aacba5c2a20283f6df110461e74924e933ac7f820517eceacef3fe0909e5df85

General

Target

6fed7322950c0152f2527e2a80fdbd75_JaffaCakes118.apk
Size

4.1MB
MD5

6fed7322950c0152f2527e2a80fdbd75
SHA1

6c9d69e75c4a41a9897301297916956f70f5cea1
SHA256

aacba5c2a20283f6df110461e74924e933ac7f820517eceacef3fe0909e5df85
SHA512

8f9036e85443845b526ceaf6f901bc4b1f08f4ef1bdfb3579804ee45a734ffa75dcfe02dbf37c2494c7a9ee15e149700b66c32db58b1e9b644336abb01bec933
SSDEEP

98304:VZur+4alJ23BJagC1jI/uU7UjTXttW16T5LypjIQUY03VyOLGGxYTYSx8s:XeWs3jiJImU7GT94A5upEQP0FNufx8s

Score

7^/10

discovery evasion impact persistence

Malware Config

Signatures

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.dscs.my

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.dscs.my

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.dscs.my

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.dscs.my

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.dscs.my

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.dscs.my

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.dscs.my

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.dscs.my

com.dscs.my
1⤵
- Checks CPU information
- Checks memory information
- Makes use of the framework's foreground persistence service
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4206

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Foreground Persistence

1

T1541

Privilege Escalation

Defense Evasion

Foreground Persistence

1

T1541

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Discovery

System Information Discovery

2

T1426

System Network Configuration Discovery

2

T1422

System Network Connections Discovery

2

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.dscs.my/app_crashrecord/1004

Filesize
220B

MD5
f81a9da793d9a934543b785eec5278e9

SHA1
2884d799b834648133f9ed3362ae5b0b34f6490d

SHA256
d7d266b82867ac72979cc640be52fb066355911703ca270defa8a3c8c44d5755

SHA512
7d9e8a8de82a2d4c1237f7a377d6378b555201eda931ef5fa50883ec36ba5ceeedc9637953781fb6877c492029b285c6d5af04f9df4edac116016208d4c3e5c6

Download Submit
/data/data/com.dscs.my/app_crashrecord/1004

Filesize
58B

MD5
0d210bfb2a0e1f1b4c082a6a0f79de07

SHA1
bb8ed9e364db79d1d9f2fcde3f15091893222faa

SHA256
988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d

SHA512
536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1

Download Submit
/data/data/com.dscs.my/databases/bugly_db_

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.dscs.my/databases/bugly_db_-journal

Filesize
512B

MD5
dd49507ab3d8a561b55dc1d23460ce93

SHA1
09763c2ded81aa9582e702e0bea908dd8a46a9b6

SHA256
4034e9e8b5258589b237a80ad489bb9c10352ebf9734e44d07b23aded2ea2956

SHA512
172692fa20724c73ce41abbb7e7e1c101c13a415b86aca743f6b83defe3981a1c2310de29a360ffd8683e2b1e7d6b107098c9cc948574df543fdb4cc22294048

Download Submit
/data/data/com.dscs.my/databases/bugly_db_-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.dscs.my/databases/bugly_db_-wal

Filesize
72KB

MD5
b5fb0b41f471c2e28f6029ec2a3fcea7

SHA1
b507ce217ef27d34eb53bda6ff9b755f581ec1ad

SHA256
c07505cfae6951f9d5a73e1db9ff3bb2a1bef16ac816b604cfb966c6a472b45f

SHA512
f65b315460adc5a9f064814800226639ce8491f724537c4531617723de596065c082f75a63bd265f68ef9d3a932fd60ff18dafc4a17180b5408f3d436f8c0b6f

Download Submit
/storage/emulated/0/UcQkDir/qk.dvid.txt

Filesize
65B

MD5
d9db65e6fdf2e39765a9a0f773968d30

SHA1
013eb561975e76b3aa9ee9311d116b6118ead5b9

SHA256
7521472ec066b1bfd174af60fa56842099f1a19b65a115e51f61122a6ccc201d

SHA512
56764600e56453379de5cf402042c6e4df0057f503fb06f449645202f76c29b56dd6060f76ba9b53f6fd23ba6734a0005ef0cc6d8b000604d8a7fa56f5d637b4

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads