37d50bb030563d6279a0961e0e5c9e0a1c382db53256b52652e5eac5e67595e7

Analysis

max time kernel
178s
max time network
130s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
24-05-2024 16:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6f237444cfa69ee57a3410c2408d1325_JaffaCakes118.apk
Size

15.0MB
MD5

6f237444cfa69ee57a3410c2408d1325
SHA1

275b61dbf12d1086b6651b03be113f6bafbc1f46
SHA256

37d50bb030563d6279a0961e0e5c9e0a1c382db53256b52652e5eac5e67595e7
SHA512

76a5c1b77336005f3c911b41034882a7fcefcd0bbe1b786a2ff48f2411438e194c2170701a5e9e83b67c138c28f1cc73f96687498519a9024807b06832860372
SSDEEP

393216:CS7B0RzxGWNfEziOjDMSsO+Cs4Afn7J480ZAen09e9yES:CxR84SsR4Ae80Zc0fS

Score

8^/10

banker collection discovery persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
collection

Stored Application Data
T1409

Processes:

com.Qplaze.JewelsPirates

description ioc process

Framework service call android.accounts.IAccountManager.getAccounts com.Qplaze.JewelsPirates
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

System Network Connections Discovery
T1421

Processes:

com.Qplaze.JewelsPirates

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.Qplaze.JewelsPirates
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

System Network Configuration Discovery
T1422

Processes:

com.Qplaze.JewelsPirates

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.Qplaze.JewelsPirates
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

com.Qplaze.JewelsPirates

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.Qplaze.JewelsPirates
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

com.Qplaze.JewelsPirates

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.Qplaze.JewelsPirates
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

description	ioc	process
Framework service call	android.accounts.IAccountManager.getAccounts	com.Qplaze.JewelsPirates

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.Qplaze.JewelsPirates

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.Qplaze.JewelsPirates

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.Qplaze.JewelsPirates

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.Qplaze.JewelsPirates

com.Qplaze.JewelsPirates
1⤵
- Queries account information for other applications stored on the device
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:4245

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.Qplaze.JewelsPirates/databases/com.gmobi.PushServiceDatabase
Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.Qplaze.JewelsPirates/databases/com.gmobi.PushServiceDatabase-journal
Filesize
512B

MD5
25dd8ca72fe14451be73e2c14817f49e

SHA1
6154a172ab2cac144542b40a37a6860109a5d260

SHA256
2592b5b96b3cea8c76d2f7da8d59bec61e3bacd54be6983d484aa12bc7c8cf0d

SHA512
22b159209f59c4f38d2ab902c511b5a9249825f7e4c82e3847ec546914deee63448fcd2e59064fef1418853f3e992563ebf140c4ec76a5de05e90d7e6a4c0e0e

Download Submit
/data/data/com.Qplaze.JewelsPirates/databases/com.gmobi.PushServiceDatabase-shm
Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.Qplaze.JewelsPirates/databases/com.gmobi.PushServiceDatabase-wal
Filesize
48KB

MD5
8edce0c9a9eea9fc8515292f195599fb

SHA1
9ae927b26a721ccf41189078bf4488e608ff03ba

SHA256
33bcfeb43a0cc6848d7efd27bac62d13487fd42e0c9af191a449416fa72cfb45

SHA512
4c1012bbf2a0585772f8074267c3d7ab6d8b9b5ca176ca1acc41e17be51f99f7ead72ff80cdb6724d6b7b37c76c089aa69824c382853ffbbee3b42690485bdcc

Download Submit
/storage/emulated/0/log.txt
Filesize
4KB

MD5
c086d9b659db8edecf7f5351adc40ac7

SHA1
260a7f460c639ec4bf8858da1a72014475cc8763

SHA256
0ba57e5c6d9f3333a4cdf046739be7eddd1d6d423f8363c4201b79e045e38329

SHA512
e71cf407096044231d6ca8fd8ed1e1403514748c4ecdea888b788eeb0e6ed6b7f1d29150b02ca6ded4541d64ed0269baf68505f66022ffa79c09d16cf1fe431f

Download Submit