Analysis
-
max time kernel
164s -
max time network
185s -
platform
android_x64 -
resource
android-x64-arm64-20240514-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system -
submitted
02-06-2024 12:10
Static task
static1
Behavioral task
behavioral1
Sample
8e08208b763b09ffd6d51dabd04d3432_JaffaCakes118.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral2
Sample
8e08208b763b09ffd6d51dabd04d3432_JaffaCakes118.apk
Resource
android-x64-20240514-en
Behavioral task
behavioral3
Sample
8e08208b763b09ffd6d51dabd04d3432_JaffaCakes118.apk
Resource
android-x64-arm64-20240514-en
Behavioral task
behavioral4
Sample
__pasys_remote_banner.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral5
Sample
__pasys_remote_banner.apk
Resource
android-x64-20240514-en
Behavioral task
behavioral6
Sample
__pasys_remote_banner.apk
Resource
android-x64-arm64-20240514-en
General
-
Target
8e08208b763b09ffd6d51dabd04d3432_JaffaCakes118.apk
-
Size
329KB
-
MD5
8e08208b763b09ffd6d51dabd04d3432
-
SHA1
d4ccd3ab769635e10c2534bc4a6a73170ced4f26
-
SHA256
2260df3fb1cc7c64e9f84f4a2032659526d28684689d4d1662bc412ae396f1fb
-
SHA512
431278ad17ff5b2219d736e46ca7a3b7178e1fc48af091fc2f3dde37fd0327113c5fcdc1baae3e38a1a09e6b8a27058f8159549810b2645fc6bbd7edfe150cbe
-
SSDEEP
6144:4Yk0Fjv5yOjw7LY3w59+Jw7i+Riqi/j1Fc+Zj8Z5eAs2S714XyWmuHbDkQ:gYD5yO07Lpmy7Tg/D9t2SmX5HbDt
Malware Config
Signatures
-
Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
Processes:
kaixin2.weizhang9description ioc process Framework service call com.android.internal.telephony.ITelephony.getCellLocation kaixin2.weizhang9 -
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
Processes:
kaixin2.weizhang9description ioc process File opened for read /proc/cpuinfo kaixin2.weizhang9 -
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
Processes:
kaixin2.weizhang9description ioc process File opened for read /proc/meminfo kaixin2.weizhang9 -
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
Processes:
kaixin2.weizhang9ioc pid process /data/user/0/kaixin2.weizhang9/files/__pasys_remote_banner.jar 4457 kaixin2.weizhang9 -
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
Processes:
kaixin2.weizhang9description ioc process Framework service call android.content.IClipboard.addPrimaryClipChangedListener kaixin2.weizhang9 -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
Processes:
kaixin2.weizhang9description ioc process Framework service call android.net.wifi.IWifiManager.getConnectionInfo kaixin2.weizhang9 -
Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
Processes:
kaixin2.weizhang9description ioc process Framework service call android.net.wifi.IWifiManager.getScanResults kaixin2.weizhang9 -
Acquires the wake lock 1 IoCs
Processes:
kaixin2.weizhang9description ioc process Framework service call android.os.IPowerManager.acquireWakeLock kaixin2.weizhang9 -
Checks if the internet connection is available 1 TTPs 1 IoCs
Processes:
kaixin2.weizhang9description ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo kaixin2.weizhang9
Processes
-
kaixin2.weizhang91⤵
- Requests cell location
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about the current Wi-Fi connection
- Queries information about the current nearby Wi-Fi networks
- Acquires the wake lock
- Checks if the internet connection is available
PID:4457
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
231KB
MD5c601107d24f96646ae86f74b0fea880c
SHA18a8ce84fe5b6e186ddcd69c8757de4fb1aae7ed1
SHA256939120d702d97dc47c6963d98dc1d2694e0fae5f5d5199c0755f54741a3c2a16
SHA512b573a0d74ea8c6e99c3ebad4ac7b42ce46940231f8a90c9b19c887c6c20356235241068d187aab2bae9914c3df84cbe80bca13b5b6d070247353f5e5eb282f33
-
Filesize
114KB
MD52ad9fb4b2d9b333883b7e38f61c2fd2f
SHA15b85041452d173ed0d81d25b9ca78608a998e328
SHA256b9310a99f1b60959f6b725eea74623dc491adec55da740c17e8c7e02f35818f5
SHA5126fc04e1e22ebf8920b4928a8086cf3e0814d155f79f80d71622916f6a0911262382710e5ee2acea653db4b387730e201134592cb9992b14f3aef8b09d83bda90