Analysis
- max time kernel
2s - max time network
130s - platform
android_x86 - resource
android-x86-arm-20240603-en - resource tags
androidarch:armarch:x86image:android-x86-arm-20240603-enlocale:en-usos:android-9-x86system - submitted
04/06/2024, 00:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9330d36769fac8abc6a147d8e350acde_JaffaCakes118.apk
Resource
android-x86-arm-20240603-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
gdtadv2.apk
Resource
android-x86-arm-20240603-en
0 signatures
150 seconds
General
- Target 9330d36769fac8abc6a147d8e350acde_JaffaCakes118.apk
- Size 21.7MB
- Sample240604-a7ksaafd2x
- SHA256 912e6177b9f8cc1b889867660c64b3d0bc807f762aff278081130a741866cd9a
- MD5 9330d36769fac8abc6a147d8e350acde
- SHA1 9be893070d3052d5c51865e0b7cab68b60822132
- SHA512 fe85f910aa87df8287e1a7e0fa68ab4356b523ab1e177a9818ae8e8d7c1b7efe3b0301dd56d101278e788dc610ba2267dc799312e9e9d463cff668bae65aedf6
- SSDEEP 393216:eCBgRXhv61bEDJbgJ01roqzI7gDI0DjjiSM6Cof3wHPYS0/tBT+OIjUcdyIWyVYj:ngRRvUEFb2krdRbh/wHWFHIjPdyIZYv7
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getCellLocation zmob.com.magnetman - Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses zmob.com.magnetman - Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo zmob.com.magnetman - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver zmob.com.magnetman - Checks if the internet connection is available 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo zmob.com.magnetman - Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
description ioc Process Framework API call android.hardware.SensorManager.registerListener zmob.com.magnetman
Processes
-
zmob.com.magnetman1⤵
- Requests cell location
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:4274
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /storage/emulated/0/Android/data/zmob.com.magnetman/files/tbslog/tbslog.txt
- Size 1KB
- SHA256 210c650a8e827ac32a4e264768ae52bde7ecc5dcc5ce98b99e3e36e9bc18ea16
- MD5 98d663f5502a46ee73a36971c1238372
- SHA1 45a909a1cc6626381c50ae03c854158406097879
- SHA512 0386a5d0d2b6349da402d641c28af94837b8d07bacf8b9872716fbdaa7fe4fe4c16e2d5820076e08bb90335622b3b8ccbd4dab4be65c4e25e90d14c08d7316f7
- MD5 SHA1 SHA512