fe466224bac7b5c3c12c92716a365e98b60aa91c427e8ea6ff644223fc079648

General

Target

747685f90d49d320c544fa1b50903d55_JaffaCakes118.apk
Size

2.6MB
MD5

747685f90d49d320c544fa1b50903d55
SHA1

acb1ebd906e4d85c86de759ea4a85b6fc7009368
SHA256

fe466224bac7b5c3c12c92716a365e98b60aa91c427e8ea6ff644223fc079648
SHA512

29143d9dbb93677fd9196d558fd5a2c56e0441af979dd95e6530c1045a384a98a1c1bbf29846a1731677b9611b465fc103eebd2b5b827cbedf5af9cb5406cce3
SSDEEP

49152:j5mR1R5XBxK4LS372cmWXYdid45rVWRYRd3haoRoTJkEb1I:j5kpBx47XdIdrNRd3hau0JkAI

Score

8^/10

banker discovery evasion execution persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	roman.eshghe.ghadim

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	roman.eshghe.ghadim

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	roman.eshghe.ghadim

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	roman.eshghe.ghadim

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	roman.eshghe.ghadim

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	roman.eshghe.ghadim

roman.eshghe.ghadim
1⤵
- Checks CPU information
- Checks memory information
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Schedules tasks to execute at a specified time
PID:4210

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

1

T1603

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

Scheduled Task/Job

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Discovery

Software Discovery

1

T1418

Security Software Discovery

1

T1418.001

System Information Discovery

2

T1426

System Network Configuration Discovery

2

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/roman.eshghe.ghadim/databases/__pushe_base_lib_db-journal

Filesize
512B

MD5
97c7b059e55ca7d15936c34e2cee1b44

SHA1
2d10432e7aa7a1d2e13b632105faae13684753a1

SHA256
9768b31618e4603cc0dc3f868c56ab311b770e695969d2184f04d798dcb55d40

SHA512
c54771cb5a369f29e264664e4a6451c914631df5e302b64eee9fb1030accdc01ce587a4c3e530c3411522e4c7d24415d1a9949a264aaf52645100d081aa81463

Download Submit
/data/data/roman.eshghe.ghadim/databases/__pushe_base_lib_db-wal

Filesize
88KB

MD5
a5a1def7e90eb0279b72b70cce22e93f

SHA1
6d9922cbf670a82538dc91a1ccf42cb5aca0e613

SHA256
99b81a35b4bffc145389a4b640d6a75d04f3a25dd236b9175bc8d355286b840e

SHA512
b5d024cd0a845e868e8bc588551b7b5847ce891b53340c4548ad1aa02792532eda2b9afacce2b2bcac91e69b06d153b1afb6561ce3009aebaaaf08dfa50d4c09

Download Submit
/data/data/roman.eshghe.ghadim/databases/evernote_jobs.db

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/roman.eshghe.ghadim/databases/evernote_jobs.db-journal

Filesize
512B

MD5
5840a47bed7d2f2551ada7f5e9e48808

SHA1
e90a3c63fb71785c4e2c881c522ad067e4c285f7

SHA256
ad157f11b70e00d208ff737daa09b7e7d809ca77a685c900fe6033301d6fda3a

SHA512
8c14ae58e1a823afcc104dc99d1d1d15a30c9b950ff201f85aa020610ce2512c4f285f1f2dd84c6a877a4cc906f98e390a99fb67050bf8b576a55a3ce95e929d

Download Submit
/data/data/roman.eshghe.ghadim/databases/evernote_jobs.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/roman.eshghe.ghadim/databases/evernote_jobs.db-wal

Filesize
84KB

MD5
5bd374fa57259b8a2e29d5d28a6afa99

SHA1
aec7ae99932e0fd42cab4b89d63bb4678fe9717e

SHA256
e9e5628533c688791568ca1a3b00d1b8d6b133d406e40e63b8b65b14587bb621

SHA512
c42b39eeea14777d4c2d437ef2c4d55d39b9e9575ac12717963415625a0fe05db53915a7ec1fbc6edd9084d380278bc103e4dd0bfb4c3bbb64e119b5d7ff4e29

Download Submit
/data/data/roman.eshghe.ghadim/files/db.db

Filesize
1.1MB

MD5
499fd65c375c7bec13bb9e372cfafd07

SHA1
4c0f8bee521577244441075e757957e7e9299493

SHA256
6bed001bad2e0bdf16806dd3b5ed9810cca9a361cef909e9125d508825bb46fc

SHA512
aa79a82859e42fcd4e4c718ff071bf0aac8ba64cf917d23f49691809ce9edcbd2354dbf26849e078e7503d682940c9cb662b9b9f861c4227befee70b27109c7d

Download Submit
/data/data/roman.eshghe.ghadim/files/unsent_requests

Filesize
58B

MD5
0d210bfb2a0e1f1b4c082a6a0f79de07

SHA1
bb8ed9e364db79d1d9f2fcde3f15091893222faa

SHA256
988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d

SHA512
536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads