51a20d14b3b6eca1f88f974f4eb85ccbbd95e6e869434e244b600f9b7cbea4f0

Analysis

max time kernel
148s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240603-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240603-enlocale:en-usos:android-11-x64system
submitted
04/06/2024, 19:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
960f321ea40284d2448f74fa084a4152_JaffaCakes118.apk
Size 1.8MB
Sample240604-yk2paaac55
SHA256 51a20d14b3b6eca1f88f974f4eb85ccbbd95e6e869434e244b600f9b7cbea4f0
MD5 960f321ea40284d2448f74fa084a4152
SHA1 fcdcd49a1e27efc3caa1f702e8ab90fa890c9b57
SHA512 5076f8aea374878f9e26f3fa381ee8549b14975099f8a5552eb38e2604824ec06f697570f8fbefd5f0118070ed6213f43dfd7238fdb7d18607466badacb87c74
SSDEEP 49152:4co+NV20WMDDgH8YRaomEBN3/o0QK73Z5m:4b+SJMocY3BNvo1R
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection credential_access evasion execution impact persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4664	com.blueboat.justtwopics.hack

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.blueboat.justtwopics.hack

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.blueboat.justtwopics.hack

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.blueboat.justtwopics.hack

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.blueboat.justtwopics.hack

com.blueboat.justtwopics.hack
1⤵
- Removes its main activity from the application launcher
- Obtains sensitive information copied to the device clipboard
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4664

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

evernote_jobs.db

Path /data/user/0/com.blueboat.justtwopics.hack/databases/evernote_jobs.db
Size 16KB
SHA256 9d74f93afa5a179b1ba2f19f154b2880aa8b99c88209802099045a0874d2426a
MD5 58c0b6e45328752b20ac6e719ac034f8
SHA1 372b2638afd00bbbc4034657b3df3d2e428fb367
SHA512 2d347d5824b9ab701e341c89e8327a95fd6bab8e92ee15ce9550da368d773e22bff304072a4854df5ab763750a7401f7aa61a49e3292d62c27fa9f20536eb3ab
SSDEEP 12:TLpvpN0KkYrZASBMAB1G0d/P6dMbWAz9m9W3dOsuA3MTzeRmBEyPbBvOw:TLhpOKRvTZYAZ3mGSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

evernote_jobs.db

Path /data/user/0/com.blueboat.justtwopics.hack/databases/evernote_jobs.db
Size 16KB
SHA256 a0fa5272916a71f34f9861f788302de1b23b91e81ab72218da6f808831bff5ab
MD5 5053568be969343dfa106ea0d14460dc
SHA1 07cc5c512a932f877055e9b695b6cbf860463c07
SHA512 329f552451e2d42fc46a2c850465365481c4e9a83a51aa74a620b0dd79276ccae5763b1e97eea278312795407631929e9640a5b4820983a0096bba837e4b2b99
SSDEEP 12:TL8UpN0KkYrZASBMAB1G0d/P6dMbWAz9m9W3dOsuA3MTzeRmBEyPbP/U7uV:TLRpOKRvTZYAZ3mGSP/UCV
MD5 SHA1 SHA512 SSDEEP

Submit Download

evernote_jobs.db-journal

Path /data/user/0/com.blueboat.justtwopics.hack/databases/evernote_jobs.db-journal
Size 512B
SHA256 8d4fdd0e450e1b75d72a29874313b1fd0146caa3d1fe910befc2ab360b5f840f
MD5 7b0b4e7b1dc4968dc4ebea717fff53c0
SHA1 1ceec37828d1ac2f636c19334d766703c6c5bec9
SHA512 3f90eebe152d7fd43f677a821f5c7df9f778e8a82e8d582ef43d2a529101b1c6fbc0524ac132ee1762b71895cc715bdf6dcad459b0db0c546211c2e5611c87c4
MD5 SHA1 SHA512

Submit Download

evernote_jobs.db-journal

Path /data/user/0/com.blueboat.justtwopics.hack/databases/evernote_jobs.db-journal
Size 8KB
SHA256 efca648a5a0da5c3a3dca6bfa267f5ca8fa71261dc4fe069551013ebc91aeaa2
MD5 b4efb61cebf894480a5616dc3e670899
SHA1 02c36ebde7095f089168524877e8075f8d2d6ab2
SHA512 5f83a7483c625a1ff51976776f4d02550da20f9c2fd0030e9cb8d424acc90d7040d6b8d9b699eeb9b2333b066505d3a19cfb42248030b2e8b385a8cb277b9bf9
SSDEEP 6:7+/l92l4n1ORg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKr:7+tkqLiuWdYRmBEyPbE
MD5 SHA1 SHA512 SSDEEP

Submit Download

evernote_jobs.db-journal

Path /data/user/0/com.blueboat.justtwopics.hack/databases/evernote_jobs.db-journal
Size 8KB
SHA256 660a6c25a4afff1a30c73a1a9adc6408c5da4769d5545d2953c00209b18ef23c
MD5 f29bf106012921c13a682d9b4167b074
SHA1 379e10f7bcb7b7d12bcc1e865ac2b88e53feba9e
SHA512 3219d6f1d9c9cb59ddb07abecfbb1d40e0bc54939e0f7cddcb37c9e6cfa51f3fa9070a0f07a9e36b827a62cc6d3585bdadb76ad67a15124fe5e4b44f8ff5a2e5
SSDEEP 6:7+/l9yFPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKo8t/YK:7+tKqLJdeWRmBEyPbl81YK
MD5 SHA1 SHA512 SSDEEP

Submit Download

evernote_jobs.db-journal

Path /data/user/0/com.blueboat.justtwopics.hack/databases/evernote_jobs.db-journal
Size 8KB
SHA256 f720577a4ff4737b059e12172f97630a094dc6e828bfb63e2ccaa501d856f566
MD5 984ca624ea4dccade8f9524c8653359f
SHA1 ab7649913433659ecf5cb9d0587f44d8e6f59f8b
SHA512 4c32664687bd4af99f211a7e1e743a0578171cc9c3e9d2812beaf117ce1a63bf4b1f7d61d9a695a7507c1326e85decb36bf38358ae4d0963115340fa2e8f7db9
SSDEEP 12:7+tZuvqLpvpN0KkYrZASBMAB1G0d/P6dMbWAz9m9W3dOsuA3MTzeRmBEyPbtn:7+tZuvqLhpOKRvTZYAZ3mGStn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads