Analysis
-
max time kernel
179s -
max time network
159s -
platform
android_x64 -
resource
android-x64-20240514-en -
resource tags
-
submitted
30-05-2024 11:18
General
-
Target
840af04291bf6f8c239c5178e1674772_JaffaCakes118.apk
-
Size
263KB
-
MD5
840af04291bf6f8c239c5178e1674772
-
SHA1
35322bd708e281a3af6f33a7a48cf01f969f123c
-
SHA256
0516416947f71b9af9dbc95a72b0d4fd0fbff816c97bca163deed795cd75d02d
-
SHA512
30a41c2a1ff09f2e7a0a479d7cd2b160d498398bc43ab0f338dae1a822e5611e3932ad21c60c836d8956003ad68497a5d9b47834107398305ef46ddf641696f2
-
SSDEEP
6144:bRIZPNvivXSCeVvnD2IJOsBFaw4IzEsS/ZXBc2Y4MT5fNq:bRI3i6tQIwsBFa/IvcR9Uq
Malware Config
Signatures
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks if the internet connection is available 1 TTPs 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Schedules tasks to execute at a specified time 1 TTPs 2 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.news.geynci.jxvlsxqrljv1⤵
- Removes its main activity from the application launcher
- Checks memory information
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries account information for other applications stored on the device
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
-
com.news.geynci.jxvlsxqrljv:RemoteProcess1⤵
-
com.news.geynci.jxvlsxqrljv:guard1⤵
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Mobile v15
Persistence
Event Triggered Execution
1Broadcast Receivers
1Scheduled Task/Job
1Defense Evasion
Download New Code at Runtime
1Hide Artifacts
1Suppress Application Icon
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
138KB
MD5cceb8db3b057d24673d49eda229e9892
SHA1b18f6353b2156410249079a3b7b86ef3a530e8ee
SHA256e900cb4c3fe9d8f45196a7457e9645c65b0f3cde820f4161950252cff67a4d97
SHA5124a42cde3165a706e823caa1362001ed8aa647caf22325a4f2554c64fc4ebcd79afe44fe5eab5474221806f26e7aca9d2901026de6e597ef62fe867f123e4bd57
-
Filesize
369B
MD56de41202d76cfb91657a014430e7f33d
SHA11c066a98ee1dae3493881522b42a6978ef72ffee
SHA25651491488aa5999f64c4d74c50676559497e9890b2a3978cdc8f07dc782e945ec
SHA512765ef4f4ca7a832af8677b8cb38b705a5cf809b6d321f7d86bcb03471d5e55d8c9b8dc04dbad9f89b10febd5e87b29d29e1bd36fa91259ba00ea863ad1225236
-
Filesize
36KB
MD5ae8aa93151da27ce1348c21d6ea98a45
SHA1d187ce29f387717ea0c7d2919a77945a6f04a954
SHA256b5023c1c2354845e52c945166be1111d7565a000e57ea18d8ce2943c73580e81
SHA5127bc212292c6dd5192e2d714d1e06c3109f133bf0f5bddb4dd4113a4b9ab3a8db3ba7e1cab4a7da44724361b8d7d53cdde3d50506cf7264fb00d7b4521014c85a
-
Filesize
512B
MD5f73b480a1e40468ed99bcda714e34841
SHA1b2a896fcea6b3dc0de3d8f0b8691e39190d573a6
SHA256f33c1163d7751baf812a38db05fee58923cbf0cbbab0aa87384b95d5869341f1
SHA5127178acbeb9f0fdf3b6448d9d951c3c69ce619c866f482d1722047907ae47756e743610822a637060f167238dc06c7b8b70a5a6b6d8355ce01c820bf2ca4c29b9
-
Filesize
8KB
MD543b8ceb059d9c8cbb797bc482378f3c0
SHA1649b643d338b26c45ddb4b2444f040a99498d647
SHA256b5db74194260aa59aa504b5f3936013203feb79f06f0e707f62758cea07fd8cf
SHA5123e3f86b0c32405140fc908dc9140b88fb78aa38f9877186a74c8dd495d2eccc58b50658b99e08e0d1cce8c939e8534527a31dd1e8df1064e2fdb0c424b7e6502
-
Filesize
8KB
MD57afa5fc55cbeeb40cf0711cc89224344
SHA143bc158e3f6acf3fbeec01861e12c8b867b01f20
SHA256928c1b13d3b414b61a838c612ee3073b315bb0ba03bdcf8683419bd3f961ec79
SHA512e13f16d040184a421c1149c44a4a0087f1868c4aaf227d328079e2d13450e0c4a769c64786fb4d87d950556db6815298971158869642073f1faaba9f4614cad4
-
Filesize
281KB
MD573b11c4c10150bbd4f29ad012dc11dde
SHA165c83ad32c29f9811c32eda75d7fcdc92ef42dda
SHA25652132037e9b950a9cb48d6374ee2c6747a6bfe776e13a726395771f1b40ee9da
SHA5123e53b1ee22a00e60896da86d2695195e0965c93d190c4d1c0dba2eb5c611d670ee7693a9f8756858255e2b170cb82a753719dd4d6a827af437309b7a1dcc6f01
-
Filesize
4B
MD5b8c37e33defde51cf91e1e03e51657da
SHA1dd01903921ea24941c26a48f2cec24e0bb0e8cc7
SHA256fe675fe7aaee830b6fed09b64e034f84dcbdaeb429d9cccd4ebb90e15af8dd71
SHA512e3d0e2ef3cab0dab2c12f297e3bc618f6b976aced29b3a301828c6f9f1e1aabbe6dab06e1f899c9c2ae2ca86caa330115218817f4ce36d333733cb2b4c7afde7