c06b5750f4fc2e2a9ef08e1e282bd07245115d00f08a885ade45c015961a089a

Analysis

max time kernel
174s
max time network
173s
platform
android_x64
resource
android-x64-arm64-20240603-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240603-enlocale:en-usos:android-11-x64system
submitted
05/06/2024, 04:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9735da903d3999777b5d7ba01097c53c_JaffaCakes118.apk
Size 5.1MB
Sample240605-fa2bnafc73
SHA256 c06b5750f4fc2e2a9ef08e1e282bd07245115d00f08a885ade45c015961a089a
MD5 9735da903d3999777b5d7ba01097c53c
SHA1 68c6fbd8e93e604c98a4e6172d430e66b261cac6
SHA512 f6496de3ec6a55466ed8123b23d3374cb611df3609d6e55fc010ebb4e26107946e4906a5f1b875066818b9399999e133c7d4dc23bcba1376363c7249aa49d47a
SSDEEP 98304:/uKHbWNM6dKojPRdTWxejiMtExKWURr9izr+gGDlwIZ+Ap81+EYmOEL:/Z/6dKEPRdTyMltEwWqr4r+gGJjt8fZL
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

banker collection discovery evasion impact

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.mobi.screensaver.fzlwzksq2:com.mobi.screensaver.ScreenSaverApplication

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.mobi.screensaver.fzlwzksq2:com.mobi.screensaver.ScreenSaverApplication

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.mobi.screensaver.fzlwzksq2:com.mobi.screensaver.ScreenSaverApplication

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.mobi.screensaver.fzlwzksq2:com.mobi.screensaver.ScreenSaverApplication

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.mobi.screensaver.fzlwzksq2:com.mobi.screensaver.ScreenSaverApplication

com.mobi.screensaver.fzlwzksq2:com.mobi.screensaver.ScreenSaverApplication
1⤵
- Queries information about running processes on the device
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
PID:4614

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Credential Access

Discovery

Location Tracking

T1430

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

city.db

Path /data/user/0/com.mobi.screensaver.fzlwzksq2/databases/city.db
Size 147KB
SHA256 43af888145a2711000f625255c1e786ccb2a75f4ab594cd16bae957c976ceb7c
MD5 cf9c3c48c77bed980260bf3d29d8f570
SHA1 bd68dd512738332f7661b75001af6b6c079a0fd3
SHA512 db7a61c82f17643a437ee2987bd4171143aa0776927d6159567b3023ecaa99aa6f79d688c87846f2ccae56884e984701589c14664793b7c0b015568825c0bb22
SSDEEP 3072:lNjFwM0vinPeY9hj+mdvU+rf0yAt1c/IJKR7G460mOjs:TFmvinPeAhCmtU+rMGR7Gars
MD5 SHA1 SHA512 SSDEEP

Submit Download

city.db

Path /data/user/0/com.mobi.screensaver.fzlwzksq2/databases/city.db
Size 2KB
SHA256 f51116b49238355d5cde90ebcac8683800e28d99ab0b4c06e0a2f16c305694e8
MD5 bc471cc4fdf4924925595237d1c6e1db
SHA1 9281a6fe0a2d8c009634c8953a51a0fed9301a3b
SHA512 c49a36e26e64f9126a6df3e7e818fe9af99f726d8c771702a8de523813d67ec58fdf0e97950eae4a7b0e8c4c11ca52ee1ca21c5ed94d87338a14e8d79f751759
MD5 SHA1 SHA512

Submit Download

city.db-journal

Path /data/user/0/com.mobi.screensaver.fzlwzksq2/databases/city.db-journal
Size 2KB
SHA256 e48e901cfeabcc82235d4bc87ed4bafac9aadd14cf7cc213ff23e0d6b2a1b929
MD5 d224be17d38ec225e04f9cdb9386694a
SHA1 8904ac151a50cf6aa3a5650d58fad17e525c3171
SHA512 5691bdb1ee5d3e6244ae14ff80b4ef85e422d63e3f06db030d7f026d0b6ad8ed314b055f69883396585d01b49a6a7be1ba669bfbf382b7e61b84d81157920f2f
MD5 SHA1 SHA512

Submit Download

city.db-journal

Path /data/user/0/com.mobi.screensaver.fzlwzksq2/databases/city.db-journal
Size 1KB
SHA256 65c78ba85cd5dee5f765244a68551915d7e94d6960794e2e9d200087b1a755e5
MD5 dc8da8299101a8f940274b4c3fcc7fe7
SHA1 c39ea70a6e418417312299d4bc5185ccc8a863f7
SHA512 c442d7eef31305d2cca40a7894c8c4a9f5fa12a1410fe8a110df7be2d4917f03dbadeaee0c634d1c6788bfd379914779913a2a835d6390324a8d6142bd0684de
MD5 SHA1 SHA512

Submit Download

TDtcagent.db

Path /data/user/0/com.mobi.screensaver.fzlwzksq2/files/TDtcagent.db
Size 28KB
SHA256 d2d2dec7b1fdd102367988b3f9277994f9809ba1fe60a2e14a7ebe6d563b5b72
MD5 bf72903156e346397aab40dd45f6e6c9
SHA1 8cd11965ac6df1007b446efb5c8483a91e8ce4e8
SHA512 99043f9f784b8224d0db490a996c086f5fc94a4ee6a5891e019d49985374c571a205d6dc41ed1ff8da6e8146ecef5e8e5d4b21f405f3bd67e009ebaf41559970
SSDEEP 48:TOxeYTDHY8qlBaUd/gpTSP/hrSa74fO37nhCEB:6tg8ql8Ud/gpWPJh
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db

Path /data/user/0/com.mobi.screensaver.fzlwzksq2/files/TDtcagent.db
Size 28KB
SHA256 24738aea4ef11c30cc903d920e311202ab6324ae8a9bb806ff09f08aa33f8c55
MD5 3f63cf8de6209b8859f260193fe66c85
SHA1 e54818bc3b49213893e2e31f7a4e0069cb2cf945
SHA512 aa2cc1811f5860f3e819b63b6704854c780f2e46a92720bf9209a0da3034ad2a4b49d9281f266c2a8f4bb2b23baebeb00edcea378a268a131b41d101effb7a21
SSDEEP 48:TuxeYTDHY8qlBaUd/gpTSP/h01ZrgniLOqU74fO37nhCEB:atg8ql8Ud/gpWP/
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db

Path /data/user/0/com.mobi.screensaver.fzlwzksq2/files/TDtcagent.db
Size 28KB
SHA256 b085038cc97ca98d029c720e58a7fdde4b6195f355647b9db32f2ae86603c8c1
MD5 2cfc0c7d6f996777a0ff7e9d654daa4d
SHA1 73074f2170e9ba520237bd28a2ab731216049195
SHA512 4ef8d4118a93a413955e9503faa3761fef806af1d1f1f5fd8b818acfdb2df2d714eaf44e9fd1f232198d4d66b51cc5f17d81dbc54f6d1c91c3afb2dbf5a66fe7
SSDEEP 48:T+xeYTDHY8qlBaUd/gpTSP/hVtS48ZrgniLOqU74fO37nhCEB:Ktg8ql8Ud/gpWPP0I
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db

Path /data/user/0/com.mobi.screensaver.fzlwzksq2/files/TDtcagent.db
Size 28KB
SHA256 f9bf226cdfde39a3cc4cb60416cba411c2ff612011c030c94d93501d369236fd
MD5 73caad881643440495c3a875b02a15d3
SHA1 5b1a9ce6cf3229054c09fa929cd5490e4eedf400
SHA512 14d0da6818ab77f2eb8f0978bcb612e7a7e8ad0751cd1421946f5b6f461065385e60360aa0587963df81b6f1755af0872c00fe0f1d144d32dea82c0cabfb858a
SSDEEP 48:TOxeYTDHY8qlBaUd/gpTSP/hKsVk/48ZrgniLOqU74fO37nhCEB:6tg8ql8Ud/gpWPQq
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db-journal

Path /data/user/0/com.mobi.screensaver.fzlwzksq2/files/TDtcagent.db-journal
Size 12KB
SHA256 7e5b5b1c1e534bd51955cf3d3d2141426bee8fd85ea35bf32331fd0f6b4ed564
MD5 90c0f4fdd084e2c3d82d5a93a867ba23
SHA1 70c99528b7cb4ea8aeceac5d5b788910553cecb0
SHA512 341c51a67b3fa57a07a287e9d5fd116184b88e3edeae97326459728a91835edb8ad416e6f3fd9a2872f198869030467335f13998da7f9aa4717e24278d976b4f
SSDEEP 48:7M84Q4fO37nhCEeXq+xeYTDHY8qlBaUd/gpTSx:7QXJtg8ql8Ud/gpWx
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db-journal

Path /data/user/0/com.mobi.screensaver.fzlwzksq2/files/TDtcagent.db-journal
Size 12KB
SHA256 217c9fd2d0ea6159918c3df0d6cb3fd9c809d2587fe57b4598e620c8bf31dc66
MD5 7b821a051948a784facba57b49a9a163
SHA1 1f43233d9cdb5b51d24dfa4a74741788b3318c73
SHA512 2fb049dbfcebac43e489a55e8fbe227b1e0c786a3663bc064a3a0c6d3767bbb98190e96bcb094c78fb0111b54a0daf6cd34d5e62b0ff940738256fe59b296343
SSDEEP 48:7MvMergniLOqU74fO37nhCEzqexeYTDHY8qlBaUd/gpTSH:7Zptg8ql8Ud/gpWH
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db-journal

Path /data/user/0/com.mobi.screensaver.fzlwzksq2/files/TDtcagent.db-journal
Size 12KB
SHA256 c0c287bee39dbe60b0105982dfac8050f98793dc71ea28f5acd0f42d2a0c66e1
MD5 1c697f1826282d6966589a287fa62efb
SHA1 70ed165a2182961ab19f551f6ea2fb8f5d6591da
SHA512 ff96e852ef2c52ad1ce2c57104ae95fe6801da42c5812c883864e533d5f74a27d0d53209ee984c4b8bd18848b8655a3cd5aab573a5951db1a558d10cd589f361
SSDEEP 48:7MF1ZrgniLOqU74fO37nhCE07quxeYTDHY8qlBaUd/gpTSE:705tg8ql8Ud/gpWE
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db-journal

Path /data/user/0/com.mobi.screensaver.fzlwzksq2/files/TDtcagent.db-journal
Size 12KB
SHA256 429408ea882e69744a697141d9c628e97437bb84bbc1641475d311e5c1791e55
MD5 4bc914517f361ef12de1c82b90fd90c9
SHA1 78e0293a3112cc0ab3abbb7c468be994dcc56d77
SHA512 9b5faa80fac1f7cfc1c20acf22eb0161f419a7b145ca490c5025e58cc1fa855750dbccd49aa36e8e7716a76df79ec075aa4f50ad2cbac97193061ec8490d2f38
SSDEEP 48:7MqS48ZrgniLOqU74fO37nhCEeaq+xeYTDHY8qlBaUd/gpTS5:783aJtg8ql8Ud/gpW5
MD5 SHA1 SHA512 SSDEEP

Submit Download

1717562469936.dat

Path /data/user/0/com.mobi.screensaver.fzlwzksq2/files/alilocation/1717562469936.dat
Size 392B
SHA256 a8fa4647a65079895c88a357258edd005729a92acc819067aaad433168a90676
MD5 3d9a98d2ebc31136e5969f5f885d49ae
SHA1 9144bec864abdb9c7d77f86bd3bae98eeb517a82
SHA512 55437d8725bb622987f77f0bcf8682e9dfe3334f45085ff7d32d6be1d393ec66b15aa458244ebefb053488e61400bee670decf54c3d48b46679486a9b53cae6d
MD5 SHA1 SHA512

Submit Download

.1717562470

Path /data/user/0/com.mobi.screensaver.fzlwzksq2/files/alilocdata/.1717562470
Size 389B
SHA256 2f004215fbe4a26f339ee5bfae2597817f1f2c01ae0024e91b000908e31fa3c7
MD5 0e1a3f1ce8668faa120712cfd8ff0a36
SHA1 a4e5b09e26042ef68626ba6462bd81dd5a35bac1
SHA512 8f0c4e3435611acefd5b9c8508b1b8f2cdce016f38b2f176dfe4f6ac72808eb93252fe85a430d05a194593855e8a43fffc5305cbb2985b3d8c082089b2c3d38c
MD5 SHA1 SHA512

Submit Download

.1717562471

Path /data/user/0/com.mobi.screensaver.fzlwzksq2/files/alilocdata/.1717562471
Size 389B
SHA256 1d011123dd17dcc5b85cb12ad3fb1e57bdbb1dbaa746adcb2801c1a1ee740df6
MD5 f4ebd8aa53042d7202d67d0c4f6b350e
SHA1 ab8e488fd5587cf675d07189b1a23b551c5deade
SHA512 197f7eb9b225b21da606e5563852ff57e4fe29de4b25ce30b0514bd6d4501c9a3fd39fc1529d19be971079d21ae078b3a806231d55b7b4069aaf01140a46eb4a
MD5 SHA1 SHA512

Submit Download

.1717562473

Path /data/user/0/com.mobi.screensaver.fzlwzksq2/files/alilocdata/.1717562473
Size 389B
SHA256 6902bf5a56252f2c90e025a7c629e04ffad2128ad7765f20401f386a7266d50e
MD5 97ab9c32c96b6ad3d5179d1296edb9cb
SHA1 305f79ecb00e696f12ba1a2993750419da295404
SHA512 b045263336b012a34bb4bf740218e0a0eadbc129309db4b4c498276f27c8604c1f74a36ae584003ae1e2a46917a303d78d3f366b97c833c87065180eb808c41a
MD5 SHA1 SHA512

Submit Download

.1717562477

Path /data/user/0/com.mobi.screensaver.fzlwzksq2/files/alilocdata/.1717562477
Size 389B
SHA256 6535bcdc12e218735d3011dac1a6112e93be7efed4d3923c2cd3e19264ffed82
MD5 a5c2a7b089d748adbd5ed82ea30ec1d0
SHA1 cb09cbd9d367a4699cfabc0008b80276662aaba1
SHA512 289def2190e1f09bcb08ac0d4db81eb4e0bd7e77568f87137ebd49c8382d05bb22ce0543b7541fea2f22cf586967f965396a78a176b57c602e0384d179796dee
MD5 SHA1 SHA512

Submit Download

823bf35e02d1572b4f3eed49d4d31c04

Path /storage/emulated/0/love_phone/.entry/1072/823bf35e02d1572b4f3eed49d4d31c04
Size 39B
SHA256 0e961b93e0f1d6009372e5123a3e629ba7b84b10d3a73a55c0be34b818e9d37f
MD5 2d3afefa7273f9c57b389f6e813a1088
SHA1 b149bcf3da4773eb062257650e85c7310a2f58d4
SHA512 060c6c4597b441a3f0d11b76466d15716540114dd4c037dc7aa98b8414a172a7c5c4a82dcfad06a0d17f0563c26a60c3628509c6b80003769454ec7e98efbbab
MD5 SHA1 SHA512

Submit Download

1d529009a7619c1f208f2474d316340b

Path /storage/emulated/0/love_phone/.entry/1079/1d529009a7619c1f208f2474d316340b
Size 39B
SHA256 7f3b0d8d17530dfa518364e2372f98a160d07f8b6fb98736cb47842483148581
MD5 45e3b8ed04b6ad3f1ccfd60494347f0e
SHA1 ac51231c7bf67f33c635c0c6bf8ed5ff808c90b9
SHA512 61a25f02f33d2f1a2ba02b46837815bb0bfe10b5cacbe0467987d3b09d7e3c53a08ebdc5d7036c8ced96e9e0f86c7d51a36b300515f22528fbba901a2c77dc58
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads