7164b77bb97e96b5900dc8468c70dedd5e3ce4957f9e2356cb4e58461f005808

Analysis

max time kernel
13s
max time network
129s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
27-05-2024 18:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7a1fd6a1963e284dfe2a5ac72c20f3da_JaffaCakes118.apk
Size

827KB
MD5

7a1fd6a1963e284dfe2a5ac72c20f3da
SHA1

8efdfd37fadfda4a840ea0f3068fbcb8a844b672
SHA256

7164b77bb97e96b5900dc8468c70dedd5e3ce4957f9e2356cb4e58461f005808
SHA512

a580a6db0c1ae1d2b043ed68fe4bea059d4163a15b03518e592070628e1510587383f3b7fcef10e0e607699a0836afa85369d20722207d9aa8c4b2428c83f5a2
SSDEEP

24576:6kQlRHrE4n4mJlzG7nRHe/E0W5rD2hWbzC2:BQHQiTl4HesT5X2haO2

Score

8^/10

discovery evasion persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs
stealth trojan evasion

Suppress Application Icon
T1628.001

Processes:

com.android.services

pid process

5235 com.android.services
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

com.android.services

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.android.services
Acquires the wake lock 1 IoCs

Processes:

com.android.services

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.android.services
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

pid	process
5235	com.android.services

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.android.services

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.android.services

com.android.services
1⤵
- Removes its main activity from the application launcher
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
PID:5235

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.android.services/databases/bot_starsds

Filesize
16KB

MD5
7a3ffba00ee513b42199aa2492940457

SHA1
39629518c2a73154be32d67146f83aa85985e522

SHA256
930db1f3ee1e84e526474623f2d095454ee9d1ae505925af4c23bf65181795b0

SHA512
afc87ac64b07c3af91eff1aee784e692cbe7df1d8b3c8c85b225b543765e5b69e6f46539570fa95571b8cbcf25e55bc77b08a4e974ed350c328e0a1a63c74ec3

Download Submit
/data/data/com.android.services/databases/bot_starsds

Filesize
16KB

MD5
9ccbc8934c167495ce716a78dcdfff24

SHA1
d567bdbde22e0159422294e8fc2b6544717a5ef3

SHA256
a0109a74db9de9b85ec5253160f6deaa79e9704b1fa3a69b05add68f44056e28

SHA512
7223a2d660d30ef16f4b8c8c45b97631c662c22a084f0118c556c4a3ae75cee7ed96c6b37fe5033097d55db4133790a6f29f1ab3087d4214ec88930bfb16f7cd

Download Submit
/data/data/com.android.services/databases/bot_starsds-journal

Filesize
512B

MD5
f6cccc90705597129bff95d6b44fb808

SHA1
403142306bcf18d4f52c59cbea19dbbd50f09d42

SHA256
56a8169c3e1f32a40dfff68786f1cef84da885db454ead5ad6100bdb636207a3

SHA512
1a0aeb2d7e673544fedf656abff9ef27db2dd2bdafe42aa9b159aa57a60be608d74325aae5362a22b21ce2c253d5f3cce88d7b5e415b02c9a348c2912a4b5877

Download Submit
/data/data/com.android.services/databases/bot_starsds-journal

Filesize
8KB

MD5
415593a41d446c481dc91fda04c73868

SHA1
4514979bc9930c1b79a7f4b8affbd31e8de1c333

SHA256
61d28d0d9d6a408b3c69f9c0e91d41dd264d9e7fe40f80f2c2d37017ef368cf0

SHA512
f825522bc0eb960ba95c3c92ef682bfd502d9cef3762df1d6abf4a2ad2c9073e3e973a4f5eedd5d82d9f2ec9cc81e7dda729b408c6f5f076694599e37494e569

Download Submit
/data/data/com.android.services/databases/bot_starsds-journal

Filesize
8KB

MD5
913b5943b67dfe743abf014415db295e

SHA1
33ff8bd78979c9a0e0eff09d0c52729097259703

SHA256
ee24f231d69451fd2cea04aa6576a0d5b605fdb7f5c44a15f9aa1a75bb669099

SHA512
1d4fbf000b1a15593c5c25b8aa80281bec1dd7797f980def1b491df0e235833e6b6c8b24d90899303d83c7c517745eca719f54257eebdffd6dfb854993ea8276

Download Submit
/data/data/com.android.services/databases/bot_starsds-journal

Filesize
8KB

MD5
4169c3541830b35cfd7eb0a700e672e4

SHA1
d879eefb1f323fb786fde59ecda9f0ea706c371d

SHA256
d7a4c7ad0b9459524b69da7adef8d27ea5a57ba9f95d0e78153732e9b5c8b9b8

SHA512
2ad876d75659e72a9cce7917852c8faf46dc6f2ba64f5991365aac8fe892573cf6a4accfbfb0639d79e42bf89ea642db967591125a3461f36393921581b18129

Download Submit