0429b901f3f6fbc0aa2ee1682cfb5bf219519aa0baafd06a1685fc9cf22d9e00

General

Target
710bbb35db5ab2cc27f9a94eb519c1fb_JaffaCakes118.apk
Size 12.4MB
Sample240525-gmffdsge76
SHA256 0429b901f3f6fbc0aa2ee1682cfb5bf219519aa0baafd06a1685fc9cf22d9e00
MD5 710bbb35db5ab2cc27f9a94eb519c1fb
SHA1 c19347d81a8befd32e14abab0f722307d92049ea
SHA512 47852f73bdb968bc73dd4ff08e48a40c234e5bcf29c4fdf1444b4b427a367a4ae192d750c8f2102cbc18788dccdc1f8e91a2299e5c319ae2c2f5528cc6686759
SSDEEP 196608:MAGeTD1fu//VSWZnpiOSQpFPbi9Q8jWOZcy+BdBoTfvlHHnr5N:JGoDAFrysFzEWOZN+BToDvln3
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection credential_access discovery evasion impact

Malware Config

Signatures

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	exam.gaokao

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	exam.gaokao

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	exam.gaokao

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	exam.gaokao

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	exam.gaokao

exam.gaokao
1⤵
- Requests cell location
- Checks memory information
- Obtains sensitive information copied to the device clipboard
- Queries information about the current Wi-Fi connection
- Checks if the internet connection is available
PID:4532

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Execution Guardrails

1

T1627

Geofencing

1

T1627.001

Virtualization/Sandbox Evasion

1

T1633

System Checks

1

T1633.001

Credential Access

Clipboard Data

1

T1414

Discovery

Location Tracking

1

T1430

System Information Discovery

1

T1426

System Network Connections Discovery

2

T1421

Lateral Movement

Collection

Clipboard Data

Location Tracking

Command and Control

Exfiltration

Impact

Data Manipulation

1

T1641

Transmitted Data Manipulation

1

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

net.yyasp.recite.2.1.db

Path /data/user/0/exam.gaokao/databases/net.yyasp.recite.2.1.db
Size 40KB
SHA256 ce9f27dec0c7d10f1547aa89026ef6667464c22ebd15e942db7ea6803da511e3
MD5 74c4910e308e03c9e6e8ccb7f2f10a3d
SHA1 6032e40ce5d0292f0e9e1f478e4205ec0ce901a5
SHA512 df0e14717d5a4a197db4027f615e43a73a20688980e17b615cf177d7340fee5619e0377a19f8bcfc3a252a8a3058b833301c17daed6bca74509a458b18315458
SSDEEP 12:TLnFiQkAqL+8Pe/egFlmrFrsdJXNJOckF+OF0foK2TZmYcrF0Y5B76HRmBEyPb3:TLnFHk0e1sdJXz+mfj2EmYfrGSvIee
MD5 SHA1 SHA512 SSDEEP

Submit Download

net.yyasp.recite.2.1.db

Path /data/user/0/exam.gaokao/databases/net.yyasp.recite.2.1.db
Size 6.8MB
SHA256 7ded94f59770d0b7a92b22b36fbe9fbdb3611770a4dfce569e5de0442cef8dda
MD5 94ed5b0958d57b2e9cf765bc878da5d4
SHA1 1f517c7225663b5b0e762d40c179a1bd25be1bf3
SHA512 098375fd03f147be3c15c7d03f8b065b3eefcd12c2110c30d8cd33a85ecc420b00cdf78e2397c8f09fc4f572037e09d9b4aecd409f3f56b8f89bba30a2fa84f7
SSDEEP 49152:AAZAGFb2xJyteaKfTcH4avnOVAyYE98FPFvWuiWQzRaD2ZsiB8lNHEYsk2rpCBv1:bYdlYsk2rpgr/Eo1f
MD5 SHA1 SHA512 SSDEEP

Submit Download