Analysis
-
max time kernel
49s -
max time network
180s -
platform
android_x64 -
resource
android-x64-20240514-en -
resource tags
androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system -
submitted
02-06-2024 13:20
Static task
static1
Behavioral task
behavioral1
Sample
8e36f838aab0624da9c6d88c50a57c87_JaffaCakes118.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral2
Sample
8e36f838aab0624da9c6d88c50a57c87_JaffaCakes118.apk
Resource
android-x64-20240514-en
Behavioral task
behavioral3
Sample
8e36f838aab0624da9c6d88c50a57c87_JaffaCakes118.apk
Resource
android-x64-arm64-20240514-en
General
-
Target
8e36f838aab0624da9c6d88c50a57c87_JaffaCakes118.apk
-
Size
668KB
-
MD5
8e36f838aab0624da9c6d88c50a57c87
-
SHA1
167f3936b3a5d3d7b06728451ec32141260b9b16
-
SHA256
56d805c7aa02aa41a34e2e0e93cd038b517616fc463c92931f74ca4fc037c737
-
SHA512
b66ab2a5ffe938f49dafd3423f8fa51341a6352dee08d01e47364c2a26c1c975edd75c26f055be5d617d42a30d73c5adbddcb576e89ffd2668f4c2ff406df17e
-
SSDEEP
12288:MGLgs+RKHjPYvNwYSHCuGkH1hx2+za10tx3RLBNjp1AkWXRIsFEkP/NwHbUmOd:FLg/Y70NxSHHX8UaG/fVArhI8EoKIrd
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
Processes:
com.ios.browserdescription ioc process File opened for read /proc/cpuinfo com.ios.browser -
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
Processes:
com.ios.browserdescription ioc process File opened for read /proc/meminfo com.ios.browser -
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.ios.browserioc pid process /data/user/0/com.ios.browser/cache/ads2171788616314577028.jar 5149 com.ios.browser -
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
Processes:
com.ios.browserdescription ioc process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.ios.browser -
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
Processes:
com.ios.browserdescription ioc process Framework service call android.app.IActivityManager.getRunningAppProcesses com.ios.browser -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
Processes:
com.ios.browserdescription ioc process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.ios.browser -
Reads the content of the browser bookmarks. 1 TTPs 1 IoCs
Processes:
com.ios.browserdescription ioc process URI accessed for read content://browser/bookmarks com.ios.browser -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
com.ios.browserdescription ioc process Framework service call android.app.IActivityManager.registerReceiver com.ios.browser -
Checks if the internet connection is available 1 TTPs 1 IoCs
Processes:
com.ios.browserdescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.ios.browser -
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes:
com.ios.browserdescription ioc process Framework API call javax.crypto.Cipher.doFinal com.ios.browser
Processes
-
com.ios.browser1⤵
- Checks if the Android device is rooted.
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries the mobile country code (MCC)
- Reads the content of the browser bookmarks.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:5149
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d80f6d032778b02d10a9c9a2f1a24714
SHA1e34d4ea9618b1b499b65032723ea029ab3998500
SHA256ee2de01a238f9e1834f9f9934dd1f5b267bdf9747965641d2fd636d740041f9b
SHA51234fa52d41831142f86999ac407aafeb2b69bb4cd45ada9f739be84c80deb0414d11d6784f385eec287e4f6b5bdf29ba1c9a6a77c07707d66a73c60eb389136e1
-
Filesize
16KB
MD57f5c184e8c83a02c69a84c8bdea77729
SHA1030cc4b0af8c2f7b6ff2507d3d3b79272688b707
SHA256cc1ab419a11ff84b63d85c199f5b63995d8c49c72d665583c2917440fbf6ced8
SHA512d59f3f1e4244b122b4a8beacc51101fc01a2532106b6e566b3be3e620bad68091b12153c26b0fa6b699099fc19d5665b6daa6f091dfe3a5b59238cd81f626c61
-
Filesize
8KB
MD500f204b4226c430c55bd4a1350c84b36
SHA1c6d71a9012f00e9c3c476105194640c9f3016a98
SHA2568e2add9ba61a57020252529cd753a0d830dda96404b5064003bd4fc39f25bde4
SHA51280763646a7f2960cd3a637295b2ff6e11447c64df88a0de70f4bbf5a8f1ec718e7b284d0c0289de4f00296ba1fff8a57393a06bffdd6ed655b7b9c110ccb767f
-
Filesize
512B
MD50b8719c1917de2a3c56f47d4db6505aa
SHA1e6bd2ce516d91d5854af901c7a8666e00459f92f
SHA2563838e275cb5810d2bd7efc7459d7789bba37d647f34ab24556adffc66e46ef49
SHA51252834e5f28d576827ac72e0df6948e6bb60add62961d5395a569869dc143649cfb55ad5ee1043454bd3a020a701935eff1433b85b0cf8c88efa42ac69f2854a7
-
Filesize
8KB
MD577fec51ea7599e05b970886cb231cc3f
SHA1275a10a668bb978973a73c06f169c551c8cfbe2c
SHA2562133ff052ab268991fa2c88c48482cc0ceb79ff1238fee88c912f0d5e978b800
SHA5128919117785a00b7c955f8ae17377fd6c6696927c8526ea8713e9463d198a706d9ce8595f2f02f612f691d95f4960b37e28cf808fc4d94a7982ad4cb94f998b52
-
Filesize
8KB
MD5fb697bbb226231f8bcf91d263c91ad99
SHA1dd3f0c2fa5481eee4ba7c789cf1dd46e0f3136db
SHA256f7b6a8474394aa0644361af5182e9b7ed430d21c6e011b421821c1fc7364f0bd
SHA51293eb27773efd4cf521d4a815e2c73ff1122276b72f600ef6c382c0adf35bcb28580ad4a28d91ec22b6d26df89a26939e28785448cd53f548b4137756f54f27cc
-
Filesize
51B
MD5a757049a22d0a9d73b8373c4ca63d0d9
SHA1d309e40e194d5d3820c0b1a1ea8074ad2b9897bb
SHA256324ea8ded317574a6192dcab92d53d26a102f1f876c9269763a9d1260d8d13c6
SHA512a8bfdfcc823cf4281342e3415a46d4ba77d4a903ff3fa22faf6392728f199a6b4f11d70a43c0609bdfe7149dfbf076e270de624724d434c7928293d4ed874708
-
Filesize
4KB
MD512670a32ad1380c9021a9e74aa5f2281
SHA17e8caf0c7a4d78452efb90958e8ce1aae5148e44
SHA256f3c142f78cadcb57d7da3d8e4dc5f8c7b05377417c639059910696c844afc1f9
SHA5121277dde373cab02d5df62732834adb79f8dbf1d1a9ac56b5b348e354317fadc24fe20b5ebdd1ecc28f8fc98dcdff807d2839bef75ef7d871e976e68a95851b06
-
Filesize
33B
MD5cd498fd4f9247e9f9ef99e940063433b
SHA11828b2bb82aa7129dfd4cc01f61e1bad3f9e2895
SHA256af525fedb16ebcb058598ce37e7e69d6374e3c900aa9fd8593bc29b38725ba36
SHA512a2f90938ecf8190b20f3e565dc69976ef8e59071d764da1a17a6d70fcb52702701c54ad68ceb9408865f6c44f419d285435d36e2ba0ed6df146818eec0457f4f