ac7fe6ae3652d123d337e3bd053d25c9e7ddd34423c8b7b96eadb8d7ee1d07d0

Analysis

max time kernel
111s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240514-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
submitted
25/05/2024, 10:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
71aa30726d3bbd98fc3d17cab8a798b1_JaffaCakes118.apk
Size 7.4MB
Sample240525-mlxaeadf4y
SHA256 ac7fe6ae3652d123d337e3bd053d25c9e7ddd34423c8b7b96eadb8d7ee1d07d0
MD5 71aa30726d3bbd98fc3d17cab8a798b1
SHA1 1437c5da94c9293baf6f9803904d02fe147b29d0
SHA512 7e09345436c58c57a7bb8646d6c278fdfc9f47efae8b2cccb30c58b4a40413af8259d202dceee7c14b056dcc2c8aa913c1ce2ea0f5a5e947aea2f703333031b8
SSDEEP 196608:jAPhEQah70FUFeno9omT40nBMgmK8o5aYUO39:8P2F0dIomU0GgsocQ9
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection credential_access discovery evasion impact

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.swingy.teetotums.thatt

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.swingy.teetotums.thatt

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.swingy.teetotums.thatt

Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.swingy.teetotums.thatt
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.swingy.teetotums.thatt:mcServiceProcess

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.swingy.teetotums.thatt

Checks if the internet connection is available 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.swingy.teetotums.thatt
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.swingy.teetotums.thatt:mcServiceProcess

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.swingy.teetotums.thatt:mcServiceProcess

com.swingy.teetotums.thatt
1⤵
- Checks CPU information
- Checks memory information
- Obtains sensitive information copied to the device clipboard
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Checks if the internet connection is available
PID:4604

com.swingy.teetotums.thatt:mcServiceProcess
1⤵
- Queries information about the current Wi-Fi connection
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4756

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

journal.tmp

Path /data/user/0/com.swingy.teetotums.thatt/cache/uil-images/journal.tmp
Size 31B
SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
MD5 8c92de9ce46d41a22f3b20f77404cc1d
SHA1 8671a6dca00edb72be47363a7071be65cf270373
SHA512 30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56
MD5 SHA1 SHA512

Submit Download

directToMarket.html

Path /data/user/0/com.swingy.teetotums.thatt/files/direct/directToMarket.html
Size 1KB
SHA256 d08149221046f24cd08132606156c6f1a127bd25f7efdce879b04c02ee1bfeeb
MD5 0d0d831fa66a8844072bd54fc443a014
SHA1 53913eaeb0323153f12d8fbf6e0bd2e4a4b1cfba
SHA512 3fcb52f98a1f3d0dd54bde6cba14a610fe56efddf2a16ff2e2e042feeb9554189c8ec522fd052f628ca5c62714082306ce6e7544ed94f03a154732f5736366e8
MD5 SHA1 SHA512

Submit Download

log_stack_errors.dat

Path /data/user/0/com.swingy.teetotums.thatt/files/log_stack_errors.dat
Size 1KB
SHA256 c764ef5d92fb54e79fb37c145e7eb189c60c734d0e1b963172218e602febf3e6
MD5 e63dc5b8053762a98b7815ed048a9d47
SHA1 6b251ed0b680b62d7303b8c9c5cbc871501d0556
SHA512 a063d24de4b1004ffeeae2b761b657a7f1c228dd1b9827005321d0035e81423923f94dd94f14ac7be8301f59fe353790de450ee552a2aca9381794ff2d9e9cfd
MD5 SHA1 SHA512

Submit Download

nativeAds.html

Path /data/user/0/com.swingy.teetotums.thatt/files/nativeAds/nativeAds.html
Size 1KB
SHA256 84c72eadd9b8b6745eef0844f81e1117307cd93c750be40aec3a380e3c5b2124
MD5 d2f2a0b4dc208096ea5a792bccb0c353
SHA1 3b30ce76a7687813a55c4cc5aa5e79da866f913e
SHA512 b2fe3c5bc14e2c3392552e6de7275de9089fbf2b1805642019a2581eb7703774518fcaa5f79ccfeba099a5e12801ba8c8db78750039b8ce7e53b19486867853e
MD5 SHA1 SHA512

Submit Download

offerWall.html

Path /data/user/0/com.swingy.teetotums.thatt/files/offerwall/offerWall.html
Size 1KB
SHA256 2f2fb36d1412a3870cf63e5604452c710b4359943abed7ed04c7770f4b045f58
MD5 67c9a1dc09001e500c64ff5d4868ac42
SHA1 48929f1dc7d8a9ffd5ef5cddd65235fabd307dbf
SHA512 a7f69d65bac14ba690a1836ef8600c0991a8b8290f86ae04340c260a602dc941a9404ec009733abdd8af38685a7acf59f7dbeb8bbd05625cc025e55f0166bc3a
MD5 SHA1 SHA512

Submit Download

preloader_0001.png

Path /data/user/0/com.swingy.teetotums.thatt/files/preloader/preloader_0001.png
Size 3KB
SHA256 0edd817790d7dbd789b0d594810bbed301bd2646bdae8c7c3629fbad32ef8ff3
MD5 66d686fb1901cc4cc8e779555cf83b8d
SHA1 53131b9ff7e69db450179138f7ca99e965ba4053
SHA512 3804df5aef9858223f9fa59173f35e40dbee9a4c9b246b36c1d85edd042215a4d6e5492a9e121328a2383326c0349514b5ed4d1f61cb29776ec91d08022806db
MD5 SHA1 SHA512

Submit Download

preloader_0002.png

Path /data/user/0/com.swingy.teetotums.thatt/files/preloader/preloader_0002.png
Size 3KB
SHA256 9e5fff43f313839ff8dc8078b44a4601c5748e87902d602512f34f0131a1c47b
MD5 d1482c608dd18b9f744c4015ad0360a1
SHA1 1d48e67a029dc8378d955f7fca25f6b8bf12c913
SHA512 ab9fa1c7323318821939538aa429423516ead317d352b880aec0dfdb1b030a4728061757ca12e546a47d814c7890144aae2128a7829cb8b90e8defb8b0abc059
MD5 SHA1 SHA512

Submit Download

preloader_0003.png

Path /data/user/0/com.swingy.teetotums.thatt/files/preloader/preloader_0003.png
Size 3KB
SHA256 4bee8b27a1f135351b12bb1115560359fcec346842f058bec4e85d88c541e250
MD5 ffbe93f98f05cee98cfc7c09392a7a18
SHA1 c4ddb8bb07af7b5f6a5ba913bece4b021bd7267e
SHA512 6cc9f673573d5a99233859b815143a61664caa1c5d76bf3ccab177d57c27059fb946b460027e31e9c2960ac2cba901d458f87ab2eeded0a5c89d0f1226907624
MD5 SHA1 SHA512

Submit Download

preloader_0004.png

Path /data/user/0/com.swingy.teetotums.thatt/files/preloader/preloader_0004.png
Size 3KB
SHA256 5010f60883e868d5e6b34e1f5524e072055c8efef7ead491335ad0af62cd603d
MD5 0f0d78022b9b6162d6d20eaadbc81d9e
SHA1 8ae90e8c499c6f8f7635ad22cb8116d364ddd3c8
SHA512 b754441c389fc4738d312a9d0b0e19c39727ffad38b5e36dd7010bee2043bf7494ba0642973ba235c5dcac394a6999e44bab7fedf60791025c2714894ea2c6ff
MD5 SHA1 SHA512

Submit Download

preloader_0005.png

Path /data/user/0/com.swingy.teetotums.thatt/files/preloader/preloader_0005.png
Size 3KB
SHA256 d4eaa7e311aa5706bb0f0d43fcfa5593aa0035753439a0704258c4c66028f89e
MD5 e71761502dad346755d9e12923acab4e
SHA1 cd3aae137c9b381e4f0617cbede0126f236350a4
SHA512 f474e403d8c6b45b5d642af2bbe58d7ccebd308171f9f9a93c3459e32bfa56bcd5116c8349d4dd1447e968f0899a05acff9feda4af0e932e9283f47e51c8b453
MD5 SHA1 SHA512

Submit Download

preloader_0006.png

Path /data/user/0/com.swingy.teetotums.thatt/files/preloader/preloader_0006.png
Size 3KB
SHA256 47acf0c528abd5dca1bd899aa41b99f6bbee469e204074cba259657d9a589378
MD5 d7e606100f3d0e7a688da2f698c568bb
SHA1 52f585bc7b048aa418f36e82b0f2dd9163e92e17
SHA512 2a57e31f8c044db85f27cc7b159d8e827ce026b074c1814b4b9f82685a330223e6abf8f956be36360dcfec20c08c22d841db66384fbd3bfbc0cdc86dd50a8e7b
MD5 SHA1 SHA512

Submit Download

preloader_0007.png

Path /data/user/0/com.swingy.teetotums.thatt/files/preloader/preloader_0007.png
Size 3KB
SHA256 0237e32468aa870098878f124cbab5d365310ee9fbd2c074cf8e31859272beb9
MD5 84f0ccc36af5714961e14b77374d1f15
SHA1 3a7f8163501d560f1a88324f5c8dfa2b14b3a40a
SHA512 4a8b6439ead11f73c285b0ed123cb5e20ab1f772dd57e7cbaf5ea12cd08221d9f6e2036e5d1515abf0b095fba79c2d26d7aa0b5f5dba890cd484f1c3cda9eba4
MD5 SHA1 SHA512

Submit Download

preloader_0008.png

Path /data/user/0/com.swingy.teetotums.thatt/files/preloader/preloader_0008.png
Size 3KB
SHA256 5137e718727890e7572e63868435f34538aa0fb9c735540cb0223c39fa08305f
MD5 b7da3a818e98bdd9c5651c9858a7a3c6
SHA1 6a9d4cbfaa263c74b5827d9b2c7960519cb07eb5
SHA512 fabda0a518758c4a2f6fb2e74b13abf0e4b26492fd6e9261791d7572237ef21ba8cf37830ed83286a7a50fd2005d42f43097a7c9c872da06e4f32749401a3dc7
MD5 SHA1 SHA512

Submit Download

preloader_0009.png

Path /data/user/0/com.swingy.teetotums.thatt/files/preloader/preloader_0009.png
Size 3KB
SHA256 4f125fa2b62a10c2b78fce29861f3c8f52400092d5baa929d1e70a3a762cf6c9
MD5 ded007117da35843c1a3282963068c24
SHA1 c0dcded1f4030216d62d5d1afb849b6d0212952e
SHA512 a1d4987d40f28631a70a455540907438682e68b14a05495744df2e75b9eb17b192a122937108f500269dd4f37a478409becad3b4b06ff6e2a8948e9d7bab825f
MD5 SHA1 SHA512

Submit Download

preloader_0010.png

Path /data/user/0/com.swingy.teetotums.thatt/files/preloader/preloader_0010.png
Size 3KB
SHA256 d9f2c8bb2ffe191f2ed7740d45a6c6cdc92a82a7da51ba3d3f798e778cd0dfbc
MD5 8eab6bfb9c95a44f08b1b2f80188a870
SHA1 c7cd5ba7280390d4b3872c1658c80462f05bc478
SHA512 796d8f6c7fa5602e43022c6a9e69959bdfa1f92c5aef75631742938630f8be294d1ceb5c19bf89332e4f38f04627c9c299e0f0722ce25ac90224d7828ef9785d
MD5 SHA1 SHA512

Submit Download

preloader_0011.png

Path /data/user/0/com.swingy.teetotums.thatt/files/preloader/preloader_0011.png
Size 3KB
SHA256 ca37435682330a7cfe9562f7419f6a353191a613750657d18cf7f65b19ffb039
MD5 66e07e1574af0312354bbb410ce1ecaf
SHA1 7f37bf34f6a9364dec2278e4432a4434596a3ab5
SHA512 5e596ba8b7b7872270a98c04728f19f1175c75257ea4f66005b57602f74fee8710cfef1608ab921e75b7e6e236230ff7a6be6c15fdc9954fec31c307f2d59ea8
MD5 SHA1 SHA512

Submit Download

preloader_0012.png

Path /data/user/0/com.swingy.teetotums.thatt/files/preloader/preloader_0012.png
Size 3KB
SHA256 094c72476e0752e1eb4c36b03a757669827d40d449dcc0f2c90aeb573b4dfe32
MD5 ba2e26488d6b8ac46c84e48d61f04bab
SHA1 8a4f36e18a40fc4e8310f66b16b97c1c13009add
SHA512 e325dbeb4878d069e998b022e9a18ce7b08218699b9d26c1929c3a23bddf401fa47e7deb085b6b0e84631fbddcfb36e9d40812cb75e8c29f9231b8805c14ddf1
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads