09d743e7bef76456f6152af820bcb29d020e0ddba28fb2c6c5b324f852997071

Analysis

max time kernel
33s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
23-05-2024 00:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6918491f0bf4bef229b95a0bc247d174_JaffaCakes118.apk
Size

19.4MB
MD5

6918491f0bf4bef229b95a0bc247d174
SHA1

88ad2774853491d9be34c4d2ad1d7af1f1fbd803
SHA256

09d743e7bef76456f6152af820bcb29d020e0ddba28fb2c6c5b324f852997071
SHA512

61ab107881ac4d3662e0c2000463c8ad5393ebd3484938939ac77c7d678c6c4f41dd692c1d53f8004451ecd75e0347dad4085afe9f686b053ac1b0201c236032
SSDEEP

393216:Jw8kny1c/8zvjFkciEmCDTlfDp0l5UMw8clzcSAtKWK1W8gxAY:JkyJzpNkCVp0DdPc6DtKzoht

Score

6^/10

discovery impact

Malware Config

Signatures

Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

com.tastypill.sides.xc

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.tastypill.sides.xc
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

com.tastypill.sides.xc

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.tastypill.sides.xc

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.tastypill.sides.xc

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.tastypill.sides.xc

com.tastypill.sides.xc
1⤵
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4280

chmod 755 /data/user/0/com.tastypill.sides.xc/.jiagu/libjiagu.so
2⤵
PID:4317

chmod 755 /data/user/0/com.tastypill.sides.xc/.jiagu/libjiagu.so
2⤵
PID:4410

/system/bin/dex2oat --instruction-set=x86 --dex-file=/data/data/com.tastypill.sides.xc/.jiagu/classes.dex --dex-file=/data/data/com.tastypill.sides.xc/.jiagu/classes.dex!classes2.dex --dex-file=/data/data/com.tastypill.sides.xc/.jiagu/classes.dex!classes3.dex --oat-file=/data/data/com.tastypill.sides.xc/.jiagu/oat/x86/classes.odex --inline-max-code-units=0 --compiler-filter=speed
2⤵
PID:4432

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.tastypill.sides.xc/.jiagu/classes.dex
Filesize
4.6MB

MD5
8959ef2eca7c6e95f805beec889dae22

SHA1
e7a1b1733be325ea0ca6e9009d72aa0a62f9364e

SHA256
2df48e9b396b671890a0f3fe0e9b196358ab60b446fec2d470a472bfee7d0d48

SHA512
cf9ed36f958a7a0468a9c7e71b23ef257b49878ec87c53179d567b445526b077dd6ef8f483d741f84de84ac39243375b96bbd918369f65a803832e5c3f1a720b

Download Submit
/data/data/com.tastypill.sides.xc/.jiagu/libjiagu.so
Filesize
363KB

MD5
6c9d83b90aa9c9f904d22eb9b16f8f95

SHA1
4d5e0ce3c55a22475b58a982d67ab9aa84384c40

SHA256
2432ac0b864b33cd599129578c42c43811461dbcb83e2a21301ccb8d0810c5e7

SHA512
07d16f67cefc986c0d6974e3bbc38d95b5b184520ec8f3c9ae59a2f0e76213d359b35dc507d482322d2c045ee75183def8e3d7659ff5fa78f6afff931084e90b

Download Submit