497b8c8e05e89e0bc538d395e2336627791b43a4c04c625072e17b47aa3dc37d

Analysis

max time kernel
152s
max time network
168s
platform
android_x64
resource
android-x64-arm64-20240603-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240603-enlocale:en-usos:android-11-x64system
submitted
03/06/2024, 16:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9276de9e07d8cf442b7d4d5ee5f4d3c1_JaffaCakes118.apk
Size 8.2MB
Sample240603-t3pp8adf94
SHA256 497b8c8e05e89e0bc538d395e2336627791b43a4c04c625072e17b47aa3dc37d
MD5 9276de9e07d8cf442b7d4d5ee5f4d3c1
SHA1 fe38fb6e27bf2e6b317e061b8acd84bdec95439d
SHA512 b027c307b2e7d9308ac10f81e014ef870f6d55dae58a89e86cd40bc4b562817ad26f5b167b920c80ebed294c05f83c7a6bd9cec6e500a97bd3e98dacf1d83ba4
SSDEEP 196608:JI0KWSMhDJxCbUPzp6beG9hvI1DNujhvI0BUXlVc2lA:JBKenJzpMeGvQ98tQ5XrcQA
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection discovery evasion

Malware Config

Signatures

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.hrbl.mobile.android.order

Queries account information for other applications stored on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect account information stored on the device.

collection

Stored Application Data

T1409

description	ioc	Process
Framework service call	android.accounts.IAccountManager.getAccountsAsUser	com.hrbl.mobile.android.order

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.hrbl.mobile.android.order

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.hrbl.mobile.android.order

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.hrbl.mobile.android.order

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.hrbl.mobile.android.order
1⤵
- Checks memory information
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Checks if the internet connection is available
PID:4530

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Stored Application Data

T1409

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cache_1717432555434

Path /data/user/0/com.hrbl.mobile.android.order/app_TLFCache/cache_1717432555434
Size 10KB
SHA256 80f38c681d2d5762bff1c6d0ecd6186ff5cce26053f0d876e6d5ae8d970f5c6b
MD5 ff43720f51666be101b8f964b5738b7c
SHA1 62b322c10e0cd6dba562288596c90d95483547e2
SHA512 fa9f119f624b177d6e1ff1cb415a95c568909d9ed5adb30310346c748f7ec269fb8603b4dcb583234552e86a3148658aaed012488f5d940f1a20487a0d3dea13
SSDEEP 192:p1nbbRgMq8pYtBMU8bD66SMBhILgQxlNWGWmXo:p1bCMq8pYtBMU8PxSMbI0klLXXo
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_analytics_v4.db

Path /data/user/0/com.hrbl.mobile.android.order/databases/google_analytics_v4.db
Size 28KB
SHA256 be2290733af3dc92305e348cd52310ed5e3a8697999b9bd967543065ba57e06e
MD5 f7a76f4e1d75ec30236dac19159a240c
SHA1 30e99a7ceb1fd8f5709df0ff9d8bac510bab1083
SHA512 0ad7da3d2837717ee30eca01c1e4a6074eb944e76f12859cb8368a9e1d58fe3248dc175620f3c063c8ae28f3698a10473407a4519910629dee393955f3014fef
SSDEEP 24:TLOLVXixByqQWWEqrUhCafBGBGSiG8qyExAE:TChX9hWfqrUhnBZSGqyHE
MD5 SHA1 SHA512 SSDEEP

Submit Download