Analysis
-
max time kernel
135s -
max time network
188s -
platform
android_x64 -
resource
android-x64-arm64-20240514-en -
resource tags
-
submitted
24-05-2024 15:44
General
-
Target
6f05479fe223584d78606b3fe3d1f0be_JaffaCakes118.apk
-
Size
13.0MB
-
MD5
6f05479fe223584d78606b3fe3d1f0be
-
SHA1
ca9cfd5226cb563b867235e323cb30daec331ff8
-
SHA256
5fe0d38c39ab6cb4c20d0a4b333c242aebed12e9a75138fcfe3ce8986ebc3c00
-
SHA512
2502f468374bade315a8aa2aca0dda9f5218cce2eef09abc733045a8d7bd3a8ec6ceab4e1d524e6b91cd85f4e4e7effc04ac0acf7a6a72f41f5684222e835b8b
-
SSDEEP
196608:8SOVpt3w7VZxDDAsiR5byIoSDe17SzI51CoRjGuvBa7nZvwUPlZuaSXJi:8pV2Pf4wSDal51CoRj/Q7n/PlZuS
Malware Config
Signatures
-
Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
-
Checks memory information 2 TTPs 2 IoCs
Checks memory information which indicate if the system is an emulator.
-
Makes use of the framework's foreground persistence service 1 TTPs 2 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
-
Queries information about running processes on the device 1 TTPs 3 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Checks if the internet connection is available 1 TTPs 3 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 3 IoCs
Processes
-
cn.it.picliu.fanyu.shuyou1⤵
- Checks memory information
- Queries information about running processes on the device
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
-
cn.it.picliu.fanyu.shuyou:channel1⤵
- Checks memory information
- Makes use of the framework's foreground persistence service
- Queries information about running processes on the device
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
-
cn.it.picliu.fanyu.shuyou:TcmsService1⤵
- Requests cell location
- Makes use of the framework's foreground persistence service
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD530a22bb89c0564efe82468e7f2b8f6f2
SHA1493c0f151689fcc133493a2318017564b2544311
SHA256ff313d835b17bcc25de0c723293165ad86493076f0687e2127a63f2663f19915
SHA5124f3ac031219ceca4bea70d4ceab2ab3244c56aa56a597725e3e49bf1da52708c503df0cd9d3ffcc88542d6777b9882edac30192fa4aada87a2a397e31a18a705
-
Filesize
512B
MD508fa3221258101b781876edbed121cde
SHA1eb644b18ada0a2979dc0e61e225f89c600f85fbf
SHA25602225b550ae2bd77a042ce05418a0afae1f677ad0b7fbce74a8197dd21d509b3
SHA51210ca754bb279a80487d912075b53bbc5b4f2b7cfd34cdb87bf36b742b51a56777954dde9aaafc16f90053216a3e3ff41774a5912c0a6a41979aaca7e668be7e1
-
Filesize
8KB
MD5abb5fc8fc33a476184e4bfdf9b957169
SHA1cc2b4f62a9a77947463431c5f860bbea73d802a0
SHA256a524747752ee261fb7335b3705a1978ab3a77b665bf56fea936f21222fe37019
SHA51204602bbf2fd72c2f40925c5e2b645d4d3ac18d3da9e119b445a9333e4f1ef3bffe60aa2d8a41a541d5ddca02d5a6b928ed78150111798c30633d7403334f0404
-
Filesize
8KB
MD5273a04c232b0330438b2b5c3299d7169
SHA1ed773fe6c99553dc7bb9ef755acc7add553df824
SHA256a528802ef56f651afbbf2bf0fef6c9f21c2fa9d10c056dfc186f802d795fc886
SHA512a72f25ec52c67a12069e7cbc0b51d1b1872ab539e1bafbb8dffdbc06bc7a58100169afadff301d18fa328ddf5e6d7a3672a28cb76f80aa39cef246e3002b5252
-
Filesize
20KB
MD5ca8224424dbc75407e5a55b35818b158
SHA1fcf85f5936a55d2b450f4e4d4289620ac230bd3a
SHA256be9f7bc91051c2eba9ed6c02d9f71e1a44637cd141f829be45c838fb656a006d
SHA5128af2ae0cd26162a6b5d5f96984dad4d4732bbc6d99e98d9c632b128b8122048f36940cac4aac15a3b5ce9bece0b2b9be85dabae5f77bb2b451b5afb8a1794bdf
-
Filesize
512B
MD55d299a366bd585763c9378a4cdd63a2d
SHA165556444d4dd7b58626d9c5ff2e7e08cfd1dec23
SHA2562b518e5677b918cae39a7a3160d22aee7c9bc998914da9260f7495c49d83203a
SHA512cbdb422e9f9b29e0b979937c050ad9c74dfa326976f89fc99959e4d0a4bcf0a47763d00d78d858faa3078d2c5d4b1d8f425a32407fb7383ea6f5b8fc83dee8e8
-
Filesize
8KB
MD52f4531cd195bcc7e446b1ae6004271ee
SHA194c5c389ed9df2de38ef48e57384854f5e32ac83
SHA256dbcc6d3f372f846ddb776ef70c5f6b6cc8cd3f878f1a0057527c3841af31db4b
SHA512aacbd97e49be085592c970cd3da4ccdc98623beff07f9c84cb26b3f6012a2c795591d1e8d075ee3c12209db82f204e15fc1f41257a78c89aa29a3d2f694c6dd6
-
Filesize
8KB
MD5d76367ef62228ef08467361042628474
SHA1d9e2a5f247dc13d2643a3b8e770918a330dfaf2a
SHA2565bbfb524da273d1ce3db729365d24d76f4b165cfa513755079d1c3f2c43fcc5f
SHA5127f8e557d9aff22f7f26316e3a777923395975d692eeb0474b48b59647e7c95beef90dcd6e54f9ec02b31fb8b9eac52508dc1647a75f4f1591ccb719170a7fd41
-
Filesize
167B
MD5c74c6dc5c4b3aa3e6ab9dafe4fd6192b
SHA1bff9f23de802bf9369644a935f4bf8694c10e6f7
SHA2563e1dfef2aa122bad7e43d7b1742de97c83d6b6472742e6c656bfb357652c3fa7
SHA51287b66e6c45eb6af4c7a6270d46e2afcec14a14fe246b003d2e401b1c9b078a235eaf89944dcadf861522e387f937a027a6efc7d8c754a9e89547a9ab4ffa91b0
-
Filesize
544B
MD5d0c1564a7b0f3af03ecf1d489f904cca
SHA18c65ae4f038cce52bb83bd56410a33d1fa7b5642
SHA2564bebeaa6e36517cf34613acdcec727a9aa9311d46fef9882ab377729fec231eb
SHA5121c6446ec4dcb810d6b3169bc292e4209ee8afe8b8da27404f5639e13f3efc5c514bfee175eeee071a58339686444c06b6e98b88279f400c4da35b3adddee04da
-
Filesize
4KB
MD5d65d2e0da9bff79e350ced083657e0ac
SHA1e16fd2e0a17ad1cf874de838931bba542eff3e6f
SHA256e43d4de8f37fc8f465c45430eb1e822b41e916ced6836a81415ee9d9d4e5ed39
SHA512fab42a4bdabe2162058dc7213d1b768324d9607f76d849c118991cccd8ad55427e871ffd8ec8c6795a31e9e19e9005ada73146ffa4ea24941d94ffeb66fef2ce