dc0034988720e462d9d4a8d1dbc494c86fcdac1c6caf13d29adca75e7ac0deda

Analysis

max time kernel
173s
max time network
185s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
03/06/2024, 09:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
91402532c18c3ce82595f439bb25629a_JaffaCakes118.apk
Size 8.8MB
Sample240603-k8gr5abb49
SHA256 dc0034988720e462d9d4a8d1dbc494c86fcdac1c6caf13d29adca75e7ac0deda
MD5 91402532c18c3ce82595f439bb25629a
SHA1 421b0d3ed74982c6ee7a90b3ea9a0a34e733ac89
SHA512 99f4dbdaffd17297f2f845a83b0b2417f9ed83ceebff04b53c1e4de71a81b9048f445c22281ae145013e2215c8dc4751e1ea515ad3c65cc32d00b9306750fec2
SSDEEP 196608:5R0HVL/S0mfguHmv3Y39SXnj2zPco0qeakw9oHpfS6k:PCVO0efmA3Ez2zUQeaqpfS6k
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery impact

Malware Config

Signatures

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.jinding.YSD:core
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.jinding.YSD

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.jinding.YSD

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.jinding.YSD:core
Framework API call	javax.crypto.Cipher.doFinal	com.jinding.YSD

com.jinding.YSD
1⤵
- Queries information about running processes on the device
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4307

com.jinding.YSD:core
1⤵
- Queries information about running processes on the device
- Uses Crypto APIs (Might try to encrypt user data)
PID:4348

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1424

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

jpush_stat_cache_history.json

Path /data/data/com.jinding.YSD/files/jpush_stat_cache_history.json
Size 174B
SHA256 5daea2594471dad8b7a7e2de50ca5f14bedf7208689f784a4d2eae5d30c8c953
MD5 d1cef079c2757d2f01d37eaa7f9d3158
SHA1 2daf7d7265822b13e5a9113cf27940539abb3bb5
SHA512 9b3cd14c894212954d43408cc48918d454c267bb9b837eeabc3ada69d663e2b97df8b9e26d4061afa82fdf3ceb9f68a048b8a81c62b4ab2cf8fb7b60c75f6f8d
MD5 SHA1 SHA512

Submit Download

unicorn#cheese#

Path /data/data/com.jinding.YSD/unicorn#cheese#
Size 64KB
SHA256 de2f256064a0af797747c2b97505dc0b9f3df0de4f489eac731c23ae9ca9cc31
MD5 fcd6bcb56c1689fcef28b57c22475bad
SHA1 1adc95bebe9eea8c112d40cd04ab7a8d75c4f961
SHA512 73e4153936dab198397b74ee9efc26093dda721eaab2f8d92786891153b45b04265a161b169c988edb0db2c53124607b6eaaa816559c5ce54f3dbc9fa6a7a4b2
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

.push_deviceid

Path /storage/emulated/0/data/.push_deviceid
Size 32B
SHA256 7f0b71f6c1d30a928d1dc23ae93fcfe1845f1c57ae24601550070be99ff526ec
MD5 c005895a825f9a512e9f0f66f7b6d186
SHA1 b98f22698ed0e0814eb13a40adfac50b8fbffa69
SHA512 1bb1d3d6ad6f8ec57904edead8e1c352639a1342fc616b19ad47ee6f67624e581e35da668c6bb27eeb0cd7f8b12834585148a845840e5888587fd2d4e3173761
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads