Analysis
-
max time kernel
15s -
max time network
131s -
platform
android_x86 -
resource
android-x86-arm-20240603-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240603-enlocale:en-usos:android-9-x86system -
submitted
03-06-2024 22:40
Static task
static1
Behavioral task
behavioral1
Sample
92da3a04887ccbfda362ac8d18bd0304_JaffaCakes118.apk
Resource
android-x86-arm-20240603-en
Behavioral task
behavioral2
Sample
92da3a04887ccbfda362ac8d18bd0304_JaffaCakes118.apk
Resource
android-x64-20240603-en
Behavioral task
behavioral3
Sample
92da3a04887ccbfda362ac8d18bd0304_JaffaCakes118.apk
Resource
android-x64-arm64-20240603-en
General
-
Target
92da3a04887ccbfda362ac8d18bd0304_JaffaCakes118.apk
-
Size
165KB
-
MD5
92da3a04887ccbfda362ac8d18bd0304
-
SHA1
323642d385d04432729e5ef6bf0f30667e723b3c
-
SHA256
70c243d9612119b841004a7a5b66f17a8c57953bd9df712ef62127a0c620c52b
-
SHA512
b9d21ab7c7d7a1e69940db4c927d334429e6c3d9ff38cba4d5a5988a31294c7546009f2b65189e73ec7f33e635279e94752cbb3c614f112f2b9f9a4ed112ff66
-
SSDEEP
3072:snmHdXawlFeVi+BjPx3ylsk8NxJdDITlwHeUA/NkGF2c/2ePY2pFfO:sm3E06xJmTS+UA/NkV78YCFfO
Malware Config
Signatures
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.master.fuhvpdz.buumaqlbioc pid process /data/user/0/com.master.fuhvpdz.buumaqlb/app_tfile/config.jar 4278 com.master.fuhvpdz.buumaqlb -
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
Processes:
com.master.fuhvpdz.buumaqlbdescription ioc process Framework service call android.accounts.IAccountManager.getAccountsAsUser com.master.fuhvpdz.buumaqlb -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
Processes:
com.master.fuhvpdz.buumaqlbdescription ioc process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.master.fuhvpdz.buumaqlb -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
com.master.fuhvpdz.buumaqlbdescription ioc process Framework service call android.app.IActivityManager.registerReceiver com.master.fuhvpdz.buumaqlb -
Checks if the internet connection is available 1 TTPs 1 IoCs
Processes:
com.master.fuhvpdz.buumaqlbdescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.master.fuhvpdz.buumaqlb -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes:
com.master.fuhvpdz.buumaqlbdescription ioc process Framework API call javax.crypto.Cipher.doFinal com.master.fuhvpdz.buumaqlb
Processes
-
com.master.fuhvpdz.buumaqlb1⤵
- Removes its main activity from the application launcher
- Checks memory information
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.master.fuhvpdz.buumaqlb/app_tfile/config.jarFilesize
127KB
MD5454ef9f79671f57962f69108986d5ec3
SHA196086de711b1def503e49b9b90b9263ec8dabfab
SHA256c3dab1b8b86257971e033958a667f6b256ab575494df1ed6a9921520a787789c
SHA512097d3ebd8183227487b611a7468570fcd5146ff17f0ab0e2172c7a5d9b0ead03fba2414c729ebcddc9bdc6acc063a537c3f2208898da2fcd01f3d82b6876122f
-
/data/data/com.master.fuhvpdz.buumaqlb/databases/tbcom.master.fuhvpdz.buumaqlbFilesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
/data/data/com.master.fuhvpdz.buumaqlb/databases/tbcom.master.fuhvpdz.buumaqlb-journalFilesize
512B
MD5ea79900d9d23ad01c2f74d8dc6f1fc4b
SHA12ffa36207b6da2d78653abf3d2dd87cb7acea7eb
SHA2562cb93b566d50a904ad60b4c0ddb48f58e5e14feae3cff27a0c63f5571156b8aa
SHA512874e8baa4bba8b9aa9289618956564c3fcde88d5801fa91e3006eee4ea64ab1aab22262fad8aa77e24738d7126a935df426f221338a82d62409f20f3f7e4eb01
-
/data/data/com.master.fuhvpdz.buumaqlb/databases/tbcom.master.fuhvpdz.buumaqlb-shmFilesize
28KB
MD5cf845a781c107ec1346e849c9dd1b7e8
SHA1b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA25618619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
SHA5124802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
-
/data/data/com.master.fuhvpdz.buumaqlb/databases/tbcom.master.fuhvpdz.buumaqlb-walFilesize
48KB
MD5b6c1e86171f050f5e4dc52b7527c1c56
SHA187e2f19d7096d3a5e5b8db373f134442d824bd42
SHA256fcbac34aa055e106c5a152f00ec6b07107f75f5a95507fc68b03496d3bbfc932
SHA512edd8e9ceda90481ce89ce6b04d204296a08ba3676f5935c28070994cf2c96097700172c15ca6f82cb00a5b20de6fbd95e829a71f9cb52ed7f93ae78c40274fe3
-
/data/user/0/com.master.fuhvpdz.buumaqlb/app_tfile/config.jarFilesize
258KB
MD511f663c8da263a6965f54de6d7bc993d
SHA149fb24cf75401e2dec37f42c4747ef9a854d7693
SHA256f4749b55dc2bcc87d08beab051c154bfce0636669f2c8e129d5d9b06626a3948
SHA5126ee13e0b42d5fb859d9e099637b42a194fe3d41f9b0c3a4f07a543a5cbabac7bbb058f2da151e8b12b8cbe4333d285c7f241b17919ddbbcd816a4b588248e513
-
/storage/emulated/0/Download/sdsidFilesize
4B
MD5b8c37e33defde51cf91e1e03e51657da
SHA1dd01903921ea24941c26a48f2cec24e0bb0e8cc7
SHA256fe675fe7aaee830b6fed09b64e034f84dcbdaeb429d9cccd4ebb90e15af8dd71
SHA512e3d0e2ef3cab0dab2c12f297e3bc618f6b976aced29b3a301828c6f9f1e1aabbe6dab06e1f899c9c2ae2ca86caa330115218817f4ce36d333733cb2b4c7afde7