Analysis

  • max time kernel
    15s
  • max time network
    186s
  • platform
    android_x64
  • resource
    android-x64-20240603-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240603-enlocale:en-usos:android-10-x64system
  • submitted
    03-06-2024 22:40

General

  • Target

    92da3a04887ccbfda362ac8d18bd0304_JaffaCakes118.apk

  • Size

    165KB

  • MD5

    92da3a04887ccbfda362ac8d18bd0304

  • SHA1

    323642d385d04432729e5ef6bf0f30667e723b3c

  • SHA256

    70c243d9612119b841004a7a5b66f17a8c57953bd9df712ef62127a0c620c52b

  • SHA512

    b9d21ab7c7d7a1e69940db4c927d334429e6c3d9ff38cba4d5a5988a31294c7546009f2b65189e73ec7f33e635279e94752cbb3c614f112f2b9f9a4ed112ff66

  • SSDEEP

    3072:snmHdXawlFeVi+BjPx3ylsk8NxJdDITlwHeUA/NkGF2c/2ePY2pFfO:sm3E06xJmTS+UA/NkV78YCFfO

Malware Config

Signatures

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

    Checks memory information which indicate if the system is an emulator.

  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

  • Queries account information for other applications stored on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect account information stored on the device.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Checks if the internet connection is available 1 TTPs 1 IoCs
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
  • Reads information about phone network operator. 1 TTPs

Processes

  • com.master.fuhvpdz.buumaqlb
    1⤵
    • Removes its main activity from the application launcher
    • Checks memory information
    • Loads dropped Dex/Jar
    • Obtains sensitive information copied to the device clipboard
    • Queries account information for other applications stored on the device
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    PID:5123

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.master.fuhvpdz.buumaqlb/app_tfile/config.jar
    Filesize

    127KB

    MD5

    454ef9f79671f57962f69108986d5ec3

    SHA1

    96086de711b1def503e49b9b90b9263ec8dabfab

    SHA256

    c3dab1b8b86257971e033958a667f6b256ab575494df1ed6a9921520a787789c

    SHA512

    097d3ebd8183227487b611a7468570fcd5146ff17f0ab0e2172c7a5d9b0ead03fba2414c729ebcddc9bdc6acc063a537c3f2208898da2fcd01f3d82b6876122f

  • /data/data/com.master.fuhvpdz.buumaqlb/databases/tbcom.master.fuhvpdz.buumaqlb
    Filesize

    36KB

    MD5

    ae8aa93151da27ce1348c21d6ea98a45

    SHA1

    d187ce29f387717ea0c7d2919a77945a6f04a954

    SHA256

    b5023c1c2354845e52c945166be1111d7565a000e57ea18d8ce2943c73580e81

    SHA512

    7bc212292c6dd5192e2d714d1e06c3109f133bf0f5bddb4dd4113a4b9ab3a8db3ba7e1cab4a7da44724361b8d7d53cdde3d50506cf7264fb00d7b4521014c85a

  • /data/data/com.master.fuhvpdz.buumaqlb/databases/tbcom.master.fuhvpdz.buumaqlb-journal
    Filesize

    512B

    MD5

    4e9b75e2c57ad4b474edd8ec97539b50

    SHA1

    14240bc2aa54c84aae437b491f3afafe38d7cf37

    SHA256

    8adf9d3745db17ae9559a91046d5b71828462aab8dc728317626b89aee1faa88

    SHA512

    7b405f5735672658476dce5b1955b86fa34a5a5ddcf4691d2c2c2b74c06eb094f5092f3b959b963d45b7efdab0f71fea332922bf43d5705c26460e7a3f4137c3

  • /data/data/com.master.fuhvpdz.buumaqlb/databases/tbcom.master.fuhvpdz.buumaqlb-journal
    Filesize

    8KB

    MD5

    190bc5b825f61bc39d4a32c2d8bb4595

    SHA1

    1b67a769ca954fda41622532468e3900d5b31c2c

    SHA256

    034d1152151cc245b2590f88b77db36db673c51451f281ab2d2fd24028de5589

    SHA512

    15c64d98cc274ec2c90112496485889cf0c60558202a8ad7afbf6327c2acf034d62590dbbbda65675f5293642537d0b02ca9e18e875c3cd0ab6d3a14a54ce680

  • /data/data/com.master.fuhvpdz.buumaqlb/databases/tbcom.master.fuhvpdz.buumaqlb-journal
    Filesize

    8KB

    MD5

    57112bddfa2c9d7b85dce8a89a7f5d89

    SHA1

    c33fe51c8d989fae6557a8d5e69066a3288ce194

    SHA256

    69be5a3f8c7255cc00ac74ebb4fa9657721b4226c4ff02c9492d5d5156986a9b

    SHA512

    218317c79da6af3b23923bed8f93ba66e4ccc901c9c35263c9c4b5ed4f00ca8b873a23771688158428cc635ad37d475ac285bb847565a4d7ac941385400b663a

  • /data/user/0/com.master.fuhvpdz.buumaqlb/app_tfile/config.jar
    Filesize

    258KB

    MD5

    11f663c8da263a6965f54de6d7bc993d

    SHA1

    49fb24cf75401e2dec37f42c4747ef9a854d7693

    SHA256

    f4749b55dc2bcc87d08beab051c154bfce0636669f2c8e129d5d9b06626a3948

    SHA512

    6ee13e0b42d5fb859d9e099637b42a194fe3d41f9b0c3a4f07a543a5cbabac7bbb058f2da151e8b12b8cbe4333d285c7f241b17919ddbbcd816a4b588248e513

  • /storage/emulated/0/Download/sdsid
    Filesize

    4B

    MD5

    b8c37e33defde51cf91e1e03e51657da

    SHA1

    dd01903921ea24941c26a48f2cec24e0bb0e8cc7

    SHA256

    fe675fe7aaee830b6fed09b64e034f84dcbdaeb429d9cccd4ebb90e15af8dd71

    SHA512

    e3d0e2ef3cab0dab2c12f297e3bc618f6b976aced29b3a301828c6f9f1e1aabbe6dab06e1f899c9c2ae2ca86caa330115218817f4ce36d333733cb2b4c7afde7