
SHA51279ddf18574207840d334d83a58f07ccde97c9acd70392bdbf556f6c006246a0bba9657e8a361021b1e9e0d73e410f734d6d48bd5a22f19879df7b2c094d7b4a6
-
Filesize
71KB
MD540a01b7baa4c469a495e2ee734aaa1d2
SHA1ea02a1b87950360bbcc937ec1b3849753ae6b386
SHA256731a32a22c7a8c28b3cda474195b52ecd7e1230e5332ad1bdd760f5379d05035
SHA512ea456df5dd68756a141c5d9fefb4fe60f8135c9e9cadb61eb7428ab00fc0a793fa8c88f2003f45ad92d6b32b596742df0ffd3d22c553d39336649b9f9010bb36
-
Filesize
41KB
MD55f48b596eb821c7d4ff5e5869f736ed3
SHA1d84a3e080273b896fdabf07125f1012c12d4cb94
SHA256e601fcf86cee91503eb883f2870fb2db216108c5e72fffb1bec46f0e8eb1805f
SHA51225a4cd454f8e05908df2d31b759fc92c0d7aedcc6513d92c64c143bd9a890d6091ff3ad1cc0a45d9e1e30ed12bd8f53442fe0b448ce4d9313f9f84be4db35fc6
-
Filesize
20KB
MD5db0784c3e5721def9ebd949f2559c1de
SHA103ee3e3ab249516cdc1cee85de8baf3b49440ec2
SHA25628c086cbc49a5fea02bef57b38e06b75b61b265765e66b449cc621228ed25c96
SHA5127dbef58a9aa20cba5b0d56d9932040eeddd901afaac77f28e85c6711ddb6e9db1a2488daea7595611e089af5218f08d7411c6cf3801fb28df649f2affaa1e9f6
-
Filesize
512B
MD5a75888daa027cba1a528644b063ec245
SHA11efc45aad6a5fb3982e20de486661c2f48b1aaba
SHA25605e08cb8fc996a52a446bd02fc1833b8e8690cb4313658b9226f04a727390c1e
SHA512b096d8dd322f0010013ac5e3bcd8bb310c5b87386c348a20d7ca99925fb2f8511dd9015e6e9d86a54b03c33926f228c4c3aa333fa27256d64dbf79dd54515979
-
Filesize
32KB
MD5002d0bfa75a4472ee61057f990f98a43
SHA16df65efb88f012bddce8be51bf5f98e138a2aaa4
SHA2564596e0ac60ec98a4acac34e78bb761b25e0eb8058967edb5caf953f46ce40063
SHA512fcb25b95239f4264d58508fbefd9910b984a66bbe7906eba00ff6b0a6c96d79d55a36a05a38e1dd5acc62fe123480de00b38376914a136886a15baeba643e1cb
-
Filesize
52KB
MD5a18e97a95b8bddcaad942c8e19678d54
SHA101edd8f8e10b2d3b6a16c2f42e319fb6d1b9eaa7
SHA256e7b7fdcd58ea1e66e5b0023a0129679b56d99f24d64dd6f5247022c4d04bcb7b
SHA51213e3ca58610cf38e3277a5538810187f5d3ed3e546eb54d0b8ab72038c0eb6f1d48629735bb0d778fc26f47940c30ed7f65e4dbfbd18000b81d5d3d984ecfe21
-
Filesize
2.0MB
MD5bde1d82866e8bdddedcea6dede87a3be
SHA1a978e368e467f92a0cf29d6d6579fe4b3fb48f55
SHA2562809b039bdd568056c25c64df379d6a7932dd323e4c234e677b31a9cf2fce156
SHA512d8ff1b9f3316ccfb55adfbd953b4acf39f44d506278c185e7988dc34ea18ce86b008cb571312cdb7594c583443e3e8a80d26542dc085d8c94116d6382e9efc43
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
/data/data/com.battery.power.batterysaver/databases/db_75cd7e846a42d722b248d50f86f37987hk_ad.db-journal
Filesize512B
MD53d2433234568f5ad9849248823344814
SHA1ac72684e39aa12257bf6fd2d21847d3047c2566d
SHA2561c452a458fecfc3a61378ab3995b73e5c1358116fa66a1a17bdc0e64f2b5e57e
SHA512acf082dd4fffb041a782a293f0a57cd5f73c877f480d57e616bd571dd5fa22df0824eb095ea783aa8ceaf5a605c7de8fa703e7e6a057b71516ddc9319a964e6f
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
52KB
MD55e44f3f190f53d594117d838356e2cfd
SHA1a3587d256b340de7e1a598c1a3ed81d619e4e100
SHA256dacc3ac6c699283f54775b2203994c273b551ef67f0eee87045009852490d067
SHA51246af120672b03ea4769593a2af513fa35df4fc112e45f3243a94d603b569acd2f849bea7d92332f6e3711325731fb8b82c80708cbe707fadea163874c2c7c4bd
-
Filesize
16KB
MD58bb6297bf807d8a396eb63430d2164d9
SHA19c989bbd41151a41ec2bfcc3821dea356a6fdd9f
SHA256499bfd522238d301f9843e1e6feca987b5abeb4cc062b4813ff7118dbc2132dd
SHA5123825a06c76a91bd378c34e8bce76dff9105a5fecd97eeb4abd4ea1d991d2f551b3c65ada21ce813ec075798ca2b26e3da157b9b23cc47f8fe0ddf9a270b5ff39
-
Filesize
16KB
MD5c56a43118a35531fd0832429275d63d2
SHA116cac1fc65245bd3663384a4c8feeb804be8c1c4
SHA25624b1d4b3d42d0b37ef94abaa072af30ba6d44b5760d6808b16ff0ec0a14d5c4b
SHA5129d4371d35b9d556178eb1c84f8fd9d8ed8a97c5c745c93dbda7b21e6bbef0cac5051e49ef9e8e5da509aff49fc661c9604a2552d518325245d8bb481c3470c8a
-
Filesize
16KB
MD5b21f6b02addf023ff7bae0ccc10a1645
SHA1c9f2fae18ad3c3457ae108056cd74836798b4e59
SHA2560cd2648f1960fa41eb1c4bc4f4a9f19d7b9183a9e41bba97830f38f40bd0dbe9
SHA512b14eef6cd7eb6781fb2161ee3eb16b5513ba5138d8292ed3f696c99eade6098331c23616e919201098efcdee15196a00dcc049677b50e72c8f31f9c4df751211
-
Filesize
16KB
MD56af3d96236d204f7574457e5159dfc5c
SHA1f40dd8e845f4f53635fca8e35f9e3bb05b80b5e5
SHA2561200efe5d72fd8c31f3690718dc964e6051cf6dbc316107fe7cd5e4560829c24
SHA512c371a4996968e43f5e1d1dda019cfad1a24e4240ad990cd6812b6d8f61c88b46d1999220a364d9f03d33153ef5e399ed0628aafaf13fbf33902e0466ffca6aa5
-
Filesize
16KB
MD56490d61ad87a2efa6f2f001158200db8
SHA1abc1bb70b659d06ee01bbe11caa8e5072f8650db
SHA256805bfc768ca316cdf04b180ed566281491a354070dd2110eeed51d1459aad88f
SHA512865aa1173b2cffcbcaaa9400cc2dcfc3fdfa2a5511be10e60a991ff86fa35cce2abd0b25ec96f08d14ff1a960f18cb513f51b5ed23ce0cfa5530dce26c041020
-
Filesize
16KB
MD57b645ce7857f19e4a9162c75ca0d46e6
SHA1c4d3feec8b935294255942de27b37b0882ae47fb
SHA25679f824348cb48dae6afdb2c8743e48801b52c665aba6877f0a8db4dc4cf8f6dc
SHA51235cf1910555c4a1db46d8dbec909078dcc141ba7546d84bd958a09d4730a9499f93ffd9edce50784181ad3b26b84886ab26fd41487289f9850b1ab24fb3a012a
-
Filesize
512B
MD53626c58b6141b76b05f8e340e931d56e
SHA18df019abfd280456e305e2e533a10add781458f9
SHA256113604e936a60de85c30a947b204a7bc6f19acc8132f7cea0ddffc9c6c1871fd
SHA512a76e0253282ad6bfb2341ee4ca85a66507c5da46f9270f2e7e61dcb2a42509824a86600dafda5e5804dbf7bfc2316379c3ef0b1459b380526e8f5337a296788b
-
Filesize
36KB
MD54c00782efb58fa992862bbdc66542638
SHA14977c0adc28b8fcf17c2d12a4fb4ea08c32b3ec3
SHA25615d37a5f2f35e6d945d7865a56bd6dcbf1169d08f0e301f966d63e5d168e8ca7
SHA5129af6e96a94e3d214556b755466267c2f1aca81fd444cba2d90a133b866ab9122369760496b11eab90e35b1387d5baccae9f47ad9d5f6e973321a3eb1a47a35aa
-
Filesize
4KB
MD5e7751df26cbc7572c63ea23bf19f99ed
SHA167ab63505cc24e697a981a04adf4e052cde210b3
SHA2560161311945c0b9572ec2a2f9c11b575f9ef9461dd65a861904f52a82f5c698bd
SHA512940a5688aef5a0cbc812f75c32a377f43d21df44df45af372c1b5a426019e0f9681850961dafd00d3608d268d954bc932f9a4fd50dbb4ac4aaec66b449a2f4df
-
Filesize
4KB
MD5022f0086243bf8fdae214dd4daef7259
SHA12a68599ee33b92425f012251220e2f4a51ee778f
SHA2560cd967c82238cdcaa05e265ba811e58702c456f4eb0aabc05234845d91bb5c02
SHA512d2694dc891b774a2c97eba97d89e8047f3483c9618279253615a023cc006c0204779d2f88072d6298dcbe7211cdec1ab51e731a8b4d020390b65d594ba15fbb2
-
Filesize
4KB
MD59a90652b75180fcae062eea0bd58e1c1
SHA1a793814e1eaee927092d208426781e88e22e7a6b
SHA256ffe050b6b0d14db82cf2db900c9000588b50deab8f0b2e9de8363f87b1b98d8f
SHA512548a53927e7208a4cc4011795ffc46018d388e66c008d49fda47b844df76296230e4a16f3f0d277a9e61fa00f0c111907c509e6ce31c1f998661aec4346046be
-
Filesize
4KB
MD5cfbea55f9f3928d5ddc2a11056119247
SHA181e157d6cc9a9e5da4e96a388716da394f317fb7
SHA25678aba8e867e561ed29593153447cb328fa6bae307c3eeb7d9f9df808cb8e23fd
SHA512db79f02f78409f98a8c597d0eb2abcc08b9ac40f98d6cf439e6ed0dbdb2f677e45743cebd6251977f55fc26911a5ea745badc07990220e600536276b77ab5300
-
Filesize
4KB
MD57834997a6b6923a025ff4bb458c86f3f
SHA156647e4114155fb0f095e78df0fb0c858c99e2f0
SHA25600a23b008e9d617584dd760781eb1b4fbb6d4f0a2391906e973a7e350d7157ae
SHA512bc306aebf204b26bc7344b55be65fd39793592fea8b7f1d407e809f558aa56faa66a6eff5bb5ab89c45629a5565b46fe5eb25dc9b9a67a055f394b64f65bbe4a
-
Filesize
12KB
MD5f712c23528c3d2b73e680676671242b4
SHA15410044628aaefb886d528d4ffbf6273e624fdf9
SHA25688c689c2a1947dcdfcdd64bc14e1a2eb9c71e5909a9fd4e9935e6b9d4e6f7299
SHA51206a30466241b5c57b9186d65544ccebaea3612d666a6430a7f2472924aa8a4288d61b25dfa058f3ff11544a301c73c04de5babcd4cb6c1f1f7436187290070c0
-
Filesize
48KB
MD57cd249863aae1b7f25aa93307dfe0af5
SHA158bed1247527f680d6b842e79e662ad95126a5f3
SHA256ac636fabc3c75591428d368a370b7a48d9b79d0ea7c139a220dd5724cdf6cce4
SHA512cb5f1ef494145c13299f0afa1d1f667e0d5e02bf7c17635697d04173896275a386699b9fc8b24ed0c27f9d1d99faf98d309b16dcf7a57c72297b14e5a238efee
-
Filesize
40KB
MD588951eeb34591f2b55ca824a55775952
SHA1cbd0581fe6eb6ae1ba48c7b379b5ebc3227e2ff9
SHA256ee5a9fbf8da67311a78752a1425e3005ec47319db325744890575f146c8281c1
SHA51270764965bc8a959fbb17559a93ae97adf743c92f07e1522d63fc43a12630a5a3da814aba3eeeca9808a5f5d5d13254993567b02f7adf60657b69af1e2e540aab
-
Filesize
167KB
MD5b646cc383b7ed3b15a97c2a5b7980b3e
SHA1b6895a71b207bb019877176883681016c7bd7ea1
SHA2567f44438f5552581352bc4c3bf0abe5786e18f67df59c4696b7ee8a5a01690c1a
SHA512d37d4682906fd6e86acd78f1d12451b378bab11b632a4480b02822aca3d14199759ac9953dcba58a40e73f523902c73de53c27f8d8c115bd490736ceb203eb7a
-
Filesize
1.5MB
MD5d149f6da614476a6404b3169b7f2276d
SHA109dfc4d5bb40e422c1d665c9b36e0e5efce52c57
SHA256986e8e5563c95ca392b5bf693cbda2f1cca657ac655bfcb2bbb684a9c6d6c16f
SHA5120e3e6164af343f3b4c94d8e5b48bf5f152138b085462d10264d85ba718be23f67ff3091b0376373c7b74b97c07595562be8d13c919d316fa731c82636e52ba94
-
Filesize
403B
MD53423a06f7f70ffe7de6dacb1abacf137
SHA15dc396b2d509da284f42b16dbeccadd2db20b597
SHA256a0cbb1903c1bc9d3247472765db23b6ec1be6aa658444fe9568d7eba10ec1f8d
SHA512b957c7a09712b3785f589bfba2cc05c1308466bd337d008e2ae2ce2a3a65ccbd6122247aaf69183908dd70c568f4f2aee4fb1f837faa742213b6713ae827cc73
-
Filesize
32B
MD5437d313f2e88acd642aabcb82b75eebe
SHA111ac5c52c2c9f0753f5157e055f691b7dd4cb0fe
SHA256c24901429bff92f6c4ceb38e3ee75adc872e63d5806fad8364fbea4dce3931e4
SHA512c9e72ed006112c046241ceadbab68444b2c25d44956de81d7bef53a6da627c70023f454a41abfb812197a8ea0c173c89c7ff5244717c6ede1371b6b8e784009c