7164b77bb97e96b5900dc8468c70dedd5e3ce4957f9e2356cb4e58461f005808

Analysis

max time kernel
13s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
27-05-2024 18:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7a1fd6a1963e284dfe2a5ac72c20f3da_JaffaCakes118.apk
Size

827KB
MD5

7a1fd6a1963e284dfe2a5ac72c20f3da
SHA1

8efdfd37fadfda4a840ea0f3068fbcb8a844b672
SHA256

7164b77bb97e96b5900dc8468c70dedd5e3ce4957f9e2356cb4e58461f005808
SHA512

a580a6db0c1ae1d2b043ed68fe4bea059d4163a15b03518e592070628e1510587383f3b7fcef10e0e607699a0836afa85369d20722207d9aa8c4b2428c83f5a2
SSDEEP

24576:6kQlRHrE4n4mJlzG7nRHe/E0W5rD2hWbzC2:BQHQiTl4HesT5X2haO2

Score

8^/10

discovery evasion impact persistence privilege_escalation stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

Suppress Application Icon
T1628.001

Processes:

com.android.services

pid process

4274 com.android.services
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

com.android.services

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.android.services
Tries to add a device administrator. 2 TTPs 1 IoCs
privilege_escalation impact

Device Administrator Permissions
T1626.001

Account Access Removal
T1640

Processes:

com.android.services

description ioc process

Intent action android.app.action.ADD_DEVICE_ADMIN com.android.services
Acquires the wake lock 1 IoCs

Processes:

com.android.services

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.android.services
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

pid	process
4274	com.android.services

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.android.services

description	ioc	process
Intent action	android.app.action.ADD_DEVICE_ADMIN	com.android.services

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.android.services

com.android.services
1⤵
- Removes its main activity from the application launcher
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Tries to add a device administrator.
- Acquires the wake lock
PID:4274

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1626

Device Administrator Permissions

T1626.001

Defense Evasion

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Account Access Removal

T1640

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.android.services/databases/bot_starsds

Filesize
16KB

MD5
71892b9da2596d8462629a9641128514

SHA1
09d21de59e1b64b6650cf19cde6fd1c751caa6b2

SHA256
00c8f482258fb519c11042083b75044a097c3550af43d125641ba1abc6920aff

SHA512
7f70091d8885ec69ff434a26b8eea3b29a66507d445e7848b070c322ed6547349e953915b8113dbf856b6ff2921517a0ef0852d2d866ff909047c1b3c11f8ae1

Download Submit
/data/data/com.android.services/databases/bot_starsds

Filesize
16KB

MD5
23da1c4d966fe65f7f9b82db14032299

SHA1
5ef00cdf2481889c7869a22894b1dbd1963cc6fd

SHA256
3b26f4391998ce93c55673ff29ba0efc567978729ee94309559a1c0338b47187

SHA512
2b9dacdecc7554c6d3aa1b3d7411c632f0dd066c77f2b3c39974c5335b7b4f94cf6b08306e8078cf29fc012b065b4fdead8382df293b675ff865eb2cb417896f

Download Submit
/data/data/com.android.services/databases/bot_starsds-journal

Filesize
512B

MD5
1ef0421af97d272440b88e782129f902

SHA1
4b93268ef8f9840ca89206d8daa549dcdd70e99b

SHA256
44bd2fd60e5cebaa4b86ecd7cb4d715102f3193b9ae15897f6fc0dc362d465d0

SHA512
201b49d69d5ab6e103b0ebeaba6b2cd2246f427b9af8800f178eb357afe709dcf0a7659becd0fdcf856587f370eae1506ec9b6141129df2ad5c39e5810e09bf3

Download Submit
/data/data/com.android.services/databases/bot_starsds-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.android.services/databases/bot_starsds-wal

Filesize
28KB

MD5
7f2e529d8a3c82c9087102387374ccf0

SHA1
0532372416cf3d3260498ea2956b2038e9870f21

SHA256
4b63bd451bcf85e6b8907e31d9ecc0fbf0f4cdfba419adc5aa2a5a2443d2bda0

SHA512
3df411ba61e4e1bae887e05884a5105317d3cd9bc263644222726a0488f5f5e2c4dd32ecec1e052fa4b87c9992e159ed7cb24014a53ba54dc7018a60caf37973

Download Submit
/data/data/com.android.services/databases/bot_starsds-wal

Filesize
4KB

MD5
f4ff0ec287edb2e6c8f89708cac57b35

SHA1
0ab47f25407ffbf5320a71abc412d935c1b2e73f

SHA256
028c9af5a80dac46e8cc7b51322e38950d8c7928e722aee3772715a4ee056dac

SHA512
46e15b27386262d91b061c17f2b68b51cf17be1bcdbf7d4aba3cd51dc91f878701d7116b228e48e1db6f049df5eba556aabe2587925b5e8e57a8c3621f578f5d

Download Submit