Analysis
-
max time kernel
3s -
max time network
130s -
platform
android_x86 -
resource
android-x86-arm-20240514-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system -
submitted
23-05-2024 04:07
Static task
static1
Behavioral task
behavioral1
Sample
69aea2e544b21e5650d6063afbf24d11_JaffaCakes118.apk
Resource
android-x86-arm-20240514-en
General
-
Target
69aea2e544b21e5650d6063afbf24d11_JaffaCakes118.apk
-
Size
2.5MB
-
MD5
69aea2e544b21e5650d6063afbf24d11
-
SHA1
3a7fc7497f0a3551368b46a3a279a4df8db551ec
-
SHA256
44710fe018450f47310c7ab69654201de8a72253ee564ab11f12e733a88bea7f
-
SHA512
610d4c420879dba20d31ae130cf2cbafbdf9cdbeddf1699700a4ec81c67acffcef48231b87b9d982c1d6773465d4bf2b9e8cda80d65a41579ac9137025c1dc6e
-
SSDEEP
49152:HASxVPa2KaGlBJ8ff+/oLoi0vDe3oeYUcunYzoI3cTRexHSahg:HALxl2oi0lX3zjfjq
Malware Config
Signatures
-
Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
Processes:
com.dfoiej8.ccsdyiadescription ioc process Framework service call android.app.IActivityManager.getRunningAppProcesses com.dfoiej8.ccsdyia -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
Processes:
com.dfoiej8.ccsdyiadescription ioc process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.dfoiej8.ccsdyia -
Reads the content of the SMS messages. 1 TTPs 1 IoCs
Processes:
com.dfoiej8.ccsdyiadescription ioc process URI accessed for read content://sms/ com.dfoiej8.ccsdyia -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
com.dfoiej8.ccsdyiadescription ioc process Framework service call android.app.IActivityManager.registerReceiver com.dfoiej8.ccsdyia -
Checks if the internet connection is available 1 TTPs 1 IoCs
Processes:
com.dfoiej8.ccsdyiadescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.dfoiej8.ccsdyia -
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
Processes:
com.dfoiej8.ccsdyiadescription ioc process Framework API call android.hardware.SensorManager.registerListener com.dfoiej8.ccsdyia -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes:
com.dfoiej8.ccsdyiadescription ioc process Framework API call javax.crypto.Cipher.doFinal com.dfoiej8.ccsdyia
Processes
-
com.dfoiej8.ccsdyia1⤵
- Requests cell location
- Checks CPU information
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Reads the content of the SMS messages.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Listens for changes in the sensor environment (might be used to detect emulation)
- Uses Crypto APIs (Might try to encrypt user data)
-
ls /sys/class/thermal2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.dfoiej8.ccsdyia/app_jar/lpdf.jarFilesize
35KB
MD5e1ab911d4b585a26aae02d8540575013
SHA1ac148f7bdf95edddc97d9224ff51a771f1070520
SHA2568a71fab57b4a03f0b37095daa2eaa086ec6ed6c1c6166ca67c0e0a9e14cc85ca
SHA512983ec12cde3cbfaffb414b8c8eb17c793bee558eb51b9d5e630f9bd5f312e0ce55622719aad6097a799286c25001212b26d7053e7e110a4918beace33d3bcbc4