Analysis
- max time kernel
23s - max time network
130s - platform
android_x86 - resource
android-x86-arm-20240603-en - resource tags
androidarch:armarch:x86image:android-x86-arm-20240603-enlocale:en-usos:android-9-x86system - submitted
04/06/2024, 19:51
Static task
static1
Behavioral task
behavioral1
Sample
960f321ea40284d2448f74fa084a4152_JaffaCakes118.apk
Resource
android-x86-arm-20240603-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
960f321ea40284d2448f74fa084a4152_JaffaCakes118.apk
Resource
android-x64-20240603-en
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
960f321ea40284d2448f74fa084a4152_JaffaCakes118.apk
Resource
android-x64-arm64-20240603-en
5 signatures
150 seconds
General
- Target 960f321ea40284d2448f74fa084a4152_JaffaCakes118.apk
- Size 1.8MB
- Sample240604-yk2paaac55
- SHA256 51a20d14b3b6eca1f88f974f4eb85ccbbd95e6e869434e244b600f9b7cbea4f0
- MD5 960f321ea40284d2448f74fa084a4152
- SHA1 fcdcd49a1e27efc3caa1f702e8ab90fa890c9b57
- SHA512 5076f8aea374878f9e26f3fa381ee8549b14975099f8a5552eb38e2604824ec06f697570f8fbefd5f0118070ed6213f43dfd7238fdb7d18607466badacb87c74
- SSDEEP 49152:4co+NV20WMDDgH8YRaomEBN3/o0QK73Z5m:4b+SJMocY3BNvo1R
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
-
pid Process 4278 com.blueboat.justtwopics.hack - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.blueboat.justtwopics.hack - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.blueboat.justtwopics.hack - Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
description ioc Process Framework service call android.app.job.IJobScheduler.schedule com.blueboat.justtwopics.hack - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.blueboat.justtwopics.hack - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.blueboat.justtwopics.hack
Processes
-
com.blueboat.justtwopics.hack1⤵
- Removes its main activity from the application launcher
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4278
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.blueboat.justtwopics.hack/databases/evernote_jobs.db
- Size 16KB
- SHA256 55f8907e91226ef43a05583c7b4623b4e26994b62d20c8603975ccc1fa3b9409
- MD5 5d85664f8e614fcaef42be2e6f649027
- SHA1 09c6288922102f6114a823f4992415fd3373d61e
- SHA512 3d6006a3e82d00fe9bc443e940acc5df12ec84114fcbcf8fbc8099c085cb1229b21a217b7445129b50558bfef5100894686d7359eb80b7ef087b65c7be3bc6e9
- SSDEEP 12:TgSpN0KkYrZASBMAB1G0d/P6dMbWAz9m9W3dOsuA3MTzeRmBEyPbBvOw:TrpOKRvTZYAZ3mGSN
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.blueboat.justtwopics.hack/databases/evernote_jobs.db
- Size 16KB
- SHA256 1ba72c0cf447ae1cd60337de285d60476ee0c1ad656e94886bbe1240f4553259
- MD5 658cd5828dcf0f655c102c72e9c3cfee
- SHA1 876a6614bba1e03a056f1c9ea692272f504be510
- SHA512 320b89fbcc06c95d45fd4a8d2b69e900cff8ec83506a169504e6409f2b79869f6fa1b0a65638f3cf85fd464ccb2d0c81a70b03b1e9c094a6f9921fe4f2c84316
- SSDEEP 3:pqTwDSxttfMRv+HvrqtsDiA:pqTGSBhuU
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.blueboat.justtwopics.hack/databases/evernote_jobs.db-journal
- Size 512B
- SHA256 fffe490129a9a077366b98686198a5dbdf3b9f7eb708ea82382845f6bf15ae2e
- MD5 46c40ca3fdc24ee3503c435b3d8ac0ed
- SHA1 87fef54c7af5e1ff92dbbf270d9647baa50b1982
- SHA512 43dbc12b94bcb84ea6b0a936575bfc079640bc75bedca833ddd7ca1a0cd934a4fee2450bf0c9d5eca4ae7f56467c0c97bfba5f19f53b30c419407422c259fa5d
- MD5 SHA1 SHA512
- Path /data/data/com.blueboat.justtwopics.hack/databases/evernote_jobs.db-shm
- Size 32KB
- SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
- MD5 bb7df04e1b0a2570657527a7e108ae23
- SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
- SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.blueboat.justtwopics.hack/databases/evernote_jobs.db-wal
- Size 28KB
- SHA256 33b9ab5a97061ac9e6dcf9c43b960423f117dd6a39a99a868dcf3d3dfc7c6f3d
- MD5 c3b48885c4ad7866ba7381f9b665ef46
- SHA1 0dd05d3355ea14b4e92b0739e070ff016e261dd3
- SHA512 eccd4cdc984025d16f85933545117d900b62f01fb6d37139420d5e1d88817a1779e9c013071351d326878b767d52837013b736200624988612f0817ee1ef85df
- SSDEEP 24:Ke/O4mzyGSP/Vm0i6rpOKRvTZYAZ3mGSP/:2zNSP/VzRYAZ3pSP/
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.blueboat.justtwopics.hack/databases/evernote_jobs.db-wal
- Size 4KB
- SHA256 fe32da7e7c005ffc081a6041d682c15bec66b0ed8ad82a99ca3f3103b468e890
- MD5 11b68ef625552f4d317774d8a29b64a3
- SHA1 cb43883685166373f8d88da8090bf3ef59c5c247
- SHA512 03dbef696972a8ac3c684e7f55d9dd6e7f937eae1e5ef14b5e3c02f3cb9e1381faafc90a861820d8c213defc52f0e55c5e7295fff2427677697915255447f588
- SSDEEP 3:OlH/l94ZGO+7T9dQVHk0TwDSxttfMRv+HvrqtsDiA:K1Opk0TGSBhuU
- MD5 SHA1 SHA512 SSDEEP