Analysis

  • max time kernel
    5s
  • max time network
    131s
  • platform
    android_x64
  • resource
    android-x64-20240514-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
  • submitted
    26-05-2024 21:41

General

  • Target

    76decb71d610b87bd4248397e27d1cfb_JaffaCakes118.apk

  • Size

    11.1MB

  • MD5

    76decb71d610b87bd4248397e27d1cfb

  • SHA1

    d420b1b9047fd39809e444f9067ab0e986bf9789

  • SHA256

    50e961c11f9b81810bfd749b307a5611de775f344ecb3de633d825ea15c75f87

  • SHA512

    def3e891ead84eba1f1fcff1e45a0bd0d2f2295740081b873be606f88dcd5a490f77ca39c6e900a50837b58e2372de7324f3c16c493a3073be81b71f90bfa1ab

  • SSDEEP

    196608:ktpUpW1VP4Vq4pasHsfqg2Aem1PNz0k7jibDslug4J3I0CS3iPVJoPf:C28VQVTFHsfqg20Cihlul3IfSS96Pf

Malware Config

Signatures

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.belrare.daibird
    1⤵
    • Queries information about running processes on the device
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5153

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.belrare.daibird/files/TDtcagent.db

    Filesize

    32KB

    MD5

    f63801a7c15aefc466a9f9f60f6f37dd

    SHA1

    80ef2791b0ec8fbebfa3b851eb958ed5433e2529

    SHA256

    65ca5a0cf65f0510e225ca2057765d724590c98759ccfb0991c22945eccdc626

    SHA512

    39ba7e38bc56f595f66d40f8bcc6bbcb65ec779b143cf838c3a4c0de88a6592f1d97580716ca2b766a531bce2ecfe4c8c65accdaf9149ffd6ffa04fa6a8f30ad

  • /data/data/com.belrare.daibird/files/TDtcagent.db-journal

    Filesize

    512B

    MD5

    abdb2d3cb5bd10817d7d427cc6f40b59

    SHA1

    aa41002e54b45661c4d7f28ab41046bcf825641a

    SHA256

    8a57bc7e940ed533ea32793eb0eac75d50fd008d9b81112b4646b286fd7f92ff

    SHA512

    6ae3cadb702afdfde9e53a383473be7056ef3466e4efaa54a134f3ab0efb604cc08ca08a1df2e6551124b0672148d3d191b65c6a825b00e9391d76e3894aed36

  • /data/data/com.belrare.daibird/files/TDtcagent.db-journal

    Filesize

    8KB

    MD5

    9abc16342e95dd12ddb5e5786f03d736

    SHA1

    b0e7be11311adbda1860b7c2638db09379023e39

    SHA256

    645d90739692009ad80672dd4607bc793a1150ff17403944ff0927a982214522

    SHA512

    4054ff17c9ff8d27f45d79ba643aac58ddf8a986eeaca70d6dd2ddcdf4243ea97215caa1017dd901dd810d2142acdb7c2d86d4d7bc64a40c7aff0ac487d29e3e

  • /data/data/com.belrare.daibird/files/TDtcagent.db-journal

    Filesize

    4KB

    MD5

    2cace5a97ea072e0f195925ecd30b4ab

    SHA1

    78345d1e11d9bb02c81ab3385b8b5290da3e2fca

    SHA256

    e45330f0285c2cde95b9e5d554bd9e3bc0194446f5a2f116421a7e1a6a468894

    SHA512

    94ed4fdf19e3961e1a33bef3fa0ab3ddbb631402dbfe8f55ef3af4ce47e0c4238de81e6334651950aab8c88c7bdd1cce06efb37af73264b41a528c61ebdff195

  • /data/data/com.belrare.daibird/files/TDtcagent.db-journal

    Filesize

    8KB

    MD5

    e6609b6ca9f5dbc008a6edc4f8a87945

    SHA1

    49bac4b2fcde7004dda79fe4510e9f8b6b77320a

    SHA256

    974a6d2b4b7481a782e06274c4da4b458a5f0bec76eec9333cba8c48c80f7f77

    SHA512

    a83e1764d1145ef1ad9a9c5f8ec7e792f1196a68547e88ba1515c589722e84778c3a881485b7598935b6d350866b307fd0faaa05830e98a23b23a2490ac1f57b

  • /data/data/com.belrare.daibird/files/TDtcagent.db-journal

    Filesize

    8KB

    MD5

    f64ae6a84608425147167928f2978cc7

    SHA1

    c96852797b09ba0fadc57b15ea8048a151678807

    SHA256

    0afae9c1850eaec5ffb620bc250030785f6b985430562d58ebcd391c45d2f47e

    SHA512

    cfb4d4656e6e39eb952ef92acaacd87798ac31bf645bee5712b9b3d373b5bbff0d2a8cb567efa9aa06a0690b8a403a9d3c8a1358de340c12b34a6c404a76e550

  • /data/data/com.belrare.daibird/files/TDtcagent.db-journal

    Filesize

    8KB

    MD5

    5b6f1c82bcb7ca0d6adab0d1fc0a6eb6

    SHA1

    c65abd94b189c6d0b7c54e934182e0ce374f8e4d

    SHA256

    49fada8976834604c040323fd3f8decc345f3a2631f082095c4a22406774a3b9

    SHA512

    5e2062b545d627dbf7fd686ee965574294bc2f0a4b9b6493a8f9f4aea57d1aaaec4a1557e4011f233e448d4308be24bdd7196b89b58f931f10c5ebcd101beff7