Analysis
-
max time kernel
178s -
max time network
129s -
platform
android_x64 -
resource
android-x64-20240514-en -
resource tags
-
submitted
23-05-2024 18:48
General
-
Target
6bec060cc0c3aa7ddd3d4de005dbdabd_JaffaCakes118.apk
-
Size
602KB
-
MD5
6bec060cc0c3aa7ddd3d4de005dbdabd
-
SHA1
a8e7abe5e7aaa8a0b6d52aae5ee6d4c1c9e2380b
-
SHA256
75ef78181b828392c9d8ba2fb128cc71d3a20217f7b35d9b9eae5e25a260b5bb
-
SHA512
45b35235249716bd2d1b1132ebcdd10cf9f0c24d7017bf34c39a8d630d8ce4e2602f19f69d9c7d1d087739819baeab1b0ae6a00ee83f426f88429c23e04e917d
-
SSDEEP
12288:AuEaFZvkGGNUuWW1NVwCKn6GAx1d9H1BxyMGl9fDHxUNYL0NpX79s:PEaFmFN9v46flH7xyVfNGFf9s
Malware Config
Signatures
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
-
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks if the internet connection is available 1 TTPs 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
feifei.tnd9.meta.face1⤵
- Removes its main activity from the application launcher
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/feifei.tnd9.meta.face/app_ttmp/oat/t.jar.cur.profFilesize
595B
MD5cf91483dc3e7b736d5fd4f7c2f994898
SHA1323f1ac27e0f59c14c500c25a0dfae496566fd96
SHA2569e228e9c1a4670802929997bfe5e02dfabf9edcd0943e29b2cc77bc29a71f09d
SHA512c6e96e6ca6bfdd1ae6f1a9074e055f37b20423a24a11e31ef6a9e03131ff8e53ca69aea4d878a440dc23798553b41a3a014ebb576738ac77b3f71698bcfeb931
-
/data/data/feifei.tnd9.meta.face/app_ttmp/t.jarFilesize
276KB
MD59aaea567e0c93e51718ba7eade0e83df
SHA10005116aad1779361b70093db00fed5ac090ae23
SHA256b30a95dff6f65f444472971c8aaf895ffc8e66e0117ce242ec4cb8a8a519a5ec
SHA5122aef1034335d8752f4e25ce6c5823ce03019536cc6e51ee61b5291c77a0f356a2517e0cbe7f2c4cc2d897115dc856449a342cfdc247c9d34d313187d15b2f890
-
/data/data/feifei.tnd9.meta.face/databases/feifei.tnd9.meta.facebFilesize
72KB
MD5a6503794d5ec8dce87702a1943248de3
SHA1c7c474afdeb70368129e6aaa8150324d3a708267
SHA25692e67b100e2903aba4f8f7f972bcedf14bcd3374d06f0fd3b310b72b2ab04765
SHA512d316c074d684b5f16dbb336dcc3d9b2483286d07aed36c318133fb9e29cc14ed24eea72516a5f0a2b49aa2749be61519d99ee214870737b3273dcf2ef842cb97
-
/data/data/feifei.tnd9.meta.face/databases/feifei.tnd9.meta.faceb-journalFilesize
512B
MD5b1508701299fdfff4cab7e88f9345051
SHA1c36a873a4a55a2ff4738c320b740216a2852f162
SHA256a0dd37a0de01f408ddbde8aee35bd1885a3c3cb3103950afe1de63f6e2833f07
SHA512efa1fff338f008039933bd6502d595c13969ac95ed53cf512546df87fe3d44bbcb07607cf3c237187f61db513077cde3e30a16357f79cd209bb66ede8f938a60
-
/data/data/feifei.tnd9.meta.face/databases/feifei.tnd9.meta.faceb-journalFilesize
8KB
MD598db081a41e02bd85fa3990d7c60e42a
SHA191e20cbdcdc5cefb15ff167d309dec7d0a180d83
SHA2563a4755b8f82bbe18282821699595631dec64ac15d6be829d5923d068fd958825
SHA5128eb2ff610092245073eac96b66fea0bee902fb65dc573e7d926397c06c2933579be26a8d23799be4ade862acc7bf44999ee8f09a4b6417c02d93585fa7c92e35
-
/data/data/feifei.tnd9.meta.face/databases/feifei.tnd9.meta.faceb-journalFilesize
8KB
MD5efc2f6ba688c8078f380181f107debb6
SHA1fe8c75c70dd91bec37386210d5c94f006ce59a85
SHA2569a87f5ed2843efb733e5706f2654d46cbc4cd3cdf01716410173b3adca37c541
SHA512028948a4cb99bd5cf676aac3c71e687ca92468c71ffa2355d4700debad690466d6858a8f6ab3839a46cd1b75a7416f17055d7383827df69db2df54d72a466b24
-
/data/data/feifei.tnd9.meta.face/databases/feifei.tnd9.meta.faceb-journalFilesize
12KB
MD5859dcbb1376ef6a089bf4926ebd9a2fa
SHA1514fc85d69dc532c650cb0a55a655a1f37da5bf4
SHA256639022deab17a272b9a50d46993c7d10ce934737d124c16ae009405fb42669e3
SHA512229b90902536de37376efee65e57bbcb163a14710facd863bda7f59df766a8781f8d750e8b1345fb4543a87518d82b1fd83a76ab15937c92c4af3f6a32232c6d
-
/data/user/0/feifei.tnd9.meta.face/app_ttmp/t.jarFilesize
587KB
MD5f72c3d07507c3e26d317e9117ba757d1
SHA1cdede4739e9dd9fd95243aab5e44c24f93f825c3
SHA2561c65834d9ca018c6496a8b9957589d0e94657911b6635dc21a448d78f9238887
SHA5123420714252e7503abc13c99274d767b0bc08671d769460dc61823ab9470e145fb75c5dfaadc617d3a05cf251ed5ecf38ea7e8c1d7b343bca4d7e8296f1b805d4