8ff32ca0ab0d2a6d5e0c9a35560c9aad9362791120ad8823da427cad8380d693

Analysis

max time kernel
178s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240514-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
submitted
30/05/2024, 00:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8292a35553c0f6648b609b5a21861a01_JaffaCakes118.apk
Size 785KB
Sample240530-bamfaahd53
SHA256 8ff32ca0ab0d2a6d5e0c9a35560c9aad9362791120ad8823da427cad8380d693
MD5 8292a35553c0f6648b609b5a21861a01
SHA1 559d270213258482bef31fc4771819d0392377a7
SHA512 37e4de2a6145fb6451b1c741f92a52fd579a6a356ccd5e81782b46842ed72bbccdc87ee4843674a730f12be20369d30cbe5a81f378dc4ac3a5f72d5c318ac51b
SSDEEP 24576:CH64RIpF08BP0ksnclFapqeLO34nsOkb5jf7fHWLhRR5Bf0ZDg:6lU08BP0ksncjapqeLOInsOkb5fDIhRT
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection credential_access discovery evasion impact

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.app.wifitransmit

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.app.wifitransmit

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.app.wifitransmit

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.app.wifitransmit

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.app.wifitransmit

com.app.wifitransmit
1⤵
- Checks CPU information
- Checks memory information
- Obtains sensitive information copied to the device clipboard
- Queries information about the current Wi-Fi connection
- Checks if the internet connection is available
PID:4610

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

cpwifi.db

Path /data/user/0/com.app.wifitransmit/files/cpwifi.db
Size 24KB
SHA256 06ded4517c5fbc9c7211d1a47b8e6f93355e8c9a1ca856b8f01068ce3c987bfd
MD5 71908757e83874534ecfef79fa1171d7
SHA1 65d53daefa954feb5605ee1ddbe6f802ce82bb97
SHA512 fbf529a24e93ef088f77221a71c2cc7d5145b8568727c719a3c7f079a6459da6f6cb686ec6e3d430fd2a2dfa3c78368e8070272bfda435951b76cce8fe33988b
SSDEEP 12:TL/2abUOZxruNTSFbyKogAbrU4SwPMrfRmBEyPbD3OwGQ:TLsOTrusogcwMbGSzGQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

cpwifi.db-journal

Path /data/user/0/com.app.wifitransmit/files/cpwifi.db-journal
Size 512B
SHA256 5e7ae63563dbef88dba9c027b4a708f44ffc8d7ba82362bc7a3a49bf73ea8acb
MD5 793d204d8bfc65dd3897db644f94cd72
SHA1 77e20d75f694e0beba6c82e0114d1266c2f40b84
SHA512 28afe5772bdb0e02c3932ed4512b10f47c727f6c61a3acdd2d842f685ba431a82bfecb0b33830bfdeee805067ed7c88a3b14ef10c21b16f6fa0a838da75400e9
MD5 SHA1 SHA512

Submit Download

cpwifi.db-journal

Path /data/user/0/com.app.wifitransmit/files/cpwifi.db-journal
Size 8KB
SHA256 8e6ec284dcd610d662c064ef4fe0b261d87508e5e186bac3e275194b1df1bc70
MD5 ea3bcb44d974e7a5d19069aa044312dd
SHA1 28a5a0000b9b27bd7a197f097ecf610b120604eb
SHA512 ba7dc58af5a7d364592f4131328a0df883d83913181b5db79a31285d70278c1d4426c6453b62bfd74679e618e0b7caaa070fcb807cb257011b16f1dfc14a7952
SSDEEP 6:7+/l997UHn1wWg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKo:7+tzoBqLiuWdYRmBEyPb/
MD5 SHA1 SHA512 SSDEEP

Submit Download

cpwifi.db-journal

Path /data/user/0/com.app.wifitransmit/files/cpwifi.db-journal
Size 8KB
SHA256 b52de825cdd9dfaef61ff5e154baec712638292993dd34a1d55c5c6df051cda4
MD5 6f44b4a1133399846be1eb5804ea141e
SHA1 8db10808f6aabdbe5a7a15dbb6553a7471ddc979
SHA512 123b61bed85cf591e3a1dc98605311a3bd47d6dd166eb2d063f0351567f7bab7982e8bc9b732b57c82cac52128dea48a8bbae71fd5311c9d54e7fc925f2072e3
SSDEEP 6:7+/l9zIPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKoE/B:7+tRAqLJdeWRmBEyPbiB
MD5 SHA1 SHA512 SSDEEP

Submit Download

cpwifi.db-journal

Path /data/user/0/com.app.wifitransmit/files/cpwifi.db-journal
Size 8KB
SHA256 3f82aa369cea4cbc9e41b5a55cd10c9facbdb9cf8de9dc011cabbeeac0ee4082
MD5 eda2fef463a09bf98da0a634837a2f6b
SHA1 39d2dbf278920317d92049bd977ab0ca7c280bc5
SHA512 2f7b39f7a98125fc6c89f96d078a63a7f8b9f07d668607ab6d2772c318e03f864b3ba6219037d896b21d3d0915463365046935ec86ce945dbdc206b9defca0e4
SSDEEP 12:7+twnqLZqLjcyNTSFbyKogAbrU4SwPMrfRmBEyPbMJJ:7+tIqLwLNsogcwMbGSU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads