Analysis
- max time kernel
173s - max time network
191s - platform
android_x64 - resource
android-x64-20240514-en - resource tags
androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system - submitted
03/06/2024, 09:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
91402532c18c3ce82595f439bb25629a_JaffaCakes118.apk
Resource
android-x86-arm-20240514-en
3 signatures
150 seconds
General
- Target 91402532c18c3ce82595f439bb25629a_JaffaCakes118.apk
- Size 8.8MB
- Sample240603-k8gr5abb49
- SHA256 dc0034988720e462d9d4a8d1dbc494c86fcdac1c6caf13d29adca75e7ac0deda
- MD5 91402532c18c3ce82595f439bb25629a
- SHA1 421b0d3ed74982c6ee7a90b3ea9a0a34e733ac89
- SHA512 99f4dbdaffd17297f2f845a83b0b2417f9ed83ceebff04b53c1e4de71a81b9048f445c22281ae145013e2215c8dc4751e1ea515ad3c65cc32d00b9306750fec2
- SSDEEP 196608:5R0HVL/S0mfguHmv3Y39SXnj2zPco0qeakw9oHpfS6k:PCVO0efmA3Ez2zUQeaqpfS6k
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Queries information about running processes on the device 1 TTPs 2 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.jinding.YSD Framework service call android.app.IActivityManager.getRunningAppProcesses com.jinding.YSD:core - Checks if the internet connection is available 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.jinding.YSD - Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
- Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.jinding.YSD Framework API call javax.crypto.Cipher.doFinal com.jinding.YSD:core
Processes
-
com.jinding.YSD1⤵
- Queries information about running processes on the device
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:5176
-
com.jinding.YSD:core1⤵
- Queries information about running processes on the device
- Uses Crypto APIs (Might try to encrypt user data)
PID:5225
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.jinding.YSD/files/jpush_stat_cache_history.json
- Size 174B
- SHA256 08d7a5764105022ed6584cc5866be098c01c279cc892bd71d2087dd5b8c8e509
- MD5 0cb1abf3f99e213e492bc068d6c1eca9
- SHA1 af384e08bafa1925ed3877dbdb6e000f1ab0d0cf
- SHA512 8fffbbee6534b05d165368184dcb08c2a5e79b494e88caeae4fb3c3e5d3569a1cd2c9cc638e1f61cc1f0f6ea177beafc7dd6b14bb31c0aed730913fd2a02d4f7
- MD5 SHA1 SHA512
- Path /data/data/com.jinding.YSD/unicorn#cheese#
- Size 64KB
- SHA256 de2f256064a0af797747c2b97505dc0b9f3df0de4f489eac731c23ae9ca9cc31
- MD5 fcd6bcb56c1689fcef28b57c22475bad
- SHA1 1adc95bebe9eea8c112d40cd04ab7a8d75c4f961
- SHA512 73e4153936dab198397b74ee9efc26093dda721eaab2f8d92786891153b45b04265a161b169c988edb0db2c53124607b6eaaa816559c5ce54f3dbc9fa6a7a4b2
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
- Path /storage/emulated/0/data/.push_deviceid
- Size 32B
- SHA256 ad787ba9d63fb9b5cf186d16174deffa68a433ab89b71fcf4617ae4607622acd
- MD5 3ea1c0d48278a9a996f90ce13f916abd
- SHA1 074c22f3bf11245aafabde1c3a61ca2d15ccb361
- SHA512 5178ccb0259a794b50a99d4f6d8a689c85c010d3574c420f778c9eaa6be81db7291a607acabf53144a97ae10591258ad8b7ee37d622e55510cb582d17c5dec0d
- MD5 SHA1 SHA512