8fb03ca0308df065072f7bc15c87b5d90de0c0992e93194ffa3eb11ff5260415

Analysis

max time kernel
11s
max time network
151s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
31/05/2024, 09:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
868fdc62008897bfa74ee9e4ff4cf9de_JaffaCakes118.apk
Size 24.3MB
Sample240531-lpb8zaed63
SHA256 8fb03ca0308df065072f7bc15c87b5d90de0c0992e93194ffa3eb11ff5260415
MD5 868fdc62008897bfa74ee9e4ff4cf9de
SHA1 fd534951622801a6a9ad2c1c15ccce37a6b6e037
SHA512 9b9d8fba1fae51b222fefbc66f970b339f68999095272f61c333ddb613680a181e0f27e992dc4f10e3023831aec0f66341baa5a29b0e6ea0ce6a4651f2480b54
SSDEEP 786432:qgL9pJrs7PZKZdcT5RNAu6j/dCbEx5kMti8C:9pN0BDNAuK/MbEjkMtS
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.myzaker.ZAKER_Phone

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.myzaker.ZAKER_Phone

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/data/com.myzaker.ZAKER_Phone/mix.dex	5150	com.myzaker.ZAKER_Phone
/data/data/com.myzaker.ZAKER_Phone/mix.dex	5150	com.myzaker.ZAKER_Phone

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.myzaker.ZAKER_Phone

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Checks the presence of a debugger
evasion

com.myzaker.ZAKER_Phone
1⤵
- Checks if the Android device is rooted.
- Checks memory information
- Loads dropped Dex/Jar
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:5150

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rqd_record.eup

Path /data/data/com.myzaker.ZAKER_Phone/app_bugly/rqd_record.eup
Size 368B
SHA256 f62aa2dfebebd36d5c91d3c9e387c9b4fe9a8fec5fa334a061eaf5f8ef92f7d9
MD5 06abb23a741b267a48f66524079ea3fa
SHA1 506146d6c25ff05964161f426af4e2fcc7e85fd7
SHA512 9643a4b1b0c5582963478000ed032bb2453ff7b68a2c9f5899509d8c1fef03efbb41b5ca4d65905d17804ba708112b374cb4138d5e14fff208eb5999f44333ef
MD5 SHA1 SHA512

Submit Download

rqd_record.eup

Path /data/data/com.myzaker.ZAKER_Phone/app_bugly/rqd_record.eup
Size 1KB
SHA256 c253021f817c61b0bc303b46b3c2f0bdfcd79663d01259501f81de4684c6fd78
MD5 08c212355f7d501c4d557eaeedb25a6a
SHA1 ccd7c3fa61ba39ad80390be4a605889695dbe3f3
SHA512 b55c8cbff8af2433cf243ff580724ea5da3da6c34b7215fb8e7d6e9eb0f213358d120cc0df88b627e7cc6f8cb8c28769575f3510cbf67f74f2c861581258e970
MD5 SHA1 SHA512

Submit Download

tomb_1717148544983.txt

Path /data/data/com.myzaker.ZAKER_Phone/app_bugly/tomb_1717148544983.txt
Size 19KB
SHA256 5644b81693854783298f9b18e26d388c0b0e93e340dda1a98814da34109e0378
MD5 d2010e69f379d196bdf594e0defdfbdd
SHA1 53f69fb8ee4cf260b20f050138f2b746446eea05
SHA512 e6d8ce05f53538ad96c3f8b357a90d9ffc4abc2dbd177d6915e31fb002109a796703e5d9865df02507470b1b75ea365b2b1434bbf818eefc867d1c37df1a333f
SSDEEP 192:V/NEFDLaQOMqnElm6geNAouDtpq0Pdihimj5EnF83MhRxt/2fMPJ0F:VmaMmaMaV5mhD92UhU
MD5 SHA1 SHA512 SSDEEP

Submit Download

tomb.zip

Path /data/data/com.myzaker.ZAKER_Phone/cache/tomb.zip
Size 4KB
SHA256 09ab901e6484be2b8a950a236caacdf2b868b244cdb74720225f3513aff6f24a
MD5 e9db727146a72bb56501c6bf9619e8e3
SHA1 07a0abd2140b6936736c79318c7c6e2d4f6b9a9a
SHA512 4b84861a879919ac7361428521fbe2cbc8f00e18e2966b2bd693d53c26abe88f44490cf6991a8d962c7f63153f365d03eb84c57d3adea43652bece38f162d005
SSDEEP 96:5GKID6FyOHHRYbOS1yJfnOHuP3CGBhgjpaynDKN9O+hGQ:5seFy8Gb0PHhwaC+hGQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu

Path /data/data/com.myzaker.ZAKER_Phone/databases/bugly_db_legu
Size 172KB
SHA256 45f78396c40a888ee7364a79a524df92f385003f841b4df22aa3bc7329f5cd73
MD5 0a30d2b8a41080e886cbb82a80235d96
SHA1 54f2e75a6ff72caaf80c73527eb2f67fc730aedf
SHA512 101d460f66e31fde8d33b344223c2590b0e3cb1880b547d550ed2bb997320432dc3b7f2603e18ef9747fa2794a55d3f5280b2bae17642acfdf7be62811fb0f72
SSDEEP 768:iw9Z5WoZgvMjweQA1nfcjwusa1pjw6BlbCHwOXaB5j/WVmjwURxu5y9ZQqjwtM9a:iqW9zeaewW5P
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/data/com.myzaker.ZAKER_Phone/databases/bugly_db_legu-journal
Size 12KB
SHA256 32c63b8e0ddf346e91b9350a0600991a7ec500b58c93771e7539023548410c34
MD5 f6132f95e14f610eef873bec44032259
SHA1 71bb94e374adaeb092666d02e7687a9308ddf07f
SHA512 4d2a7cb2590ca6ac47f61ed6263eb88912382945b24a48a5fd98513f2a6c6a23290b098a730b65fceba70e336fa121792a7d172ed4358ee4d718c6d2d941dd9a
SSDEEP 48:7MZqsfrQiw6uMg6/YBg72meposScVXAZ4w3WAohL0bP8biCKXT4rMNlNsDTn:7E74m7dmf6SRKXT4rnDTn
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/data/com.myzaker.ZAKER_Phone/databases/bugly_db_legu-journal
Size 512B
SHA256 831f67ee9ae9b1e215b698b8c65ecfaae2d0787da19b0f09eee5e7a74d646320
MD5 ff907183c4f4e61431fd19e63661d308
SHA1 fe6b8061963bb86e0f1c5e43af506eb9b150d26a
SHA512 b330dfbd5d407c5fb2b6407abadbb128e26dc6ed4a5a11c68a91f8f2a3a6f7bc88663c82422290f62a924183eea7e2b341271341765eb50743c882a39103e633
MD5 SHA1 SHA512

Submit Download

bugly_db_legu-journal

Path /data/data/com.myzaker.ZAKER_Phone/databases/bugly_db_legu-journal
Size 8KB
SHA256 009dab75e0aebb07a92c2e9bf853ffac81420a6e16659baaa0b9023a1352ede2
MD5 ab0127bb7df6acd1c48a31ab707fe177
SHA1 5f2bcf3f13fec5642998581d347decef1ece4de2
SHA512 c1aec9b617a1b201ee2fc5140079e529421d0a3e49402260dcec0b5c30b0278191cea8cbf555a2f4ec1fe0e94ddfc98046e88f073f4a832096386ee23732c4ee
SSDEEP 6:7+/l9FTGn11Jvg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuK69:7+tEqLiuWdwRmBEyPbj
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/data/com.myzaker.ZAKER_Phone/databases/bugly_db_legu-journal
Size 8KB
SHA256 262d56f0857c410302d8d96ea164eb126a7a93e5002717a1e261389943d391ce
MD5 7328d73958f5d9d0d6fba30079c59f44
SHA1 1c33a639d46205ecd85413a94199bef44690904c
SHA512 a0cf9bc61413fdae4be21cdb232373939bf54184a79a37e13d601661ecfc21a3d1818928a95779f15dc5b13a9e38efad38a24fd4832c218adc956b5bab0a94db
SSDEEP 6:7+/l9jUOPg9bNFlLdrlOERX4PBX4ogLugMBX4suuK4B/MR:7+tBUiqLJdTRmBEyPbfMR
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/data/com.myzaker.ZAKER_Phone/databases/bugly_db_legu-journal
Size 8KB
SHA256 ee28a5a6eb21db36089af025796c3afc8d93d1245b7c9a113044be6f5b450b44
MD5 28b511fb845c39c11a08a298cc76c572
SHA1 4237344181c3f2ba5ca28697b1fbcb8d1c7f6ecd
SHA512 28ed60c5ba6536824083561b1cf202d3a66aefe114f87f9561370ae857bf564f7525157ff00e24ea0a91a4ed73fba26ac868ce8e6a5843ef28179ba477f3883d
SSDEEP 24:7+t5qLTt/qqn26VnrQiVicXX+MgeRKkYBg72m/mpLwBpGSN:7M5qDfrQiw6uMg6/YBg72meposSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/data/com.myzaker.ZAKER_Phone/databases/bugly_db_legu-journal
Size 12KB
SHA256 603c494e45fe557996681732b55b071439c85e05654645bc53a572a98b44c014
MD5 d0a76dd7ad225e9a7ca4439e8c0afc08
SHA1 51bbb415af91c75b8cbd1502b6e14b7ff92c62b0
SHA512 145d3d22472a025f15e7244121f56d723293ee027fbfea65b72426da1842f716ec8985cce7c623447248f29d2def5642b801de3c520dceffe72fedc0b30e9262
SSDEEP 24:7+t2lqLMvtslqqn26VnrQiVicXX+MgeRKkYBg72m/mpLwBpGSz:7M2lq3DfrQiw6uMg6/YBg72meposSz
MD5 SHA1 SHA512 SSDEEP

Submit Download

mix.dex

Path /data/data/com.myzaker.ZAKER_Phone/mix.dex
Size 292B
SHA256 4c76a3af64cdd2f8713ffe2733dea50dbe714d0ca41c17d1847ee5b62a7ca615
MD5 63f77f99bd2c2b772a479923bde11974
SHA1 c7632e7d301e4463fafce85f84e9c3d7da3fdbbe
SHA512 3aae4a89d1ed51fdd911cb367eb10afe3c2264e4222085891b18a60d5412f85d10bf5c8f3c6642db70abb9aa42732bac5c42c42ee32d587100f53c21b5beb16c
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads