850320af411d07503ea6517c71fbf8f91e3aea941b558bca41c7bbb16cf079c2

Analysis

max time kernel
169s
max time network
139s
platform
android_x64
resource
android-x64-arm64-20240603-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240603-enlocale:en-usos:android-11-x64system
submitted
03/06/2024, 14:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9229ec932186b19d0169953d9e04062b_JaffaCakes118.apk
Size 27.4MB
Sample240603-r6b77abc23
SHA256 850320af411d07503ea6517c71fbf8f91e3aea941b558bca41c7bbb16cf079c2
MD5 9229ec932186b19d0169953d9e04062b
SHA1 e38ce08aaf1c08baccc32c20a991a99c4a8582c1
SHA512 3a8777238cce054686cb39c69bf9639abfd5d3eaf849bdcdfb04ae67efadab3e460be09fb6692cc280c371ae457a838bd2c25fd66cbd56bd678b4997c1ac688f
SSDEEP 393216:mh6iiX7ZT2m8oHvxd6/RtMUhUf9VKRZZtb9NFzULkT/hZ5R3Cw7DzmThNZotGPR9:AD+QfSr6/3mfORpbLGLkT5Z57PzINEY
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.zentertain.photocollage
/system/xbin/su	com.zentertain.photocollage

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.zentertain.photocollage

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.zentertain.photocollage

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.zentertain.photocollage

Checks the presence of a debugger
evasion

com.zentertain.photocollage
1⤵
- Checks if the Android device is rooted.
- Checks memory information
- Queries information about running processes on the device
- Checks if the internet connection is available
PID:4593

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

journal.tmp

Path /data/user/0/com.zentertain.photocollage/cache/uil-images/journal.tmp
Size 31B
SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
MD5 8c92de9ce46d41a22f3b20f77404cc1d
SHA1 8671a6dca00edb72be47363a7071be65cf270373
SHA512 30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56
MD5 SHA1 SHA512

Submit Download

google_analytics_v4.db

Path /data/user/0/com.zentertain.photocollage/databases/google_analytics_v4.db
Size 28KB
SHA256 e979b56b87e72b70a1e6caf056ab7365badce3d5cadae14e7926e1a9f0c8924d
MD5 cb7215e145e62c7c96324d5e1f3e75d7
SHA1 a1920f77892841e8dd04238ef8f1b3b01d15fafd
SHA512 82da06786b295202d0e21904a9f2fa30126d86f3deb0239434e6c1d1f18fa61ac83358be6d4f4ef1837a43b4e6d2ddd77ef39ec22f17028bf027e6b044392799
SSDEEP 24:TLOLVXixByqQWWEqrUhCafBGBGSiGDJ+wUoQgnbz+wS:TChX9hWfqrUhnBZSycnbg
MD5 SHA1 SHA512 SSDEEP

Submit Download