503b25751fb6f59b2848bebb8739e98f8dd9d6b9b4841ecfe62c1ca771d1c2f0

Analysis

max time kernel
159s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240603-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240603-enlocale:en-usos:android-11-x64system
submitted
04-06-2024 10:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

948eeab43bea60c4e20bc245f76ef785_JaffaCakes118.apk
Size

7.0MB
MD5

948eeab43bea60c4e20bc245f76ef785
SHA1

fd675e8cd919e2058d6c3b14aad80941e2fb5e2b
SHA256

503b25751fb6f59b2848bebb8739e98f8dd9d6b9b4841ecfe62c1ca771d1c2f0
SHA512

73a4c4b4739bce6de97a0fc0a97852ae910adfcfd0f0a56a1c52a04ea34d046005a5d7bc081999a78add792a35299b4a1424068a864d38af848ce35b67f1e40c
SSDEEP

196608:AVqjLxqDzak3eFm/KuEOq6vRyRS46f+AVBR:AI0Pak3eFm/KTONgRra+ArR

Score

8^/10

collection discovery evasion execution impact persistence

Malware Config

Signatures

Requests cell location 1 TTPs 2 IoCs

Uses Android APIs to to get current cell information.

collection discovery

Location Tracking

T1430

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getAllCellInfo	ir.ronak.ghazabasibzamini
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	ir.ronak.ghazabasibzamini

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	ir.ronak.ghazabasibzamini

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/ir.ronak.ghazabasibzamini/cache/1582435991586.jar	4679	ir.ronak.ghazabasibzamini

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	ir.ronak.ghazabasibzamini

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	ir.ronak.ghazabasibzamini

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	ir.ronak.ghazabasibzamini

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	ir.ronak.ghazabasibzamini

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	ir.ronak.ghazabasibzamini

ir.ronak.ghazabasibzamini
1⤵
- Requests cell location
- Checks memory information
- Loads dropped Dex/Jar
- Queries information about the current nearby Wi-Fi networks
- Acquires the wake lock
- Checks if the internet connection is available
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4679

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/ir.ronak.ghazabasibzamini/cache/1582435991586.jar

Filesize
9KB

MD5
e8e0527a01aefdb89afd2c508f131da1

SHA1
f1103e6b260c657ceb3d95f1b023af3fda8b133a

SHA256
f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce

SHA512
fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34

Download Submit
/data/user/0/ir.ronak.ghazabasibzamini/cache/1582435991586.jar

Filesize
20KB

MD5
fde2ee00cbd121cfab5290b078aa3ceb

SHA1
e2b77d5320e155e413d040a8c20020962065b2f8

SHA256
2897b0812077c654a9b3fbb0b6303d5cde681eeba7ad9981de65716c7810d685

SHA512
a9326aff8e454a2b4ac09984ef2a65fddd4dc146b4c44d839035549bff8c9fdaae490326d0b018f76c1ca2e4fb25426d74f550ca0950982fba632a023af99a56

Download Submit
/data/user/0/ir.ronak.ghazabasibzamini/cache/~test.test

Filesize
4B

MD5
098f6bcd4621d373cade4e832627b4f6

SHA1
a94a8fe5ccb19ba61c4c0873d391e987982fbbd3

SHA256
9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08

SHA512
ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

Download Submit
/data/user/0/ir.ronak.ghazabasibzamini/databases/__pushe_base_lib_db

Filesize
24KB

MD5
595f440ca99fe3bb4a8794791d7e0911

SHA1
d1c3df20863568bdaffc29f89778fe7c3c51eb1e

SHA256
8676444bc3d34c1383dd876b78934b9e26656f895d79a1ee7083a831f9129e37

SHA512
f8cc766dd6cfe0fa638f0edc6e57545af2f39bbbbd66fdcfbc68a2c47b3855ad82dce213512d4474e601a56cd1b26e6064a190ef5b1500eb4559c7a3de3a765b

Download Submit
/data/user/0/ir.ronak.ghazabasibzamini/databases/__pushe_base_lib_db-journal

Filesize
512B

MD5
dc011c1d42604a324c17ffeca442a36c

SHA1
0a7c0d437b18956d98b742db5a73556fb3c877b0

SHA256
358396f5e4d5d1879efbe04249e81b7111835e06d3521346dfe8c348ed3b2864

SHA512
6c7a0c38c47215b79c8b19b5102b0f3df94e4b79b15d0ff924bcfd2cd716a39c2fe927d0e70eae0b401bf515d290cba75071ecf351e2a42769fa06152d2bd1c8

Download Submit
/data/user/0/ir.ronak.ghazabasibzamini/databases/__pushe_base_lib_db-journal

Filesize
8KB

MD5
020d977d837f39067f245f57f9282a9f

SHA1
7da8d3c8695d0e824c85cbcce07260291ab4c8d9

SHA256
9def1561b80eb4ba2a825a7046953c067f9c4c6762087c34b6f5088ee7b43c52

SHA512
9c102d647c758b6103ecefac7de62ee1884e21354d1752274b50f9e7baf4a230748f347549f5964667018ce0b6c54e593c7ecf86816e4a1a885724bf9cbf88e5

Download Submit
/data/user/0/ir.ronak.ghazabasibzamini/databases/__pushe_base_lib_db-journal

Filesize
8KB

MD5
f098c65da4954a6ce4b32f7582685275

SHA1
85f7432007105078399193d1cea13a64da8b4b3d

SHA256
0579e136356a8c5fe37fd850f6a51c68a80a6d08e3eb364203abc7889e28427c

SHA512
f07484fb8822d227c30fb30922b49427fc1b86f55f894b624aac1a3cf8daf03705a6c7b968fd49c81de13c20032f9d23686c66646d66d308c478ddc1a26cca0c

Download Submit
/data/user/0/ir.ronak.ghazabasibzamini/databases/__pushe_base_lib_db-journal

Filesize
8KB

MD5
0eead36cff47232f37a7f9609e10db7b

SHA1
fe20635569eda223ee821db68cc5996e1d8d78b1

SHA256
4863aa5c0c733619422ff8ae53ece8ed090fbdb9d1de402550f325f3779ff36e

SHA512
d4b0c8ef9affbaebe8e2aeb4ec68260092cb9c854ee02792a36f7fe2e6d3ed10df6d258d6aea9422483166b56769fe1cbca6fbba73a768f72b66e985c2fec7f2

Download Submit
/data/user/0/ir.ronak.ghazabasibzamini/databases/__pushe_base_lib_db-journal

Filesize
8KB

MD5
6f5a6f637b07222d97072cb7d3ffda0f

SHA1
d1d0975a0b5c98661b0845f0ef6ba4545b68b942

SHA256
e7b7c31a4966696056b7dd1e20a1e92d84dd8526dcd291d7c885c33878344598

SHA512
929c5eeec64178805c4cd478b25bd6abf85ba03b4c219bdac24dc00ae9a33352d1152cb2762bceab350d01f92abf3a00b7a209619b3f46508ac259223087ccc3

Download Submit
/data/user/0/ir.ronak.ghazabasibzamini/databases/__pushe_base_lib_db-journal

Filesize
24KB

MD5
688cb922feb279c24d1824032d43e975

SHA1
4f5fb7a143b629703cac90d62d6f2c7b9a13e9b7

SHA256
a439ed8ffb43c9c8f860ec3106714cd2add0e5dbf30c666fb1da642bb171fdb1

SHA512
d54df3f8885dc536c9083f4a333e95fe0099616b8d44cf06c9f043fac8238efdd3732e1325c8bba8f8a738cc1100e4a51689e08f13e79c6030da48d52773aa3a

Download Submit
/data/user/0/ir.ronak.ghazabasibzamini/databases/evernote_jobs.db

Filesize
16KB

MD5
88aac234baced86b9637bff129abf1c5

SHA1
6c61ccd5cf17d4d8979ab784af0a16cf680e39db

SHA256
e70c90f9255685ea1cfa1745af89c003d37919328b749affa4841d03de754bab

SHA512
eaac0677b5bfc2937500dc4f3510f55148a7a0cd176a95b087502d49b831bb171ea06d93601f3d3c8d5fcb93ece7d4132a0d053b495c873e393650a9c63fb108

Download Submit
/data/user/0/ir.ronak.ghazabasibzamini/databases/evernote_jobs.db-journal

Filesize
512B

MD5
2e103534195238e986da5e43559929aa

SHA1
3e673501881a6b9069b5b5fe754732f0ff38109f

SHA256
cd24a47dca6c9dbf369e5620be15965983c90b24ba91d0ccd53ec8c226a2fc04

SHA512
9da352794fab12f41970678031a6b5e95df76d121776cd3a24bc5ab00e81ddb19ebce08df2a806d86a1f7c473f03e07f4aa7c783a6bdb13a1980827f1ef4a917

Download Submit
/data/user/0/ir.ronak.ghazabasibzamini/databases/evernote_jobs.db-journal

Filesize
8KB

MD5
852b99cd15183635b02f67625e558924

SHA1
a653d054f4e8ff4b026f876908e1da79863b50f6

SHA256
e5054e1a3851f97a650fb9ceccf0c5d2052434307f91a2d6b31d1f5b0ccfaa92

SHA512
fa1bb4866dbfbb4b28f56f190b250f001b86de6ef7706491fd8c00566097d579cc362aa6f12a71bd3d9d7991bfaabf4c22e738203adc02fb72820cfb4a7da851

Download Submit
/data/user/0/ir.ronak.ghazabasibzamini/databases/evernote_jobs.db-journal

Filesize
8KB

MD5
ddf146e3f3ece63816d964692d0ab9ac

SHA1
d539dab0f5f22e2ce1af4361aed079e3c0d48209

SHA256
9d163f827a82017544471a660df80e0be1d971634c9d51f9b23b34695dba8a0c

SHA512
5093a54c4038ef2fe62a0e64ab4f2e54fc0ca46c47d7f1fb9b3df8769937dc28acb486a979eb77815008d30a9f46685171103d00ced8081b63d0c4edbe9cc860

Download Submit
/data/user/0/ir.ronak.ghazabasibzamini/databases/evernote_jobs.db-journal

Filesize
8KB

MD5
b3183401ef6354e4229475fb7c34c0b0

SHA1
1ce35fcbeb38c3266eaeffd6e26822cb05e29b75

SHA256
fa0d5a9d4830ada5701ff2f6b0b487dc74e7016166e1848daa283af829ca45c5

SHA512
7fdf61aed36d8600eff126d2b009be30254387c8a78f60bdef485aabb32800c344d6fa20d731c6cb8946022cddb5dd6a715b644529afe22dcbc1bf4d1e08d830

Download Submit
/data/user/0/ir.ronak.ghazabasibzamini/databases/evernote_jobs.db-journal

Filesize
8KB

MD5
5544fd616da2262f2dbe47a2746fd9fe

SHA1
9f1c08ad1e8f2bad840cf6d6de2da639922dec47

SHA256
555905fc8ac484e97e61d5ae4968f2b233bed26f9d2a0015d794a26e7a9d9a8d

SHA512
99eef8841a495c571ef5ec619b1aa0ebfe8a555ded167a4f3cc345b3f99a2f7c09e7c820d2f124600b39410fe936031ec4943bf579f3aaea4dcc88293191e082

Download Submit
/data/user/0/ir.ronak.ghazabasibzamini/databases/evernote_jobs.db-journal

Filesize
8KB

MD5
c0fc00ea922ea4aa3afc3f4e2dec99fc

SHA1
99efcb95e4d79931d31cf3b0d6d41c92de57583c

SHA256
d2587b2c95a9d9f311a2f66684639aad36f44bd79fa8b25c953c9b44d618b7a8

SHA512
99b09a5a263ae2d6174cc11beb62e7c6d8a9d60164a0d70b2bc3016ac4a85c0abc3cc1b8829ec4e8570898aa4dc2e0a0b935cc76d20c107a21317d7b1b70ad8c

Download Submit
/data/user/0/ir.ronak.ghazabasibzamini/databases/google_app_measurement_local.db

Filesize
16KB

MD5
cc33d95e2859ddcb6475b03cd8806fc3

SHA1
84e3428b557559f9a438397e5fc062299a5cfe37

SHA256
ff95412dd750073bd5a016a8934f1417fd04149918d62139bdf99492b450553b

SHA512
48fe6f8656435b48ac730e7ba7ba930beaee4b908a1aed569d7fe046261655f7f34a33ad79ecdd2bbe1e7e24d1fd501fd479667fd26e391df7495bf6624087b2

Download Submit
/data/user/0/ir.ronak.ghazabasibzamini/databases/google_app_measurement_local.db

Filesize
16KB

MD5
4a3fccb7a403f048dce39edda562491d

SHA1
0d0b052f12d977f4f2f94387897506b6d62c0f7f

SHA256
d093750314bba53cc93479db0c14ac9143565951889525262ee07106400fa67e

SHA512
354717d86ae588a70666c5c8c08e3a86da88c3189610b1b96e188eee29f5d42b8474d2c4f3e8b16005ad758f5e7926051bb3e17502a76534eda330b6f42d070b

Download Submit
/data/user/0/ir.ronak.ghazabasibzamini/databases/google_app_measurement_local.db

Filesize
16KB

MD5
57278cad360a5afd893e24d1d2c66768

SHA1
4287f60eed357c2f35d3d9736fdd9ec5988b6803

SHA256
5abcc36da6978f7a45e1a774f509baf56ae85b0a1a30fd48e80c3ecfab769b2b

SHA512
4db3e25f38af77c79487aeb5e804f54863ce86f2931010267ead62caeaf30964bebc7727f3ecb00a3195432a67fe27cd47981ffe1053a1995fd3e701e64e54e2

Download Submit
/data/user/0/ir.ronak.ghazabasibzamini/databases/google_app_measurement_local.db

Filesize
16KB

MD5
7593aeae581b7749b4da4a4ff610dbeb

SHA1
d05449fd85ff9cdbc5abd904d51ccabda54bd2ba

SHA256
7e1be933ef037ab3a5e5ac79e7082cb571a5d2d6ed301ef2b4cf29262449832c

SHA512
2ed69375f22454e4be2e154ba5f9f40b28cdedb8aa505df2cc5eb4763c63da218a5eedcd90af8d26773746ef75b5859cd0b6667a92bfb893e837a1b65220afa3

Download Submit
/data/user/0/ir.ronak.ghazabasibzamini/databases/google_app_measurement_local.db

Filesize
16KB

MD5
e11508d350c851e5ff3f545f75b13340

SHA1
db5dca6efba82aef45e193a1b812cfdb80883e06

SHA256
88d8c9eadce4fbd9b93b7400b96dbc534dc0d221f79a8a1a38e456e06ce49f6f

SHA512
0e3a2cd80b52f60fb1c070ac99cca14d4579499f1bc498818c57670fc4e79d9c75ecb06a3cd2df16510a3649203a613ea8489fe999cf9475b8558980cfa9330a

Download Submit
/data/user/0/ir.ronak.ghazabasibzamini/databases/google_app_measurement_local.db

Filesize
16KB

MD5
d9cf75fdd1c2292d986f6c3d5d60f2c8

SHA1
07ecb1d3a26d952ae5fecf54f36699ab498510b1

SHA256
2d227e9b7a044c8e10294f6a831fb92d81ea9582381796d87f35bd268e37538a

SHA512
442c96e4b4c79b8d1c64dd3a6d6088ae1dace441e78d830dfb3190ee1c0fafebc606fb432071b4a1ad1a4ba9b68c7877b0bce520ccc88708feaf82bbc474e0cb

Download Submit
/data/user/0/ir.ronak.ghazabasibzamini/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
37a85fb406106bbd504fec73b8da8201

SHA1
690f78f6fbbf7a5998336e458cf4ab15d1aed080

SHA256
50baa4660cdff4c9981aa5986cf04af6cefbac8ae09a3448a2e1154a19e7f7b1

SHA512
cf7c3c79e87ee96bcc714f8b040ec39baaebca6e4bea6db004149245ca81421fc51ec362bee98d72111618c227edd47e7763bf6928ed62586ed344525e5ce8c1

Download Submit
/data/user/0/ir.ronak.ghazabasibzamini/databases/google_app_measurement_local.db-journal

Filesize
512B

MD5
2ac1dd2632c2622c4fbfc4d569f4cee6

SHA1
14a3ccef094d06ea3644d1860da77c3383fde6be

SHA256
12a3e5364bd67f42f6a63e4f01611ff411bc259d953e6e496731611ca8329838

SHA512
521a4acc9d4010690404010ca006850688fa8cededffc03cd706fff0fcf83ec746d4ed16a2384701b7f5b4d07d286b7b9db9bcf99973d262be9e80eaab7895fc

Download Submit
/data/user/0/ir.ronak.ghazabasibzamini/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
1eaf48df667ee130d9afa79bbe94b64b

SHA1
7d40d8142410be6f7467439fa7ad649006c5a6d4

SHA256
451751efb48b67e289503430c641f9df67bc9f8d591080064d66578d1ec4c4f0

SHA512
9a2813da68518ec773b5de8af00fe1e5877f5cd7ede738932658993a26e328b23834deec1d23326fa8990a7b9461e21b4a69c3f188e5ef02b3ec2bbf5c06d15e

Download Submit
/data/user/0/ir.ronak.ghazabasibzamini/databases/google_app_measurement_local.db-journal

Filesize
4KB

MD5
4d35673efd26e9b24111982642e4930d

SHA1
463b9da5e41db2b04edb54c89ac4290454fd0d6f

SHA256
3d7e66bb03f2dae50ee2c4de0ce104e45fd92072c59f504a7341875a9dc89ab0

SHA512
6b0fdc84be282d3ee0e4a6516212557e34831fca17cc8411c39ef06a2cf4a11c2c9081b9814bdb777316395cf15b5cdc1a9c78ffc613d78e8587b274af56473f

Download Submit
/data/user/0/ir.ronak.ghazabasibzamini/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
070d980c2a88942985fad7aed52983d2

SHA1
aacd6b5172ea35657637cb8f31f58240b99a5c31

SHA256
aa840c2a45bc21a87ee5ca59afc38c9266f07a83faf76c21f928b591da90d877

SHA512
62f77414fd5e936b630dc798524a397eefd778bea0b8e3f32a25ecd35a7079c3897afb2fb0e1abb538fc2fa4965c9acc4a2ee67f4e990d8c8db5be2b6d99e981

Download Submit
/data/user/0/ir.ronak.ghazabasibzamini/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
e302fddea47195116363e8d4f6dfff67

SHA1
3fb8c46111a67cf5f03f3ff93b64cc133b1c5168

SHA256
0ea0c765f7437c9134b2f0893d24dc192a59d2190f3a6ea58340fb215f0f5699

SHA512
53da687bd6ab7973e1600af435e9c5cb669c1db1806520b9a1f86cee20fd052326d154be29f6b199ba051d7141618b62dd055beefbc8252f2cbf011f4c549110

Download Submit
/data/user/0/ir.ronak.ghazabasibzamini/files/info.db

Filesize
11.0MB

MD5
3ee9167ca71f1ac8d3195bbfac42a159

SHA1
dba0c1c007870a1ed7824459f2e4bfa45927934c

SHA256
745c538ad35c680a7a4cfbd4340d5f0944e7c703d48f7dcab13a0077121d5184

SHA512
289ca38f05575c97aa138a2787ed86555c7fb2ba12885297556f85f69157c836d87178e31110b570419bcce2946403645fc06193e97989f63fdfdbdd1bc63a00

Download Submit
/data/user/0/ir.ronak.ghazabasibzamini/no_backup/com.google.InstanceId.properties

Filesize
2KB

MD5
9a496ebaa04f6fcb083b02aaa0fec3f8

SHA1
675bea54c16d9d0fc85f8e143d2a9c947ab21301

SHA256
9e97a7fc80f260c65d9638e68259edcda460ce9c648a9ed0ab8e0a176c8f2d7a

SHA512
592a604c0e18ac54d49ab569b0f3657d9586409497a3c60b95c07eb8578350991157e9b846d0bbffa4cca88382c4ad99bc14698d9459b148542706ef81463680

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads