Analysis
- max time kernel
6s - max time network
131s - platform
android_x64 - resource
android-x64-20240514-en - resource tags
androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system - submitted
27/05/2024, 23:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7adf48b907001fa9c8c3a74113dc0a72_JaffaCakes118.apk
Resource
android-x86-arm-20240514-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
7adf48b907001fa9c8c3a74113dc0a72_JaffaCakes118.apk
Resource
android-x64-20240514-en
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
7adf48b907001fa9c8c3a74113dc0a72_JaffaCakes118.apk
Resource
android-x64-arm64-20240514-en
4 signatures
150 seconds
General
- Target 7adf48b907001fa9c8c3a74113dc0a72_JaffaCakes118.apk
- Size 2.9MB
- Sample240527-25ea9sef28
- SHA256 b25e70596b7426b600a8d1858ff0e769614a5e8ff7cc9aba624c7a9e9f64bf6a
- MD5 7adf48b907001fa9c8c3a74113dc0a72
- SHA1 7b28eb1febf139e27a6e7a5739491edf5e3c933a
- SHA512 05cc6f500af4918152709c3e7bb6560a00761d3ac37f92df8304923065235f9c0d0785cea1e9449b94bcff027f184fbb808f7db3d50b213955e7d97004ee8952
- SSDEEP 49152:dmGHr1h/Q6nhElvHHw8CkNk0rqnPGjl7bxQBJTYzmBKNUH1/rg3sq+B86ekd2ztt:dmGJhQaEa8vMSxQPZf1DjvB86ROvWtI
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
description ioc Process File opened for read /proc/meminfo com.slncsc.apps - Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/data/com.slncsc.apps/.jiagu/classes.dex 5149 com.slncsc.apps - Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.slncsc.apps - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.slncsc.apps - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.slncsc.apps - Checks if the internet connection is available 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.slncsc.apps
Processes
-
com.slncsc.apps1⤵
- Checks memory information
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:5149
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.slncsc.apps/.jiagu/classes.dex
- Size 1.8MB
- SHA256 2927b5053a9cf5fa76412ee155bef7a009e57106bd7040950b9e820ceb7446d0
- MD5 7a1260c6bfc5308210e6979f08244fd1
- SHA1 e1a806f48247959d91a29648d786ee8f75ebbeef
- SHA512 af6eec758d454298fb9c9d0361709076747918111b4236fe9dac27b96fba9eb66f6bc16b08462ce120975e9646dd5fc576085e2887449622eb9b78d5205b5471
- SSDEEP 12288:JiV3IIXj+8DbHtnULw81ooT/JNy/lbip8ss/g/bMVJp30QZRWwAQAJbN/FVKCmhY:JiVbXj+CnWt7T/q0ywg8LnfSHrWj2w
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.slncsc.apps/.jiagu/libjiagu.so
- Size 487KB
- SHA256 baa349e9b5a47be21b6ea00ef2e0c0c5dc203c0e4c391dac46df07ca9d333217
- MD5 610a895c4a71bbeeaea16eddb1422bbf
- SHA1 9f919de42ed1e80bfadfef48f8202b202166f869
- SHA512 ef4173ba32309ef1257b75bcff28fd44ab14398577b4fb3b6b95323035c964201ed39546cda3b7115ba5025781f3b9c018443e7932edd50a25b1be60359f80f2
- SSDEEP 12288:u1jfCZt8eyspW+KzV1egmeOp9pWVSDm7texEVeQXD2Y2R:u1fwssE+iHegme29CS67texE4lY2
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.slncsc.apps/.jiagu/libjiagu_64.so
- Size 525KB
- SHA256 dc9d0faf8652513f0a1eed698b9559e0bbfaefe12c203d239f551ff557abbe5a
- MD5 198e8f0e9b0d80997fde430f9973c1a1
- SHA1 dec0b84b06072ad07d44b445d7e23587c0bc7f02
- SHA512 2868fc26e0bbc32e6f7c7d6e56ed6e9517d0ea4a7d8021a5f50af5945d6ac27fe87f500e32eed5143f37d484ba95fef481c9d5c11b652bac2a26d267358252ea
- SSDEEP 12288:yUDml8O/lg10OndFCbzmXlK+JM9z4J5f1mCnwNjqdd/T:yUSTOndYHm1VCurnwN2ddL
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.slncsc.apps/files/.jglogs/.jg.ac
- Size 40B
- SHA256 36269c0853ebb4dbbfcc1e6d14ed11d8f35f8d296e5f8b1610478639722d1f8b
- MD5 0e6cb6cfcc0ff0770a65a99abf07ca59
- SHA1 01e795f93eb3a700d2c806ac37c2f43c6444c22b
- SHA512 7eee9d02a00cec7b084267ffb0431d6fa53ce4669ca61d76e60e4a47c20680a9de07d7a233e92c514d098e778095efcb8545b93a91c40da37eb8edfd2a2d576e
- MD5 SHA1 SHA512
- Path /data/data/com.slncsc.apps/files/.jglogs/.jg.ri
- Size 307B
- SHA256 5024d70e8f6e315a2c4dd4866f357e67f0b2de41c0802f3015d3e9e2ec7bb739
- MD5 4a57a3e1e72e582172e1867bd1bdb3ef
- SHA1 d3f087a502df31761d3d79deec25ebb3ab3820fa
- SHA512 dea84b905beef54ddb34398da27b7b98d83fe68969c89a5e703ddaedad853afbbb0393182db3e1a71b43332c6a6062abf3d85912af93519eafcddc6dd6be2d13
- MD5 SHA1 SHA512
- Path /data/data/com.slncsc.apps/files/.jglogs/.jg.store.report_cf
- Size 32B
- SHA256 47fc43ec291142fd5ed77144506526d71208dfc1277f7f36643870ac1f100e93
- MD5 bfbdab1f083015b2a9626d08a854bef1
- SHA1 bb8f3a71c06a30f44adfff5a4de5d9e21398e9e4
- SHA512 12335322195cac3c02a8ff3b5f912c862803e8a633aaa6b769e87d6bf7c084b1f22d1aa335ce0a779ecc4666f0bc50bb963b6a518d06e94bce424b3534a3ebbd
- MD5 SHA1 SHA512
- Path /data/data/com.slncsc.apps/files/.jglogs/.jg.store.report_pid
- Size 32B
- SHA256 4b3d6b64a90c1f317ca63ea27e464af8508250ca6383547cf56b251401ac6067
- MD5 e8d4ea7afc045195684d0410d10b9c7c
- SHA1 9ba102417aab51f02dfb24edb70134fc7d569c1b
- SHA512 753ed77e0a7a49d7763b57535b6310e3eb98437aeecd6ea57a89a67c55c6bdf5ea0e987d2fea8e705b4774083a50dd0d3bddcbfb6f940599b7c62113708074eb
- MD5 SHA1 SHA512