27e8729640ff2d9434bb16d6646c3811bcde55d084e7d438b65f358e0fdc70df

Analysis

max time kernel
7s
max time network
130s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
24/05/2024, 00:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6cc55c1a2d9539f4c6f617332997c060_JaffaCakes118.apk
Size

4.7MB
MD5

6cc55c1a2d9539f4c6f617332997c060
SHA1

b1632d4f69838e5c7d42ccab9b391bbee776d92d
SHA256

27e8729640ff2d9434bb16d6646c3811bcde55d084e7d438b65f358e0fdc70df
SHA512

39f898141ea50c2304f2bc0dc354df6131d745859e2dc561ab916d217966e51706e406404b2b48b189330c0f32d9413dc037a63284c63716c2958d06b691ee00
SSDEEP

98304:DRls2+1ul8WojJJOOGk+mGMD9/UU0g5zKYB6ndnKXrJeLp2KjAwS9+6nY:D4cqWJOGSD9sUJ5zoKXrALpLMrw6Y

Score

7^/10

evasion impact persistence

Malware Config

Signatures

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.yxxinglin.xzid179898

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.yxxinglin.xzid179898

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.yxxinglin.xzid179898

com.yxxinglin.xzid179898
1⤵
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Listens for changes in the sensor environment (might be used to detect emulation)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4305

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

User Evasion

T1628.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact