bd9a234fa2f6ea6bff4b047052dc7dbce39c94d418c14c4181100101f1d59a36

Analysis

max time kernel
87s
max time network
131s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
27/05/2024, 10:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
78e4741dcbd626b1ec3fee0a18356f6b_JaffaCakes118.apk
Size 6.6MB
Sample240527-ms95vagg6s
SHA256 bd9a234fa2f6ea6bff4b047052dc7dbce39c94d418c14c4181100101f1d59a36
MD5 78e4741dcbd626b1ec3fee0a18356f6b
SHA1 1a5333ba00fcd9cd18d2c2f4d7a8accdf402f449
SHA512 dd1325f8c47eeb5c569f8607e399aa0098807c5ea0a56ded8d8494d45d1d8fedc36bb7046a62450a7233c57ce43948563a4ef155b846e0010e03fc0e0336e432
SSDEEP 196608:0WQ5zWlKPwKVu3oEv7QS3AtubC9bjfYLU:ENwKiokDQ0ChDB
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection credential_access discovery evasion impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.danestaniha.org

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.danestaniha.org

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.danestaniha.org

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.danestaniha.org/cache/1582435991586.jar	5122	com.danestaniha.org

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.danestaniha.org

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.danestaniha.org

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.danestaniha.org

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.danestaniha.org

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.danestaniha.org

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.danestaniha.org

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.danestaniha.org

com.danestaniha.org
1⤵
- Checks if the Android device is rooted.
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:5122

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

1582435991586.jar

Path /data/data/com.danestaniha.org/cache/1582435991586.jar
Size 9KB
SHA256 f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce
MD5 e8e0527a01aefdb89afd2c508f131da1
SHA1 f1103e6b260c657ceb3d95f1b023af3fda8b133a
SHA512 fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34
SSDEEP 192:uGJqbQwgQYuNUnEV4bAa0s/ombgmdxjX5fGpTVHb3qX:LkMwTTNdlns/ombJB
MD5 SHA1 SHA512 SSDEEP

Submit Download

journal.tmp

Path /data/data/com.danestaniha.org/cache/wallpaper-cache/journal.tmp
Size 36B
SHA256 7080cb592d5149c858b206d3fd0d5e3e7d601f120af00b2616bee928ee1291ca
MD5 37e8e716e0e2f4a0b05cd9571d95b84d
SHA1 f8d068f6931707bddb8cd69f706f2224ad1fea3c
SHA512 e62b850901835fdb73fa6224618422f721dd765861d42f6bc2dd013413e96bd910ac5313afd9b4f63da74beb12a15fac81b5157456c9caa3031862dab84423f6
MD5 SHA1 SHA512

Submit Download

google_app_measurement_local.db

Path /data/data/com.danestaniha.org/databases/google_app_measurement_local.db
Size 16KB
SHA256 a7f53e525d896c4820b925abd89f674fd5dd09de5b32c77a69aaf19dd6efaa38
MD5 7637fa900d29d6e7df8beb3551adab1b
SHA1 06317a0ff889e0f60e499fd27d4f2d3d5b1580e3
SHA512 8bb374aeb0ff99d53fe4ab8a346daf6e9d92f9385f34e7dd7a63dc446a199f43dd317f9b25d8b2217408678fd7eef5babac51b5adbe06c234e3ca75019b72f78
SSDEEP 6:l9bNFlsls1ylO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/WNI:TLiEy9zmzrfRmBEyPbP/WG
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.danestaniha.org/databases/google_app_measurement_local.db
Size 16KB
SHA256 ba17ad625992d120a51dab586a568dc7cbfab4ff41e84d7050ddd90bc424e6ef
MD5 15454e33c4e201b7bb49783c9e999710
SHA1 e601c8577e4e16d30cf55499a73d63520bde163f
SHA512 2761f06d12e66a8118c0105d1eff23cd66242efa37c59d2125385462cb5dbfc3f41118f567575a241153c1f71d57985bbe440bf024d7196f0f6111b9dffe53ab
SSDEEP 12:TL1Ev9zmzrfRmBEyPbP/41v7v2FyB7wU7UyWlSi2l:TLQpmzr0GSP/4v7OFMZ2Qll
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.danestaniha.org/databases/google_app_measurement_local.db
Size 16KB
SHA256 437abdf60557593e5da3f1b59b95b35f44fdd86aa31c49d8e7802a9210d8d61f
MD5 a0ff4dd177f83551ec655d8102d0c639
SHA1 66414ea5a163790f5d2cbfa5bf03739d672d9ede
SHA512 d09f260fbe59504052d911ac907efc5e9ea023c361e38007bef5bfbcbce8cde562f579f74348d6922354f4fc4b56e700db65866f006411ebe3467f799b7832cd
SSDEEP 6:l9bNFlils1QvlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/W1/4:TLIEQv9zmzrfRmBEyPbP/Wm
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.danestaniha.org/databases/google_app_measurement_local.db
Size 16KB
SHA256 08256fcdcffca7bcbf53e2a86bd50553a6e1780916a909920dcae2c9d815c399
MD5 e1b99272625b81f7e935766330d7ac0b
SHA1 7bbfbf340d16f649b8a09c703e8233b7fb3612e0
SHA512 feded2fb9aa80b77d192fe48c202e4441d94a4eb823d0b3fb593ee72548a6002576d8977d5219d47101026c919c9c8e6b4ac07006df940fbe966e8f6f846b19b
SSDEEP 12:TL6uEp9zmzrfRmBEyPbP/FWqOLaxtv+o1GtYwU7UjU5EWlCuUyWlbriSA:TL6Xpmzr0GSP/FWqKaxMJtYZ+bFrC
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.danestaniha.org/databases/google_app_measurement_local.db
Size 16KB
SHA256 e0f45a044829118e58e38ee1432a99c089edc86809547415b02820d3d18594f0
MD5 a08383badb84189552e88396c47f343c
SHA1 e9ee231e76e1a90954e204ec5f330454374bfd5a
SHA512 e3b7cb371afe48ec8675c284e4a78d750c275c8aca0b9ba61bfbb960f1d3783707db26948cdd9503cad7ba8ceb8a72400e39028fec349cd95b6dd5e42b67f831
SSDEEP 6:l9bNFl+ls1cvlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/WNtl7te:TLMEcv9zmzrfRmBEyPbP/WFt
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/com.danestaniha.org/databases/google_app_measurement_local.db
Size 16KB
SHA256 6c2f64fcf116381f744fc285fe495c70b72a424c89e6e6531ec9cbd92cec27be
MD5 7f947029738c36eb5689091a8215d0c6
SHA1 df52524113b45335dbd0158c3f0f38465f1a343a
SHA512 bc583275c60653e374775e38984cb89412f1db745dae95d77892b9ef4df0feef49b1bc2513b613e76ca903cab92bf605b9cbeb0e114cee53bceb92b0f842891f
SSDEEP 12:TLWuEOe9zmzrfRmBEyPbBvOwmYRhOLavnOAU7wU7UyWlSiC:TL5epmzr0GSNLRhKamNZ2Qb
MD5 SHA1 SHA512 SSDEEP

Submit Download