Analysis
-
max time kernel
48s -
max time network
180s -
platform
android_x64 -
resource
android-x64-arm64-20240514-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system -
submitted
02-06-2024 13:20
Static task
static1
Behavioral task
behavioral1
Sample
8e36f838aab0624da9c6d88c50a57c87_JaffaCakes118.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral2
Sample
8e36f838aab0624da9c6d88c50a57c87_JaffaCakes118.apk
Resource
android-x64-20240514-en
Behavioral task
behavioral3
Sample
8e36f838aab0624da9c6d88c50a57c87_JaffaCakes118.apk
Resource
android-x64-arm64-20240514-en
General
-
Target
8e36f838aab0624da9c6d88c50a57c87_JaffaCakes118.apk
-
Size
668KB
-
MD5
8e36f838aab0624da9c6d88c50a57c87
-
SHA1
167f3936b3a5d3d7b06728451ec32141260b9b16
-
SHA256
56d805c7aa02aa41a34e2e0e93cd038b517616fc463c92931f74ca4fc037c737
-
SHA512
b66ab2a5ffe938f49dafd3423f8fa51341a6352dee08d01e47364c2a26c1c975edd75c26f055be5d617d42a30d73c5adbddcb576e89ffd2668f4c2ff406df17e
-
SSDEEP
12288:MGLgs+RKHjPYvNwYSHCuGkH1hx2+za10tx3RLBNjp1AkWXRIsFEkP/NwHbUmOd:FLg/Y70NxSHHX8UaG/fVArhI8EoKIrd
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 2 IoCs
Processes:
com.ios.browserioc process /sbin/su com.ios.browser /system/bin/su com.ios.browser -
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
Processes:
com.ios.browserdescription ioc process File opened for read /proc/cpuinfo com.ios.browser -
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
Processes:
com.ios.browserdescription ioc process File opened for read /proc/meminfo com.ios.browser -
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.ios.browserioc pid process /data/user/0/com.ios.browser/cache/ads6723405112879079328.jar 4543 com.ios.browser -
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
Processes:
com.ios.browserdescription ioc process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.ios.browser -
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
Processes:
com.ios.browserdescription ioc process Framework service call android.app.IActivityManager.getRunningAppProcesses com.ios.browser -
Reads the content of the browser bookmarks. 1 TTPs 1 IoCs
Processes:
com.ios.browserdescription ioc process URI accessed for read content://browser/bookmarks com.ios.browser -
Checks if the internet connection is available 1 TTPs 2 IoCs
Processes:
com.ios.browsercom.ios.browser:remotedescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.ios.browser Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.ios.browser:remote -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes:
com.ios.browserdescription ioc process Framework API call javax.crypto.Cipher.doFinal com.ios.browser
Processes
-
com.ios.browser1⤵
- Checks if the Android device is rooted.
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Reads the content of the browser bookmarks.
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4543
-
com.ios.browser:remote1⤵
- Checks if the internet connection is available
PID:4760
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d80f6d032778b02d10a9c9a2f1a24714
SHA1e34d4ea9618b1b499b65032723ea029ab3998500
SHA256ee2de01a238f9e1834f9f9934dd1f5b267bdf9747965641d2fd636d740041f9b
SHA51234fa52d41831142f86999ac407aafeb2b69bb4cd45ada9f739be84c80deb0414d11d6784f385eec287e4f6b5bdf29ba1c9a6a77c07707d66a73c60eb389136e1
-
Filesize
4KB
MD512670a32ad1380c9021a9e74aa5f2281
SHA17e8caf0c7a4d78452efb90958e8ce1aae5148e44
SHA256f3c142f78cadcb57d7da3d8e4dc5f8c7b05377417c639059910696c844afc1f9
SHA5121277dde373cab02d5df62732834adb79f8dbf1d1a9ac56b5b348e354317fadc24fe20b5ebdd1ecc28f8fc98dcdff807d2839bef75ef7d871e976e68a95851b06
-
Filesize
16KB
MD5a72423bcf6ba2f2e2dc56d4f6fd2515f
SHA1cd8581a438a9281be57065f46f5e3260b15e75f3
SHA256b83e90d045f859548f9c2043a96371a900de8dac93f3cf919ff79a1c8758fbc2
SHA51294d258b33b0fab32555740fc7bce1b114025f442c750e5523e47e7e2b1df1ae88e55ff04e0f7da042a785d687f0e7176ef739aad7e90bd7a2c9f836031b9ef50
-
Filesize
8KB
MD5ea60fabeac12522c595b8cfe970ae5b5
SHA118491788bbf02e6eea87a7748f48ac4cc4264c74
SHA256f6ef23f8729d55ca2774e46c67fe91eb33b7d2db11106f12f460f1ae0d7e50a5
SHA512572fa52262ccecc2600659a0cf2ae22d665daaf4e51738ffcfa18bedcd6a00468880e18988db288c7cacba8627d53d6fb9e07f0d9826cad2e437d7da0856f676
-
Filesize
512B
MD5ce3449b12f6f131535d488bbb2001005
SHA1ca9b68bc7a527c7e79b7e9b3e98c31653bfcb3de
SHA2567d00dd754134eff82cfa91d0a7718ba840b105e4854abbcf28cd67fe1f96ee4f
SHA512afd88cce533dd2a821ecdad6aaf2cf66435a729961958a7f1126dab2c78944594a1a763ffe3d995a6edddb6c63bf06ea35f59cc6419699bfe296bc6dad956b57
-
Filesize
8KB
MD581bbdb15dd27ed00e1d3c1c5e2c91d6f
SHA1d513a5b68537d92ed3be25eccf9616222b798258
SHA256cffb628adc164e5ec939f2a15bb946d83790bbcedb43ea71982065aaa937ba32
SHA512d5309682f40dee20d5683a1123b406de8f59d60f96214b49ebe3dd39dd31be1c5a9179a5a40f54b11308e093e59da73e5add824742f68c794d21d1b749eb4719
-
Filesize
8KB
MD53fb1d4631d951bfb04098741c830b062
SHA1343074090519611fbb77641404f3bd800359b4ef
SHA2564bbf55a112093dbc91464e178c96cbe40a08d52ecd54253fbbfcd14e56cce362
SHA512bb0ef0966181beb1b838d2413e90361c1606e5e9339be1fdd38ff9b31430a7f9f22c654c2fed3a1d3a1c146a360086d58b06cdbfbcd6ce2c945a701c8a2efda8
-
Filesize
51B
MD569c44cb8d2aa7f3441eae36347e08675
SHA17bde79f6831b86eaa6d295d742764d95e4697421
SHA2569ba9428d7533008fe7cc1bde0968f0a53e73137b9e1c5e7b8c8a47c4348e9411
SHA51272f1ab8ae80768135ab89f28fb8f4cf1322bb26c7d6b1a2f6642f308ba0f4818edaf5142cacdc9f087f95790535b363d48e19315e2c5a3f2ca81d177bbd82978
-
Filesize
33B
MD55628b3a4fb9cfab56d3826f39cc07058
SHA126e0229159121e8647eefadd5732340192b09c2e
SHA2568fd4d1c88a8d426a8a7df052850eaf39b92d9c24acf20bf738ed4b2dea8cd101
SHA512bdbaaf072a8abdf1818408264161f139d9cac3fd9fc5029535f450816f4d7610bccddd8c3b3d76e503d82744cf016446fd19ff5b35dcb7c1ed9a5478dd09cdb5