Analysis
- max time kernel
134s - max time network
133s - platform
android_x64 - resource
android-x64-arm64-20240603-en - resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240603-enlocale:en-usos:android-11-x64system - submitted
04/06/2024, 11:14
Static task
static1
Behavioral task
behavioral1
Sample
94a079810e2d8bc5bce1f51689b74481_JaffaCakes118.apk
Resource
android-x86-arm-20240603-en
Behavioral task
behavioral2
Sample
94a079810e2d8bc5bce1f51689b74481_JaffaCakes118.apk
Resource
android-x64-20240603-en
Behavioral task
behavioral3
Sample
94a079810e2d8bc5bce1f51689b74481_JaffaCakes118.apk
Resource
android-x64-arm64-20240603-en
Behavioral task
behavioral4
Sample
res.apk
Resource
android-x86-arm-20240603-en
Behavioral task
behavioral5
Sample
res.apk
Resource
android-x64-20240603-en
Behavioral task
behavioral6
Sample
res.apk
Resource
android-x64-arm64-20240603-en
General
- Target 94a079810e2d8bc5bce1f51689b74481_JaffaCakes118.apk
- Size 4.8MB
- Sample240604-nb6xjaec5x
- SHA256 6ddb3538d42dc88e76eea1a4824ec975a9d753ab4d0ab5a2973049526c3256ef
- MD5 94a079810e2d8bc5bce1f51689b74481
- SHA1 5f2df6ce49be0f818818d7156d95756e4f3a8c04
- SHA512 a7de8fbe87ac588c388ae42dd62b32b99b031eed038cb8eca7d1274cb0c28a2498678237eb5d6eadb1da9ef0406e7193d8672f8fbf9556b853140da8d4982cc6
- SSDEEP 98304:GP8QwG+nPdfbNvN9J8CleS6NuwGxrP6E40ydaMwafNHJq:GkQwvnJNvneSA+rPJGdSUdJq
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
description ioc Process File opened for read /proc/cpuinfo com.nhcq - Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
description ioc Process File opened for read /proc/meminfo com.nhcq - Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.nhcq - Checks if the internet connection is available 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.nhcq - Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.nhcq
Processes
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/user/0/com.nhcq/app_tbs/core_private/debug.conf
- Size 101B
- SHA256 08f0991cbfc9d968e89d9b25e2d313c295e841805ee6d08d228f864a628a7b3b
- MD5 d2dfbb83d285ad461cbf9c9adff3bf36
- SHA1 04c95a94184d214bdb5fe23d76dd3391a75b657d
- SHA512 a8cc880bb97094b7d81eac4caa003a36f14cd72e526db7daad8438ba0144dfdac341f1363d4cf71b3ff18d3b9aec4d36fb4b8fcac68d938538b012c6cc64413f
- MD5 SHA1 SHA512
- Path /storage/emulated/0/Android/data/com.nhcq/files/tbslog/tbslog.txt (deleted)
- Size 8KB
- SHA256 f7d6fb05dbe3f85c04c4cbdef4a5ba093566d028848eb3cfaf389e1c12b6533c
- MD5 264ee19b2d3ecb9d00ddba1ac487a473
- SHA1 85c7a1d696d41f31186e30598a18acc27dd760ee
- SHA512 54565b6d54a025dbddc9b6b7c2b0bd7b72ee0a958209fa616c45a8f8714b170c5f7bb82edee605f42919c0cdbfe7520383c1ad19fa125299844002a21d8ff035
- SSDEEP 192:45xoudO1yNEz27pfHQxdSTT08zwl++F12lMpgDLN25pnCmEJjNHQ5ZnQxtZ2Ip6I:CyX0jo0BdDDOjC
- MD5 SHA1 SHA512 SSDEEP