Analysis
- max time kernel
138s - max time network
129s - platform
android_x86 - resource
android-x86-arm-20240603-en - resource tags
androidarch:armarch:x86image:android-x86-arm-20240603-enlocale:en-usos:android-9-x86system - submitted
04/06/2024, 11:14
Static task
static1
Behavioral task
behavioral1
Sample
94a079810e2d8bc5bce1f51689b74481_JaffaCakes118.apk
Resource
android-x86-arm-20240603-en
Behavioral task
behavioral2
Sample
94a079810e2d8bc5bce1f51689b74481_JaffaCakes118.apk
Resource
android-x64-20240603-en
Behavioral task
behavioral3
Sample
94a079810e2d8bc5bce1f51689b74481_JaffaCakes118.apk
Resource
android-x64-arm64-20240603-en
Behavioral task
behavioral4
Sample
res.apk
Resource
android-x86-arm-20240603-en
Behavioral task
behavioral5
Sample
res.apk
Resource
android-x64-20240603-en
Behavioral task
behavioral6
Sample
res.apk
Resource
android-x64-arm64-20240603-en
General
- Target 94a079810e2d8bc5bce1f51689b74481_JaffaCakes118.apk
- Size 4.8MB
- Sample240604-nb6xjaec5x
- SHA256 6ddb3538d42dc88e76eea1a4824ec975a9d753ab4d0ab5a2973049526c3256ef
- MD5 94a079810e2d8bc5bce1f51689b74481
- SHA1 5f2df6ce49be0f818818d7156d95756e4f3a8c04
- SHA512 a7de8fbe87ac588c388ae42dd62b32b99b031eed038cb8eca7d1274cb0c28a2498678237eb5d6eadb1da9ef0406e7193d8672f8fbf9556b853140da8d4982cc6
- SSDEEP 98304:GP8QwG+nPdfbNvN9J8CleS6NuwGxrP6E40ydaMwafNHJq:GkQwvnJNvneSA+rPJGdSUdJq
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
description ioc Process File opened for read /proc/cpuinfo com.nhcq - Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
description ioc Process File opened for read /proc/meminfo com.nhcq - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.nhcq - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.nhcq - Checks if the internet connection is available 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.nhcq - Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.nhcq
Processes
-
com.nhcq1⤵
- Checks CPU information
- Checks memory information
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4291 -
getprop ro.product.cpu.abi2⤵PID:4326
-
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.nhcq/app_tbs/core_private/debug.conf
- Size 101B
- SHA256 9d1be1807105314e9d67f64a02eefd008d5e5bef094f35b86a1c48d373e988ce
- MD5 a5b374b3c917149067aed3f377b30e86
- SHA1 a0da5addbaca80f9286efc0e35d5bfbbba3e3d5c
- SHA512 ac45993f37a758b791c44d720f56997867d57f44b9c708f8aa67930025899ca1b1bb33ecd2b0d8e23be898e4ff3c00b5ee0452e6e7426c2160108fc554cd2f31
- MD5 SHA1 SHA512
- Path /storage/emulated/0/Android/data/com.nhcq/files/tbslog/tbslog.txt
- Size 8KB
- SHA256 d4e71aadc751fd73ea62df948963be0c6ec76b5c0af49b7135316883a2dbd2e9
- MD5 0c9f58b55253ed416e4501c5d32c968e
- SHA1 660dd680b1b21a7d87a6ca7db13e59069f4ea2d9
- SHA512 9d0186cf29965aa7917bf8822ca7049594964613626a693d9e65c018c4e833d79a8db066d0d4ca99fe4b9e1cb1a2d1c2d3ab4a419be7831304a82956cd6cf4ea
- SSDEEP 192:oYYZ3IkI23Q8PG1dN7iH/mY6XD/7CPUJ45:vYZ3uHVYmtEUJ45
- MD5 SHA1 SHA512 SSDEEP