138dcf4778dc8e84e4b321f591ab8d84af770755d25796fc9ae0ed9b758e9177

Analysis

max time kernel
77s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240514-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
submitted
23/05/2024, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6b7c411cb8200e7f81c964d1fe867662_JaffaCakes118.apk
Size 1.6MB
Sample240523-thvqqsge3w
SHA256 138dcf4778dc8e84e4b321f591ab8d84af770755d25796fc9ae0ed9b758e9177
MD5 6b7c411cb8200e7f81c964d1fe867662
SHA1 f1ed88abed39477434531bcfb9d1c6495b65aacc
SHA512 f30ee97f69f4afa44cca30076b9f03344438847cfff698d125919c8f5aadf616613d6a8d6c0b1b835958a41f4053a22ea92b6e92b9d3a2b722597e819bf56efc
SSDEEP 49152:Gn5NNNNNN7DJgfLXgzn8JeEJwmq+aoI/vc2R+Bukgv02:YNNNNNN7lgfsb8JermU4Bum2
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection credential_access discovery evasion impact

Malware Config

Signatures

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	zsd.dse.lkd

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	zsd.dse.lkd

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	zsd.dse.lkd

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	zsd.dse.lkd

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	zsd.dse.lkd

zsd.dse.lkd
1⤵
- Requests cell location
- Checks memory information
- Obtains sensitive information copied to the device clipboard
- Queries information about the current Wi-Fi connection
- Checks if the internet connection is available
PID:4642

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Location Tracking

T1430

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

wrrwwsrs.data

Path /data/user/0/zsd.dse.lkd/databases/wrrwwsrs.data
Size 40KB
SHA256 8196cefc9e88a49d1159e7d54f31c1b510a7ccfb0bb2507b2c08186915f8a618
MD5 1219c1c09754c87b7e7bb8b4b1dd7dba
SHA1 54feb7ee28ba06a46cca25209acc36eff00e5bd1
SHA512 a4dae002751ec7b93834c8d4b2cb3cb559d65e4c96bdf3461b35adfe06c23096b3889f52ffa31e7df0baafd1cdea5b16c8ab6007114faf9fe6b1ac4962dc1380
SSDEEP 48:T3s9qP7WaKIU0P7SSCTYXjid6KkJWT5Cx+KxBZzavudvDv2iyWT5Cx+fS1+C:KaDSLhkqA1nAXQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

wrrwwsrs.data-journal

Path /data/user/0/zsd.dse.lkd/databases/wrrwwsrs.data-journal
Size 512B
SHA256 2af8c232ee5c086bc5cd31f2eddf7ccf24d5c9c7a3b3cf2f277c69b102723aef
MD5 f0c85a8880fa395e56bfeaa38b4690b9
SHA1 35d2e226da676c664207fa3ec8cef968de3c3159
SHA512 776910fce8230ab60dc40fb685409f7357549d9f1225836638e82f88c8e4ccb5ed607446d064c22a80499aa98b890d180a9476f576a7676142e55b667e441b33
MD5 SHA1 SHA512

Submit Download

wrrwwsrs.data-journal

Path /data/user/0/zsd.dse.lkd/databases/wrrwwsrs.data-journal
Size 8KB
SHA256 a7c51169327c244207ec480b4598f388cd81a3453412149eb328ac845245cb3e
MD5 7bf73b3b35bf4c3fdfdc18916942d0e5
SHA1 ff446804ee8fca34008b0ef1aafec21873de3b9a
SHA512 661da61091147a109224d24846216183c8ef3011c2d5981637510163196c913af0648ba3803640f227452e2fae0b8c7c88e8aeb0d5114a0f9597a7ee8ab97fd8
SSDEEP 6:7+/l98oqFn1Vg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK2vd:7+tnqhqLiuWdYRmBEyPbHF
MD5 SHA1 SHA512 SSDEEP

Submit Download

wrrwwsrs.data-journal

Path /data/user/0/zsd.dse.lkd/databases/wrrwwsrs.data-journal
Size 8KB
SHA256 7b07d8ad0cca788e81f101f6ca19d4c934a46569caa2decace3f8db96d5b63ce
MD5 084fed4778f5e80b3ceaadfd05065459
SHA1 f1bedef79f6ec9618d9be899e41dad72d3f0f4d0
SHA512 61107edbb0e7b0303a5c906615c25f3f090ffef86cafbf1466a092817994890add1860a6a4c0014f04196e55439beba65a60bb5df38063c046d8bdde24e43ef2
SSDEEP 6:7+/l9PMGPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKHlC/s:7+ttM6qLJdeWRmBEyPbjs
MD5 SHA1 SHA512 SSDEEP

Submit Download

wrrwwsrs.data-journal

Path /data/user/0/zsd.dse.lkd/databases/wrrwwsrs.data-journal
Size 8KB
SHA256 bf82b3e7cd10b51866cd8615087fccbc64ed1f8465a150f59121245a866c248c
MD5 c090834f25008e71d557d42c8ef74f95
SHA1 bd49495c9912d18bba93d58b0424b32bdad67eb3
SHA512 0f8c38662bd58e34a6a2bd43cbefa858f922795e348d461789c0a07e945de10885da109506315d91d4ef0e2a305d415fff42177c0b032f0c9e51926c70628279
SSDEEP 48:7Msvq89qP7WaKIU0P7SSCTYXjid6KkJWT5Cx+KxBZzavudvDv2iyWT5Cx+fS0:7tvdaDSLhkqA1nAX0
MD5 SHA1 SHA512 SSDEEP

Submit Download

wrrwwsrs.data-journal

Path /data/user/0/zsd.dse.lkd/databases/wrrwwsrs.data-journal
Size 8KB
SHA256 5edb3363f478f55294154276c6c4f1b30b176b2d7ce88db2fcdfe766fc782593
MD5 94d0d8523c055a47e5c5812cc8a2e15f
SHA1 ed633d178d217974857184124ac6ea65848670fa
SHA512 5ea438617968e6a8378a1c7080c8d6b625fb173fa3d54560de58f81afc22ad1f65786f01d61dfe8b40656bd9330ab13f9359823acf55e4ac498d5fcec306e3aa
SSDEEP 48:7Mx2NJqs9qP7WaKIU0P7SSCTYXjid6KkJWT5Cx+KxBZzavudvDv2iyWT5Cx+fSK:7cetaDSLhkqA1nAXK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads