Analysis
- max time kernel
48s - max time network
177s - platform
android_x64 - resource
android-x64-20240603-en - resource tags
androidarch:x64arch:x86image:android-x64-20240603-enlocale:en-usos:android-10-x64system - submitted
05/06/2024, 04:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
973358b2e72a0ef28493e1e6634e5f11_JaffaCakes118.apk
Resource
android-x86-arm-20240603-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
973358b2e72a0ef28493e1e6634e5f11_JaffaCakes118.apk
Resource
android-x64-20240603-en
7 signatures
150 seconds
General
- Target 973358b2e72a0ef28493e1e6634e5f11_JaffaCakes118.apk
- Size 2.4MB
- Sample240605-e6xgxaec4t
- SHA256 568d6c2305bcf24d4f48826477b7733cd951fd5fe0aed660230e10fa5728abc0
- MD5 973358b2e72a0ef28493e1e6634e5f11
- SHA1 006bc264a05b9676981e1bce145df184a561a03f
- SHA512 f51af3c00483abb5706189f1aa6c7865242b8e961269eb864215ddc760586048eb07ea0f679e8668c4dc6c214c99b0ac060ae87452f5a5a770e6c6f9743e59f3
- SSDEEP 49152:GWMH0qyYrlSEhf1JWszjPf7DkSpbULngyhTitVdEz/BSrqhMRc8kO:zA0qvIE0szjX7DbpbWgyh3zXb8Z
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.bbbbbai/files/_RunDex_/b.dex 5024 com.bbbbbai /data/user/0/com.bbbbbai/files/_RunDex_/b.dex 5024 com.bbbbbai - Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.bbbbbai - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.bbbbbai - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.bbbbbai - Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.bbbbbai - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.bbbbbai - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.bbbbbai
Processes
-
com.bbbbbai1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:5024
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.bbbbbai/files/_RunDex_/b.dex
- Size 146KB
- SHA256 4480fa5c1c5786955b31e45a88e03491d8b0512a970b567f1a55217090f8f398
- MD5 2ccc734b9d13580b4cc83d5ae4e10d01
- SHA1 f452f385b21a2678d005474a4d18b01093d681a3
- SHA512 430cbdaa240732691284716a01e9e14e678811b3a83fa093aaca8b6dfdb43dd37114c10006a3c8dc636848cef0bdfcf97e2baa2bd63243be3eb67d8dbd797880
- SSDEEP 3072:ULYcKsdDDf3p3x9TGfmg9f5JEzoFn3cEZbPKcxo6aZw+DG0gSHm9qOr9g9N:ULe0Dlx9TGfmg9fDE0Fn3cEZbPboC4PV
- MD5 SHA1 SHA512 SSDEEP