b07eeabbb40904cb6f912029fd2b99b8dd0120f966cf3c0ed8502fd4af2b28b2

Analysis

max time kernel
13s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240514-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
submitted
29/05/2024, 07:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7ff41b5ec7f4ed62f5dd34e2a3ec4d12_JaffaCakes118.apk
Size 10.5MB
Sample240529-jemwlsfb8v
SHA256 b07eeabbb40904cb6f912029fd2b99b8dd0120f966cf3c0ed8502fd4af2b28b2
MD5 7ff41b5ec7f4ed62f5dd34e2a3ec4d12
SHA1 c7be5a08b6430d457a4dda9deca944831ff5820a
SHA512 6e28b6cc33e0052fbdfc22015266440c09e62fa9e44da765b437893e3129f36b606ca65d46c30d006bc88790f6ec2fcf5e0499bd58ed669ba5c74882a4f0a179
SSDEEP 196608:iQWSu+XqvSxuV56UQvOt1N1m8URn/s3vHdEMthpr5VGjsAJ/kuIsQI8mNCoXneTK:iQWSTxaYOt1N1QR/efHpr5VGYAyjIbXB
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion impact

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.blueskygrid.flower

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.blueskygrid.flower

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.blueskygrid.flower

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.blueskygrid.flower

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.blueskygrid.flower

com.blueskygrid.flower
1⤵
- Checks if the Android device is rooted.
- Checks memory information
- Queries information about the current Wi-Fi connection
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4565

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

map_record.txt

Path /data/user/0/com.blueskygrid.flower/app_bugly/map_record.txt
Size 38KB
SHA256 6af1263a9f103c5f40296501f170f1cdd65b47e896a79d7b6911b673bf52ea50
MD5 1d0e361d1d3cfc9b091d8b388c4836e6
SHA1 893d61ca97fcdd0d5df22c9be9f28b938b3c17e4
SHA512 b253c352b372cf26fda8857c48d2788fb4f561cb363aed8f918449c6e74e5fcb97a2508096983ef1dda3bb4f5264d37caa34ccadc350ea77f177441f20b535f8
SSDEEP 768:NqrmZMetODZdZaZ+y83YcWE0bZSuaYuBcKE3YBgR6bJf53AAUfU1:NZYDZdZaZUiuBcKE3YBgR6bJf53AAUfG
MD5 SHA1 SHA512 SSDEEP

Submit Download

reg_record.txt

Path /data/user/0/com.blueskygrid.flower/app_bugly/reg_record.txt
Size 605B
SHA256 99688486f4f86af2f7017e05aa1af917e17ab0f6d25c02f408be266dc11cfac7
MD5 eb39412b5ebf7cf307518aaed9146859
SHA1 4cf32ad2c79599f99fd661e3813f068426dbbd1d
SHA512 c313dcd186569889b4c34764f6be3b619eb82453926123a1d33148c341f62f8c5225e3a0ff4ce7b9148da74b13b1037f757f175491ad77a0012329e991c6f67c
MD5 SHA1 SHA512

Submit Download

rqd_record.eup

Path /data/user/0/com.blueskygrid.flower/app_bugly/rqd_record.eup
Size 29B
SHA256 12eb72ff09eef9137e67ce8f0588607a28976e0e082b80125f7ff572405a582e
MD5 5ec758aba3fc538354888e38ac5ed313
SHA1 d35b6573d25b6e282a680a4ffe9ccfceebec74a4
SHA512 13e094ecf0cad0cec897853bd3fad125b5ab07db68652cad4affb1b03da9d50a19815b268361a45543205cd54774148691a3433abb075a48ef0c846dae73ccec
MD5 SHA1 SHA512

Submit Download

rqd_record.eup

Path /data/user/0/com.blueskygrid.flower/app_bugly/rqd_record.eup
Size 683B
SHA256 beeb54bd71fff5a643e109ca789183285bf862758221ddfe40743847f6104d42
MD5 cd9dcefcbb4730febb067cfea31076e3
SHA1 b40e7c2e86ad855b583a4efec32d1d11d719c728
SHA512 64297e7ab5bf1c35835772b17a2ce9f63673dacf80d8512025b1bac1bd982b154aa07562db7b763a9c9142f907e6e52bda280f0ee281054260840d75279082cf
MD5 SHA1 SHA512

Submit Download

rqd_record.eup

Path /data/user/0/com.blueskygrid.flower/app_bugly/rqd_record.eup
Size 1KB
SHA256 c19dc11982c34c27acf62f0d4f4a51c264c28619277a80525690aac2ebf452d7
MD5 845a5c6aa4c87cae9c47aaad17e8ba3e
SHA1 6ada6658654dde105ad0cd06dec231e459428ee6
SHA512 96cadf855acd0a261d7b25f14c7d5de3a805c43ff197aa91ff3168a6e0bf1cd985e117641154ee13de6a1af5e0a880df0f1fd2baf85b342f0e5f47b0f2895308
MD5 SHA1 SHA512

Submit Download

tomb_1716968119562.txt

Path /data/user/0/com.blueskygrid.flower/app_bugly/tomb_1716968119562.txt
Size 1KB
SHA256 34674898d7b1ed340786f97fd95ed02237938f70a79c758b56bf93cd9a41409d
MD5 6e61cc67498f1daba57be3eb2db21b85
SHA1 1c75e9a491e00fd8d583215931b90e97bb721918
SHA512 65b95eb1d079ac541b7ab3d9c2d1ed63e8263b2b60c6d6bc087c82409e7dc913dcbf38af404a833a95f5a469fcb4cb21913949fda7d01420f1468cc84a253d6c
MD5 SHA1 SHA512

Submit Download

tomb.zip

Path /data/user/0/com.blueskygrid.flower/cache/tomb.zip
Size 789B
SHA256 be06995ba37d3d434fb9eab09f286ec23063f20f4ed0f6f34cee463383433e78
MD5 17c82ca443618fcea392f1249014ca5d
SHA1 f4dfb8debf62286b69459f352124c826d67a5c0f
SHA512 b29e11aa201f07ba450c67115e21d1518351f33dd4e6855ec4c0c9539d7036403b90afe438037b227b4664bc152d85f4ce2bd8475944452f6d7611d3f5c2479d
MD5 SHA1 SHA512

Submit Download

bugly_db_legu

Path /data/user/0/com.blueskygrid.flower/databases/bugly_db_legu
Size 140KB
SHA256 962d8aa81e04036076a7ca107cb6ba1aa5740a0fcdf7aee24457179e8c7e83aa
MD5 dad7b4596f2176581030521132fd7b28
SHA1 a59c6ed0d271094004c12d8a1eea7285e721c5ec
SHA512 421dda711fb9bbceec45fc82b437105f91108bf149873c9e46384363b578b5fac380895db322c6a76ba61d28743c6e2e649102e200c90c0c81c92bc84e0f5281
SSDEEP 768:igbcKericsybdBWdcbnKVFLIKgqNnFT5HHNFT+XM4f4ti1FdBadbxoLY94QdBIdj:i7XDQBtyM40
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/user/0/com.blueskygrid.flower/databases/bugly_db_legu-journal
Size 512B
SHA256 b302be7116f474bcd1578a17325fdbf5b3044abec5b31988905b05e85f7f3852
MD5 40c1ec90051edb72c43e6f368af2986f
SHA1 07165e329ae661ab74d627ce62636276b8b94193
SHA512 f09dffce30eca7e56f8fb3dccc0ea9574559939a5171065e1932bfc4e3c834af1373d9c7e56c9481e24a94fbb093cfc9bbbcba232c7de1dc3fede98fd9d5ccfb
MD5 SHA1 SHA512

Submit Download

bugly_db_legu-journal

Path /data/user/0/com.blueskygrid.flower/databases/bugly_db_legu-journal
Size 8KB
SHA256 ddc580cfb7602d8f94b4188628faf34cb907443efa8d447dd4fff5c77ea9ef1e
MD5 85ddc742720099b9747d5b0e28cd79b8
SHA1 4a61292294da6532e2ae8c4c936fe8abc8e2d532
SHA512 4dca6a71970cb85f5999a68540205ad6a0bd3e83b8cf5cdb9ecb6748608e8606a0a60aab15d7b578ba3d45ecfcb506b63c25cc87169d919f1ee38ae5ad0da734
SSDEEP 6:7+/l9Hn1vMvg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKx:7+tkqLiuWdYRmBEyPba
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/user/0/com.blueskygrid.flower/databases/bugly_db_legu-journal
Size 8KB
SHA256 4f4892009dc27743ebcefaaa0c77f8faa0f703c119b5ce7d857b5e615af6c325
MD5 02648701cad9345a4f3dc07d0b8f5728
SHA1 daddd2b51d62741b6e8f2c00535dbb3e11448101
SHA512 25e4c1d43a2c6aabf227dd6b115c96b5abfeb3870ff3106e5afafd9f10e1d93689afa2fb2f77dec73526e45a78408932a8689493c02a5f1ca5342b0566bc089f
SSDEEP 6:7+/l9X4Pg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKgVM/ak:7+tZwqLJdeWRmBEyPbLVs1
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/user/0/com.blueskygrid.flower/databases/bugly_db_legu-journal
Size 8KB
SHA256 bdc6305c9b90e11bafac06c6cbb96c36602c8084f68eb65edc3e739dbc240043
MD5 0a2ba87d852ceec3112186a3986c1dcc
SHA1 7298e88841d9d62fd380d739f388e5659ef190bd
SHA512 0b31eed4a148ba75a735bbcddf16fd0b4e359e2ec07631f4a0e6ae2e643ab1e4fcc08310ce962cdf5b1346ddacac1c59a98dbf90a73cb300a7236a847687e8d2
SSDEEP 24:7+t9qLTtrrqqn26VnrQiVicXX+MgeRKkYBg72m/mpLwBpGSD:7M9qVZfrQiw6uMg6/YBg72meposSD
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/user/0/com.blueskygrid.flower/databases/bugly_db_legu-journal
Size 12KB
SHA256 8be17930631ce7bc5979479866f20318cbc1b2ecb063e64c9cee41ab12f6823e
MD5 332f28f83b54b80090e8353a8c37b171
SHA1 782e5e00f2298931e9064fb5d35b39e06dccc9fe
SHA512 60b2eba5c2f3b24d6bfadbc7b228a1528754768cc6d8d8fe8fdd5c4ba2c3aff53502dcd12b15fd972b32dce0b8c67d9cd83cbe5fd7f35f6d77e7103bf7b8c9a9
SSDEEP 24:7+t6WVqLMvtYrqqn26VnrQiVicXX+MgeRKkYBg72m/mpLwBpGS4:7MFqlZfrQiw6uMg6/YBg72meposS4
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/user/0/com.blueskygrid.flower/databases/bugly_db_legu-journal
Size 12KB
SHA256 232424d14faa74a2e37fddb30e915222c8039cecfce5d8af1e599d1b3598ab34
MD5 bb7d05bb14352abd217cb7fc8cbba58e
SHA1 013807c28f735a6535f5699d23ecf542075ebe23
SHA512 f860f67654d4651be1f207a250cbfc179f219346610661bf13c013ea06f13af3cb975cc460658add434a8dad0d4cbb59b52b7131710797f8ff57b21e48cc37a1
SSDEEP 48:7MgqMZfrQiw6uMg6/YBg72meposSFT9oXL0Z:7th4m7A6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads