bd9a234fa2f6ea6bff4b047052dc7dbce39c94d418c14c4181100101f1d59a36

Analysis

max time kernel
58s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240514-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
submitted
27/05/2024, 10:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
78e4741dcbd626b1ec3fee0a18356f6b_JaffaCakes118.apk
Size 6.6MB
Sample240527-ms95vagg6s
SHA256 bd9a234fa2f6ea6bff4b047052dc7dbce39c94d418c14c4181100101f1d59a36
MD5 78e4741dcbd626b1ec3fee0a18356f6b
SHA1 1a5333ba00fcd9cd18d2c2f4d7a8accdf402f449
SHA512 dd1325f8c47eeb5c569f8607e399aa0098807c5ea0a56ded8d8494d45d1d8fedc36bb7046a62450a7233c57ce43948563a4ef155b846e0010e03fc0e0336e432
SSDEEP 196608:0WQ5zWlKPwKVu3oEv7QS3AtubC9bjfYLU:ENwKiokDQ0ChDB
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection credential_access discovery evasion impact

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.danestaniha.org

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.danestaniha.org

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.danestaniha.org

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.danestaniha.org/cache/1582435991586.jar	4664	com.danestaniha.org

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.danestaniha.org

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.danestaniha.org

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.danestaniha.org

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.danestaniha.org

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.danestaniha.org

com.danestaniha.org
1⤵
- Checks if the Android device is rooted.
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4664

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

1582435991586.jar

Path /data/user/0/com.danestaniha.org/cache/1582435991586.jar
Size 9KB
SHA256 f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce
MD5 e8e0527a01aefdb89afd2c508f131da1
SHA1 f1103e6b260c657ceb3d95f1b023af3fda8b133a
SHA512 fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34
SSDEEP 192:uGJqbQwgQYuNUnEV4bAa0s/ombgmdxjX5fGpTVHb3qX:LkMwTTNdlns/ombJB
MD5 SHA1 SHA512 SSDEEP

Submit Download

1582435991586.jar

Path /data/user/0/com.danestaniha.org/cache/1582435991586.jar
Size 20KB
SHA256 2897b0812077c654a9b3fbb0b6303d5cde681eeba7ad9981de65716c7810d685
MD5 fde2ee00cbd121cfab5290b078aa3ceb
SHA1 e2b77d5320e155e413d040a8c20020962065b2f8
SHA512 a9326aff8e454a2b4ac09984ef2a65fddd4dc146b4c44d839035549bff8c9fdaae490326d0b018f76c1ca2e4fb25426d74f550ca0950982fba632a023af99a56
SSDEEP 384:Za0jn+huC5sMvRuvypj6f2ZzJgm+poK+l8m4qxXpj/7wyxBLBiok+9VQ3AKm8:ZU5sMvu/f2/gm+pDAPzj/Dip+9y3AK7
MD5 SHA1 SHA512 SSDEEP

Download

journal.tmp

Path /data/user/0/com.danestaniha.org/cache/wallpaper-cache/journal.tmp
Size 36B
SHA256 7080cb592d5149c858b206d3fd0d5e3e7d601f120af00b2616bee928ee1291ca
MD5 37e8e716e0e2f4a0b05cd9571d95b84d
SHA1 f8d068f6931707bddb8cd69f706f2224ad1fea3c
SHA512 e62b850901835fdb73fa6224618422f721dd765861d42f6bc2dd013413e96bd910ac5313afd9b4f63da74beb12a15fac81b5157456c9caa3031862dab84423f6
MD5 SHA1 SHA512

Submit Download

google_app_measurement_local.db

Path /data/user/0/com.danestaniha.org/databases/google_app_measurement_local.db
Size 16KB
SHA256 9ddd6448554e05f109bcab74eb63c20ebd9612a1b88f701563419c914cee2298
MD5 d58a21dd780cee548cbdef81d20d793b
SHA1 fb37e340ad370858604de5cafb0d7885aa9d691f
SHA512 8fcdbca20211f084c65214eea093bd8e5ffa24577193c030468f27064df1b035312fb79b36e344b3592ff845ab3f343b080e5fbec27e46f553fc368ba4091baa
SSDEEP 6:l9bNFlsls12tnlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/WNI:TLiEq9zmzrfRmBEyPbP/WG
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/user/0/com.danestaniha.org/databases/google_app_measurement_local.db
Size 16KB
SHA256 1944fa289c21d97d26126b25c1e3ef5b4beb725208de7cbcd09e206748a0ebc1
MD5 f6de0f5fa378891de151802305fb13e1
SHA1 16f194ec88872dd8c610ed7995155d166d54a514
SHA512 ee046019913cfb6714e3e19ca3b4b71657ae0bc120cc6d3e17be29b895724297b25e7432bd1aa6393eecb68fcca5ab126d355a2863903437b12485ec9c561a74
SSDEEP 12:TL1E39zmzrfRmBEyPbP/41v7v2FyC7wU7UyWlYIN:TLopmzr0GSP/4v7OF1Z26q
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/user/0/com.danestaniha.org/databases/google_app_measurement_local.db
Size 16KB
SHA256 8219abc6866a8b5e0718c308a91c6629ca5d534b5daba02ee5eda393b3594ee2
MD5 f481668c493326f04c986c1cfab248ff
SHA1 f5c9c802971bb1b900e3319b2a329448ae4722dd
SHA512 7cea8dfd923f4b0d993d859e4e525001e7b3364f3d1d4aed32228c7aa6ed8436066fc6ea3f350dcc2cc0ab4311d89ed0d81e1275d7f36f00d6c0c6456ee2207d
SSDEEP 6:l9bNFlils1InlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/W1/4:TLIEU9zmzrfRmBEyPbP/Wm
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/user/0/com.danestaniha.org/databases/google_app_measurement_local.db
Size 16KB
SHA256 c1a4b9c382be4620b16f119d317098de57cb47c7cd2203a945d00f9988829231
MD5 1de2b3e73c96f3c60e5a9c8160b08a57
SHA1 dc629235116579b25e1c6d7e1040006bab111c83
SHA512 ef6b53f5b7e84f22fb4532d1ce516353ee603b4cad8a13078b104649465c0abc928c6cff451b133987fe5c36b83fafb1482bbf185fcd17eb3f8fc6b334259cf9
SSDEEP 12:TL6uER9zmzrfRmBEyPbP/FWqOLaxtv+o1GtYwU7UjoEWlCuUyWlTIj:TL6vpmzr0GSP/FWqKaxMJtYZabNk
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/user/0/com.danestaniha.org/databases/google_app_measurement_local.db
Size 16KB
SHA256 b0ebd9c8faaa307f7d44b2ab871c31b8170d10c64061219b19dbe527a0e215e1
MD5 a6e0f464e1a073e9c3370ec3b4a79e45
SHA1 861c034c2d891e7cd4580d47109727dcce0ae544
SHA512 f88e4750d1cc8dc51d72382eebef5f0f48b1e588d210b9af023faa5dd7519b329b725a965e33b6ee805bc70217a58e7744221903ac5fdb0022449e7b0a4290b8
SSDEEP 6:l9bNFl+ls10nlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/WNtl7te:TLMEw9zmzrfRmBEyPbP/WFt
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/user/0/com.danestaniha.org/databases/google_app_measurement_local.db
Size 16KB
SHA256 c90c479b25824e1259d22ddb93d6c724ce694132dbe64ad8de3e65194c1b52ad
MD5 39ca0b0857b4d5d0ea6fa9a346d77d21
SHA1 b4b191f2a48aa5001a6a40ac12566a255039796b
SHA512 dd6c55e7e3b1fc59b00f7f0e8d3e2e70979c8a786a33d4bd2984a410549004575b436ddf27cc8628a9565251bcc10d5c7f307a257af1c1e64539e65875a9982a
SSDEEP 12:TLWuEmO9zmzrfRmBEyPbBvOwmYRhOLavnOAU7wU7UyWlYIm:TLROpmzr0GSNLRhKamNZ26B
MD5 SHA1 SHA512 SSDEEP

Submit Download