Analysis

  • max time kernel
    48s
  • max time network
    180s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240514-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
  • submitted
    02-06-2024 13:20

General

  • Target

    8e36f838aab0624da9c6d88c50a57c87_JaffaCakes118.apk

  • Size

    668KB

  • MD5

    8e36f838aab0624da9c6d88c50a57c87

  • SHA1

    167f3936b3a5d3d7b06728451ec32141260b9b16

  • SHA256

    56d805c7aa02aa41a34e2e0e93cd038b517616fc463c92931f74ca4fc037c737

  • SHA512

    b66ab2a5ffe938f49dafd3423f8fa51341a6352dee08d01e47364c2a26c1c975edd75c26f055be5d617d42a30d73c5adbddcb576e89ffd2668f4c2ff406df17e

  • SSDEEP

    12288:MGLgs+RKHjPYvNwYSHCuGkH1hx2+za10tx3RLBNjp1AkWXRIsFEkP/NwHbUmOd:FLg/Y70NxSHHX8UaG/fVArhI8EoKIrd

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 2 IoCs
  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

  • Checks memory information 2 TTPs 1 IoCs

    Checks memory information which indicate if the system is an emulator.

  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Reads the content of the browser bookmarks. 1 TTPs 1 IoCs
  • Checks if the internet connection is available 1 TTPs 2 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.ios.browser
    1⤵
    • Checks if the Android device is rooted.
    • Checks CPU information
    • Checks memory information
    • Loads dropped Dex/Jar
    • Obtains sensitive information copied to the device clipboard
    • Queries information about running processes on the device
    • Reads the content of the browser bookmarks.
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4543
  • com.ios.browser:remote
    1⤵
    • Checks if the internet connection is available
    PID:4760

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.ios.browser/cache/ads6723405112879079328.jar

    Filesize

    2KB

    MD5

    d80f6d032778b02d10a9c9a2f1a24714

    SHA1

    e34d4ea9618b1b499b65032723ea029ab3998500

    SHA256

    ee2de01a238f9e1834f9f9934dd1f5b267bdf9747965641d2fd636d740041f9b

    SHA512

    34fa52d41831142f86999ac407aafeb2b69bb4cd45ada9f739be84c80deb0414d11d6784f385eec287e4f6b5bdf29ba1c9a6a77c07707d66a73c60eb389136e1

  • /data/user/0/com.ios.browser/cache/ads6723405112879079328.jar

    Filesize

    4KB

    MD5

    12670a32ad1380c9021a9e74aa5f2281

    SHA1

    7e8caf0c7a4d78452efb90958e8ce1aae5148e44

    SHA256

    f3c142f78cadcb57d7da3d8e4dc5f8c7b05377417c639059910696c844afc1f9

    SHA512

    1277dde373cab02d5df62732834adb79f8dbf1d1a9ac56b5b348e354317fadc24fe20b5ebdd1ecc28f8fc98dcdff807d2839bef75ef7d871e976e68a95851b06

  • /data/user/0/com.ios.browser/databases/historyManager

    Filesize

    16KB

    MD5

    a72423bcf6ba2f2e2dc56d4f6fd2515f

    SHA1

    cd8581a438a9281be57065f46f5e3260b15e75f3

    SHA256

    b83e90d045f859548f9c2043a96371a900de8dac93f3cf919ff79a1c8758fbc2

    SHA512

    94d258b33b0fab32555740fc7bce1b114025f442c750e5523e47e7e2b1df1ae88e55ff04e0f7da042a785d687f0e7176ef739aad7e90bd7a2c9f836031b9ef50

  • /data/user/0/com.ios.browser/databases/historyManager-journal

    Filesize

    8KB

    MD5

    ea60fabeac12522c595b8cfe970ae5b5

    SHA1

    18491788bbf02e6eea87a7748f48ac4cc4264c74

    SHA256

    f6ef23f8729d55ca2774e46c67fe91eb33b7d2db11106f12f460f1ae0d7e50a5

    SHA512

    572fa52262ccecc2600659a0cf2ae22d665daaf4e51738ffcfa18bedcd6a00468880e18988db288c7cacba8627d53d6fb9e07f0d9826cad2e437d7da0856f676

  • /data/user/0/com.ios.browser/databases/historyManager-journal

    Filesize

    512B

    MD5

    ce3449b12f6f131535d488bbb2001005

    SHA1

    ca9b68bc7a527c7e79b7e9b3e98c31653bfcb3de

    SHA256

    7d00dd754134eff82cfa91d0a7718ba840b105e4854abbcf28cd67fe1f96ee4f

    SHA512

    afd88cce533dd2a821ecdad6aaf2cf66435a729961958a7f1126dab2c78944594a1a763ffe3d995a6edddb6c63bf06ea35f59cc6419699bfe296bc6dad956b57

  • /data/user/0/com.ios.browser/databases/historyManager-journal

    Filesize

    8KB

    MD5

    81bbdb15dd27ed00e1d3c1c5e2c91d6f

    SHA1

    d513a5b68537d92ed3be25eccf9616222b798258

    SHA256

    cffb628adc164e5ec939f2a15bb946d83790bbcedb43ea71982065aaa937ba32

    SHA512

    d5309682f40dee20d5683a1123b406de8f59d60f96214b49ebe3dd39dd31be1c5a9179a5a40f54b11308e093e59da73e5add824742f68c794d21d1b749eb4719

  • /data/user/0/com.ios.browser/databases/historyManager-journal

    Filesize

    8KB

    MD5

    3fb1d4631d951bfb04098741c830b062

    SHA1

    343074090519611fbb77641404f3bd800359b4ef

    SHA256

    4bbf55a112093dbc91464e178c96cbe40a08d52ecd54253fbbfcd14e56cce362

    SHA512

    bb0ef0966181beb1b838d2413e90361c1606e5e9339be1fdd38ff9b31430a7f9f22c654c2fed3a1d3a1c146a360086d58b06cdbfbcd6ce2c945a701c8a2efda8

  • /data/user/0/com.ios.browser/files/Ping_1717334428078-78483

    Filesize

    51B

    MD5

    69c44cb8d2aa7f3441eae36347e08675

    SHA1

    7bde79f6831b86eaa6d295d742764d95e4697421

    SHA256

    9ba9428d7533008fe7cc1bde0968f0a53e73137b9e1c5e7b8c8a47c4348e9411

    SHA512

    72f1ab8ae80768135ab89f28fb8f4cf1322bb26c7d6b1a2f6642f308ba0f4818edaf5142cacdc9f087f95790535b363d48e19315e2c5a3f2ca81d177bbd82978

  • /storage/emulated/0/.bugsense

    Filesize

    33B

    MD5

    5628b3a4fb9cfab56d3826f39cc07058

    SHA1

    26e0229159121e8647eefadd5732340192b09c2e

    SHA256

    8fd4d1c88a8d426a8a7df052850eaf39b92d9c24acf20bf738ed4b2dea8cd101

    SHA512

    bdbaaf072a8abdf1818408264161f139d9cac3fd9fc5029535f450816f4d7610bccddd8c3b3d76e503d82744cf016446fd19ff5b35dcb7c1ed9a5478dd09cdb5