c06b5750f4fc2e2a9ef08e1e282bd07245115d00f08a885ade45c015961a089a

Analysis

max time kernel
173s
max time network
169s
platform
android_x86
resource
android-x86-arm-20240603-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240603-enlocale:en-usos:android-9-x86system
submitted
05/06/2024, 04:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9735da903d3999777b5d7ba01097c53c_JaffaCakes118.apk
Size 5.1MB
Sample240605-fa2bnafc73
SHA256 c06b5750f4fc2e2a9ef08e1e282bd07245115d00f08a885ade45c015961a089a
MD5 9735da903d3999777b5d7ba01097c53c
SHA1 68c6fbd8e93e604c98a4e6172d430e66b261cac6
SHA512 f6496de3ec6a55466ed8123b23d3374cb611df3609d6e55fc010ebb4e26107946e4906a5f1b875066818b9399999e133c7d4dc23bcba1376363c7249aa49d47a
SSDEEP 98304:/uKHbWNM6dKojPRdTWxejiMtExKWURr9izr+gGDlwIZ+Ap81+EYmOEL:/Z/6dKEPRdTyMltEwWqr4r+gGJjt8fZL
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

banker collection discovery evasion impact persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.mobi.screensaver.fzlwzksq2:com.mobi.screensaver.ScreenSaverApplication

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.mobi.screensaver.fzlwzksq2:com.mobi.screensaver.ScreenSaverApplication

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.mobi.screensaver.fzlwzksq2:com.mobi.screensaver.ScreenSaverApplication

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.mobi.screensaver.fzlwzksq2:com.mobi.screensaver.ScreenSaverApplication

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.mobi.screensaver.fzlwzksq2:com.mobi.screensaver.ScreenSaverApplication

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.mobi.screensaver.fzlwzksq2:com.mobi.screensaver.ScreenSaverApplication

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.mobi.screensaver.fzlwzksq2:com.mobi.screensaver.ScreenSaverApplication

com.mobi.screensaver.fzlwzksq2:com.mobi.screensaver.ScreenSaverApplication
1⤵
- Queries information about running processes on the device
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4301

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Credential Access

Discovery

Location Tracking

T1430

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

city.db

Path /data/data/com.mobi.screensaver.fzlwzksq2/databases/city.db
Size 147KB
SHA256 43af888145a2711000f625255c1e786ccb2a75f4ab594cd16bae957c976ceb7c
MD5 cf9c3c48c77bed980260bf3d29d8f570
SHA1 bd68dd512738332f7661b75001af6b6c079a0fd3
SHA512 db7a61c82f17643a437ee2987bd4171143aa0776927d6159567b3023ecaa99aa6f79d688c87846f2ccae56884e984701589c14664793b7c0b015568825c0bb22
SSDEEP 3072:lNjFwM0vinPeY9hj+mdvU+rf0yAt1c/IJKR7G460mOjs:TFmvinPeAhCmtU+rMGR7Gars
MD5 SHA1 SHA512 SSDEEP

Submit Download

city.db

Path /data/data/com.mobi.screensaver.fzlwzksq2/databases/city.db
Size 2KB
SHA256 60e0e12e342c5326a36ca4daa33c574866292ce8dc4a00d2f9228b0814190427
MD5 e21f28ecef2ff3affdd22b9a671184d9
SHA1 35497b066705e87c32f03c164c4531f96df2e6d5
SHA512 28a22d6cdb4ecb212437c9ba4cf071225513b579666350f46ea55503d2853f6e4970ae16249677c38878f86164d8e45fa943d83f0f0cd6ab5542977a3e5be132
MD5 SHA1 SHA512

Submit Download

city.db-journal

Path /data/data/com.mobi.screensaver.fzlwzksq2/databases/city.db-journal
Size 1KB
SHA256 7fddcde621ca217873bbcbfb56b805d7961ff54857ab503cd175e9735e56b34b
MD5 68531e54dcd3870a023c5f7b9c1ef137
SHA1 8074f5d5b13abb006f52ef1a3386a1173b6c8d93
SHA512 af67e1c43da3b984c7649807b8db07d0eed13fec4b8928f40fa8904cabe4b59c591a21de68de87dde14ed593a283e794d223e65b7fcf1f386cbb135a49cb5073
MD5 SHA1 SHA512

Submit Download

city.db-wal

Path /data/data/com.mobi.screensaver.fzlwzksq2/databases/city.db-wal
Size 2KB
SHA256 7e0ebe642ee5e1144921d54cf8aed983dd27eb5555a7aad8c818850c3b3597a2
MD5 e4ce413b0f1fc3a2fcd00855d5ff90a7
SHA1 bd5d54c9186e2835ec8b61f54e1f5d2755de2501
SHA512 1cf6276ba82e673c3fe0ebfbd439dea17d154c5475ac2949b8d879a6dbd475a23dfe417cc1eb49c9f88b9edc81c70346f21a31771f043f230b760acd47f8daf8
MD5 SHA1 SHA512

Submit Download

.costdb-shm

Path /data/data/com.mobi.screensaver.fzlwzksq2/files/.lf.uservalue/.costdb-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db

Path /data/data/com.mobi.screensaver.fzlwzksq2/files/TDtcagent.db
Size 28KB
SHA256 6fe604dba0eb867db90b1cbbb10453ea4a57b25bb7b1bc954e9ddd3592628972
MD5 d89a1ca13811906346b153ba7d94a2d1
SHA1 29123c6f1cca431c84feec34c6d250e33b9c62b2
SHA512 a8542f74c2b9e4fcf7d800685ec2af9c92d49332753fb08f27952f28309e8925a624a98c75e49e71646ddcefcd27073520350e90800e358496bae6d128e6bad4
SSDEEP 12:rqVgiN61Kk5MEXX/QOulCM8WRQOulx+ygPQOulxfkQOulBLQOulRQOuleq0RQOuD:rrixG0Z0U0q0BL0R0el0tOs3D
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db

Path /data/data/com.mobi.screensaver.fzlwzksq2/files/TDtcagent.db
Size 28KB
SHA256 57d6de34bd76071a9b4c02b43a542f646d95bf2c3ff8e17df72dd98f49da825e
MD5 9cabb1f196851d54380d48734eca86c1
SHA1 90e7e8fc0ef9d35a39611a21f9bbfcd4e8c4e835
SHA512 d05cd7ce96bb8736c85901f2d31f969f439bd698d58e2740a6d45cac774d4666124b7179adcc7e3770ff9ac0a94a49fd0ced543bd3ef36b1a0e8dad04ec5dab9
SSDEEP 24:rPlce31G7A4ANzAEy7A/A0A0+ASP+T0Z0U0q0BL0R0el0tOs3D:rNcAhLmra
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db

Path /data/data/com.mobi.screensaver.fzlwzksq2/files/TDtcagent.db
Size 28KB
SHA256 a34bff306d71c8c250636cddf2fcf70d370ed9eb07a26a581511ad2f8c590934
MD5 ef82ef88089d571598f455aa238451ca
SHA1 369ddd822c7250eb17fa92c0045e1f77499e8964
SHA512 9609d1814cb588e800d46e048e029f1709d64bfd87afb144f113a8622fa21361688c71cb2f0218053e0c1c36ec474ac312dcc95d846eb6cdfc1e1415b5c696a6
SSDEEP 24:rP94e31xfFAJ7A4ANzAEy7A/A0A0+ASP+T0Z0U0q0BL0R0el0tOs3D:rV4AXbLmra
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db

Path /data/data/com.mobi.screensaver.fzlwzksq2/files/TDtcagent.db
Size 28KB
SHA256 51f79b7ff7fd905a46f1de5158ee0d1a0637514c952adeacd67d30a7c59e93e5
MD5 42f369f8a00c64c21748dfabce66b516
SHA1 5f09ec3bea4ca2a86439f6dcb16365b94320df97
SHA512 9e687fc3e02f4ccc5bc61bbdd749846ce31ad9efcd902384b973bff8bcee04c18b08570d5d2abd64509b0852053b675256a7c916e055619a27b71544f996a5b0
SSDEEP 24:rPi+e31dOAz6LFAJ7A4ANzAEy7A/A0A0+ASP+T0Z0U0q0BL0R0el0tOs3D:rK+A6Lmra
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db-wal

Path /data/data/com.mobi.screensaver.fzlwzksq2/files/TDtcagent.db-wal
Size 8KB
SHA256 02aee6fa549501040fe070d94082a93bbfdd359e66430b9200d33d184adcd593
MD5 d477c7c4581e5b120d3ba268c48c07eb
SHA1 9f774ce662b83fcbfe61fd9a4c5d06e3dfaa5a03
SHA512 0bf40092f3d6471bc7594f327b95c3595162263dfb4fbaa582c9f53524f4012850ce2df01e6c56255db93e0e64a70acf089bb7301af294b6e95ec165accc77ea
SSDEEP 12:KcW/kEgiN61Kytz5MEXX/QOulCM8WRQOulx+ygPQOulxfkQOulBLQOulRQOuleqd:KPkPiVG0Z0U0q0BL0R0el0tOs3D
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db-wal

Path /data/data/com.mobi.screensaver.fzlwzksq2/files/TDtcagent.db-wal
Size 8KB
SHA256 73442578ef697197abf415e249877cea3e26738cfff4920b0ea5604e9cdfc2e0
MD5 dd21a9d37b4e66919a2e7c1068bf20a1
SHA1 b1c3667e485a9f995d05eb0e768827ff8acda626
SHA512 8d66a6497b09f0d36e24ee6d316ff0ba1b54a8fd02ecb3051b2fedb37ea9fcb51d23122938e984784922be857ed1f41e1f5fe8fec843cd480ff84d3d31dba900
SSDEEP 24:Kbz8ce31G7A4ANzAEy7A/A0A0+ASP+T0Z0U0q0BL0R0el0tOs3D:08cAhLmra
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db-wal

Path /data/data/com.mobi.screensaver.fzlwzksq2/files/TDtcagent.db-wal
Size 8KB
SHA256 a79d2322d111ccb1874868b1afda3c51aac2d85ca2ce3c113bc0a40cf495d8f1
MD5 58be8d016dcc78ced44acc6bcbfe5975
SHA1 6629cdac6e23710925afb5e291872eae3ef68660
SHA512 3d33520768c1247ef2a853de606818db78ada8495ac20623a9a66f00b53234fbbb76919e8866ea52f9b286cbdf2a95370675e51966edeeea4fcf25ee7f686f52
SSDEEP 24:K2a9Te31xfFAJ7A4ANzAEy7A/A0A0+ASP+T0Z0U0q0BL0R0el0tOs3D:H8TAXbLmra
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db-wal

Path /data/data/com.mobi.screensaver.fzlwzksq2/files/TDtcagent.db-wal
Size 8KB
SHA256 9870a68b806ceab34aa502b77aa3c7fe5f61bb22da22d8bb64e833726dae4258
MD5 5467d6c70424bd94005c3ca40d81801f
SHA1 199168ff9cb0d5e32605e6825da58471b1c382f2
SHA512 58a4f5c3fa1354edc49c0b2233f56485e75b6b0ac56fb9422694e56c96554bbbbc030ad750f93ad8215149b0c63dd01da9d4d7aa565ba1802cfe63762efda1bc
SSDEEP 24:KW0hR1e31dOAz6LFAJ7A4ANzAEy7A/A0A0+ASP+T0Z0U0q0BL0R0el0tOs3D:cA6Lmra
MD5 SHA1 SHA512 SSDEEP

Submit Download

1717562470328.dat

Path /data/data/com.mobi.screensaver.fzlwzksq2/files/alilocation/1717562470328.dat
Size 381B
SHA256 e670bcbf54a46c0696198fc67f61c965eb1a4bf8212ffcd4f35378397e582ae8
MD5 db595446862551288520d6c0e388d670
SHA1 98236b80f66a43482015aca3116f3719ec34ffb3
SHA512 e475546494a3634e9f3e4de9c46ef2f3927a52bfb1be19191982133b94417b5ad026cf3f3ed5ed9d8a709aa6dc4fbf9896cb1aae2c04a1f2210c661398d3f58d
MD5 SHA1 SHA512

Submit Download

.1717562470

Path /data/data/com.mobi.screensaver.fzlwzksq2/files/alilocdata/.1717562470
Size 377B
SHA256 bca4925317e2160c26b6f2ce39de24fff727597f2091f80eec4ebbfe0c0cb167
MD5 5f471ec2a30ca7b355f58740746d2352
SHA1 ba7058b0ce768e3a13140bd444ae9d4db939a711
SHA512 ca3bab13ba51236433e374a24087f62a447fd06eaed371032b6875beb88b49883523d72f2c1e692a2c8efc179af216a3412398eba1e29672e2b73dcd15f98dd9
MD5 SHA1 SHA512

Submit Download

.1717562471

Path /data/data/com.mobi.screensaver.fzlwzksq2/files/alilocdata/.1717562471
Size 377B
SHA256 5c635a70833c80984e161c49844b85499918cb8f31d6cf73ab08c6cb4144f829
MD5 2ccbe559fa0dbd8363cccc428465a80c
SHA1 40f3bc44a92950f1bb6c405c2dcb5433a535acc7
SHA512 c21c574463137c090c03f9c6e4b2ca69c53851c4536c463282e74b292f50a07686bf03745c5e20d7cb6d587d8198cd2e1f94ab1fa09808e65fa9f62eee9fa29f
MD5 SHA1 SHA512

Submit Download

.1717562473

Path /data/data/com.mobi.screensaver.fzlwzksq2/files/alilocdata/.1717562473
Size 377B
SHA256 ef7345be45160ffd257506805daeaef42200a253da102edc2c53e045b75271d7
MD5 6405592e6ebfaf0e2295a2a9dc461e40
SHA1 f5ba03af43e5a7ab23d4204312f6c6da97c1dd58
SHA512 92a4c34a8d23919320d66086e17bec526d43ebe0df4b3d87da8f13b349c3224bf2a500e1d728eaa9c68c6b0823eb40e892e3f29e0a97d36f01c5940c2e8b17d9
MD5 SHA1 SHA512

Submit Download

.1717562478

Path /data/data/com.mobi.screensaver.fzlwzksq2/files/alilocdata/.1717562478
Size 377B
SHA256 4f88870045893a6c0c45fac94a20ecf57252d0f932348487d100c4afee1e67f1
MD5 bd3711fafb57f2859f8cc5f68e6eb023
SHA1 e204b489545373383d02abac21aa6884d6fa180b
SHA512 a3bdcbac0eaac54813646b93e2af2684dbe5a93e0fcd15028c913c03b2dfbc7fe557de5ce60a01825f5c887c1b8e67f38fa04db1c5ecd7d5ff90058db5b38971
MD5 SHA1 SHA512

Submit Download

823bf35e02d1572b4f3eed49d4d31c04

Path /storage/emulated/0/love_phone/.entry/1072/823bf35e02d1572b4f3eed49d4d31c04
Size 130B
SHA256 6c6c25b2489b056b19ddbd1dbf3377edbca9322c9f999cd32663c4647104e1f1
MD5 be04fdf3f12703f7d390cd46a139c8d4
SHA1 a2bdb8d58d24aa8ab61f1916d606b67ebef809d6
SHA512 cf876cdd85b89fa5f29c9f036dbd212482591518b5f88709117d172e694b527970ebd9a455ec46e33cc5af0608eb4aa4f9b05233c633d633f8fc1691c727400f
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads