bd0c51d6694dabd0c86a717b78af543b86f6c429c412e42b4064fcae9bf65c0a

Analysis

max time kernel
4s
max time network
130s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
26/05/2024, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
743c7b981b95dccf79aebaf29c7d0d8d_JaffaCakes118.apk
Size 6.5MB
Sample240526-ebxjesee36
SHA256 bd0c51d6694dabd0c86a717b78af543b86f6c429c412e42b4064fcae9bf65c0a
MD5 743c7b981b95dccf79aebaf29c7d0d8d
SHA1 eb99630b06dca9ce481a27d556f02d4925944d14
SHA512 6ae433bf3437609a7515a284aa765a0d3596fabdf299553224cce331850375592428070b4a103c05b3f9c4e4d638c6d610c7071ec0112db3eef63e51f2f6e057
SSDEEP 196608:3I3rBevERvL8qu22O+XZcQ+hxcgi49j+UQLEu4:3cG4m22OqSQ+hxcgibUQLEu4
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.j1game.flight2.zyf

Requests dangerous framework permissions 6 IoCs

description	ioc
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE

com.j1game.flight2.zyf
1⤵
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:5195

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

crash-2024-05-26-03-47-01-1716695221848.txt

Path /storage/emulated/0/.android/.crash/crash-2024-05-26-03-47-01-1716695221848.txt
Size 6KB
SHA256 28fd536005a34b2fe04e7667402ade75b563190981197644bbf3511709fe6a6c
MD5 5ca7bb4484ccb4bfc93c9238f2971359
SHA1 10da409307d2f8b15060f3e72e1ab63b7df1027e
SHA512 051bb1c71f755509118ff88c3c0c0ef8a6ed56093d6981b16133e98f43c815b3dda0212f30b93d503f4f5146410c434328b2f2a0099709aff41210b37f1d6631
SSDEEP 96:t2/3We2sUOQfauptuFrezdnKvQsSYY9hj+YkOQfauptuFrezdnKvQsU9hjo9hjOf:t2dzK1hjJKfhjQhj5KD
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.skymobi.pay.opplugin_V2017.apk

Path /storage/emulated/0/Android/data/com.skymobi.pay.app/plugins/com.skymobi.pay.opplugin_V2017.apk
Size 189KB
SHA256 dc55c0952f54064f229d4105fe09178ab2061dba5ac33a78ac76bd711bfaeb0d
MD5 7ca433f40d2e4d750cd5d19e0998e005
SHA1 dbb1f221cb279c9c067be19ae2756a1c9b5b67c8
SHA512 a561bf5401050c65c5f227b3457d76bd48c4182ecfba5213b02800fc7072b209ee3baf25d024a145314503f946773dde8fc0e17907ee618286fa42c8ab323404
SSDEEP 3072:MLWTvQatpn8vCt1WgMsNFlRkSlj4Z1j4ipaEGdWGGWXEnJ:/TvZ8vCbRbvjEZ4hEcGqAJ
MD5 SHA1 SHA512 SSDEEP