5244b6a83b9d5d670c195abb1a92817626cc8eab6deef9c3180fa6e2763a926e

Analysis

max time kernel
122s
max time network
130s
platform
android_x86
resource
android-x86-arm-20240603-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240603-enlocale:en-usos:android-9-x86system
submitted
04/06/2024, 11:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

94b20e2e00e1e629236b9998d197535f_JaffaCakes118.apk
Size

17.8MB
MD5

94b20e2e00e1e629236b9998d197535f
SHA1

e2682e149680164b1ddfe8626cf9acd274b224da
SHA256

5244b6a83b9d5d670c195abb1a92817626cc8eab6deef9c3180fa6e2763a926e
SHA512

8213fb49b1bf6265145d0c552850a0327fa63e275e154c5e5d47e31955fb5cbfe5ffbfbd7f1c1aca6aa03e1aa58d926b0e06fffe345e8dd478da4aef003d9fe5
SSDEEP

393216:9bjhmF60zXL4AoRPS/LbzmsGxBh0uwfp1pWk1FrpKrJ1:phm5bVAPS/Hy9IrprWkfr+1

Score

7^/10

discovery evasion impact

Malware Config

Signatures

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.gameforge.kingofcastles

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.gameforge.kingofcastles

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.gameforge.kingofcastles

com.gameforge.kingofcastles
1⤵
- Checks CPU information
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4256

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Command and Control

Exfiltration

Impact