Analysis

  • max time kernel
    7s
  • max time network
    131s
  • platform
    android_x86
  • resource
    android-x86-arm-20240603-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240603-enlocale:en-usos:android-9-x86system
  • submitted
    06/06/2024, 02:19

General

  • Target
    99cb54c8251809a995e1ebe8ae984bc6_JaffaCakes118.apk
  • Size 17.8MB
  • Sample240606-cryqbaff26
  • SHA256 810377aec8c8a795b8338736aeecdf3e681f0fbf3b9755d213c7a03dcb87d9eb
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Signatures

  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.sakai.imikowa2.pj
    1⤵
    • Loads dropped Dex/Jar
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks memory information
    PID:4264
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/storage/emulated/0/Android/data/com.sakai.imikowa2.pj/cache/pujia/patch.apk --output-vdex-fd=48 --oat-fd=105 --oat-location=/storage/emulated/0/Android/data/com.sakai.imikowa2.pj/cache/pujia/oat/x86/patch.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4395

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        1582435991586.jar

        • Path /data/data/com.sakai.imikowa2.pj/cache/1582435991586.jar
        • Size 9KB
        • SHA256 f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce
        • MD5 SHA1 SHA512 SSDEEP

        partytrack

        • Path /data/data/com.sakai.imikowa2.pj/databases/partytrack
        • Size 16KB
        • SHA256 cd16181d54b4b2fb2a46c517648bc09c59650144de19ef7164c26c4f4100cd69
        • MD5 SHA1 SHA512 SSDEEP

        partytrack-journal

        • Path /data/data/com.sakai.imikowa2.pj/databases/partytrack-journal
        • Size 512B
        • SHA256 6d4dfed2d2d11e3dc991e0aabac380ea8e20b0640b90a6b12359b30f2f02caa7
        • MD5 SHA1 SHA512

        partytrack-shm

        • Path /data/data/com.sakai.imikowa2.pj/databases/partytrack-shm
        • Size 28KB
        • SHA256 18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
        • MD5 SHA1 SHA512 SSDEEP

        partytrack-wal

        • Path /data/data/com.sakai.imikowa2.pj/databases/partytrack-wal
        • Size 32KB
        • SHA256 f46cfe1c260a0b235a2442f7fdca90211a0a30f1b111b194522711ff6ed022b1
        • MD5 SHA1 SHA512 SSDEEP

        patch.apk

        • Path /storage/emulated/0/Android/data/com.sakai.imikowa2.pj/cache/pujia/patch.apk
        • Size 2.2MB
        • SHA256 4fef18a19ac2625a353e3d9ccecbce3fedb5a71925b7419a5752dc8c02aafd4b
        • MD5 SHA1 SHA512 SSDEEP

        patch.apk

        • Path /storage/emulated/0/Android/data/com.sakai.imikowa2.pj/cache/pujia/patch.apk
        • Size 1.9MB
        • SHA256 4d55b97d362af2cd13957e0f79a1f8a070f7644d337e7f57c628230247a3f0cd
        • MD5 SHA1 SHA512 SSDEEP