65f8dd84bf7103c85185547de71871b1a7d625af08b682811e8fcbce1b7559da

Analysis

max time kernel
155s
max time network
186s
platform
android_x64
resource
android-x64-20240603-en
resource tags

androidarch:x64arch:x86image:android-x64-20240603-enlocale:en-usos:android-10-x64system
submitted
06/06/2024, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
99f84708c9b2f3023a88186b6a7da126_JaffaCakes118.apk
Size 1.3MB
Sample240606-e9nzyagg8s
SHA256 65f8dd84bf7103c85185547de71871b1a7d625af08b682811e8fcbce1b7559da
MD5 99f84708c9b2f3023a88186b6a7da126
SHA1 ba445362b0775266b6f4b50a7149e6ae974f1f2c
SHA512 feb81bc8484d2d2d9251bd5c6ac33ffeb99fcfac2d6674a9c5f69c5f174d1861ccf874b2f1dbef00d2bd529bb90d313df7de2b8c60714633e7172f0dce0d144b
SSDEEP 24576:Qm+Fw9R+IxKGI0jgmcWPIo7oHTFydRmHaP2AY/roF3R8o6rLouuGJz:Qm+m93I4gnWPIocH4LmiLYzmR/o
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection credential_access discovery evasion impact persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.hao.filejiamidashi/files/__pasys_remote_banner.jar	5027	com.hao.filejiamidashi

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.hao.filejiamidashi

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.hao.filejiamidashi

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.hao.filejiamidashi

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.hao.filejiamidashi

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.hao.filejiamidashi

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.hao.filejiamidashi

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.hao.filejiamidashi

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.hao.filejiamidashi

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.hao.filejiamidashi

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.hao.filejiamidashi

com.hao.filejiamidashi
1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:5027

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Execution Guardrails

T1627

Geofencing

T1627.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Location Tracking

T1430

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

Cache.db

Path /data/data/com.hao.filejiamidashi/databases/Cache.db
Size 20KB
SHA256 0d70f4b2c51295ef9c85d5dd7e9625dd7509fc727f46f811db19da83097b5611
MD5 e274bec5898fcbc7a3b16c7ccd66f89e
SHA1 15362d01356bc7e4191b75e57e7fdde8e54dcb3e
SHA512 5c5ef85ef3841dda3f7885cce0d2d35db1f172bfba0b113e9142cdbb7939c3e3ae5c6e89873cbb3fcfa400031dc774cf67a4847108cb2e91fcf68b8608ba7cce
SSDEEP 12:TLZgezy+TnItysx5MMWtFpqrPosGxuE+xszJSRmBEyPbAVOwG:TLLz3DIPx5etFpCPoIqVhGSEG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cache.db-journal

Path /data/data/com.hao.filejiamidashi/databases/Cache.db-journal
Size 512B
SHA256 7b8cbb4f150d15508af483d62d8522ba7a4e4009fbf8b3ed8a80d4cac6d421da
MD5 0c1ed1252553a93e38279205fdfbf189
SHA1 206deeb56759037a583d2ab72a5526324f9260b9
SHA512 83f8279b8b45ac0f372b9165fe61fc13a00968b0d30ddf6fc807fd550723955a520be441a84b565210357effbb325d2b62a4d308ac87eab2e818ac54ba6a180a
MD5 SHA1 SHA512

Submit Download

Cache.db-journal

Path /data/data/com.hao.filejiamidashi/databases/Cache.db-journal
Size 8KB
SHA256 8bfa892fedf2fd976272693651ca815639df52b94530f244373eee16f02b7823
MD5 35d3e325dfaca124d319dd6794346b5f
SHA1 b975ec0fcbe6dd241108187dcdc16d77053cbe31
SHA512 ca5afd2ff516c53637bcca8734088121c38cf55941bffd31a8d2ea92041cd46b25ad057b24a987b3c52906afa3bfca285964f6e5ae96f195f04851afb5aa1c65
SSDEEP 6:7+/l9IuHn1mEWg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKie:7+t2u6qLiuWdwRmBEyPbTe
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cache.db-journal

Path /data/data/com.hao.filejiamidashi/databases/Cache.db-journal
Size 8KB
SHA256 39f8cbfaefc955eaa8ad0ad1c063e4a3cfd7d4f7735e45991f425e4965ea5317
MD5 1d3eef5f181d14a8e238dd70cf13180a
SHA1 3401af02229679f256151dd905c8b88f8d66dae6
SHA512 d8530a6a00b9e83a43f56d0e97c95f744c0aa4fa459771164be2a9f5352d0653df19545b78bbafadbc6891768ffdda6beea139fb1cf2a13635764eb9de0967ef
SSDEEP 6:7+/l9kPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKB//5:7+taqLJdTRmBEyPbK5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Freq.db

Path /data/data/com.hao.filejiamidashi/databases/Freq.db
Size 16KB
SHA256 cabe6e7bc9f5c0fc6cf00896818f1ad973381c122dc8bb36d6cd21f3791c184d
MD5 491b13cf064dd1f1b555725258dc5780
SHA1 17fad584a08af0d850c0efa55bbf71097d31f63f
SHA512 9ca0eb54e3ed15399bc3681f8a3ab84142639ef4f9df042693f22ba18f859dcd341a14cf598520518c55155e1f98f22db1278e2cf6c3993a2d1bebda7718ca1a
SSDEEP 6:l9bNFlqals1uTQZdxRLu47yo/gn9gRdgTg86pQRfRM9CMERX4PBX4ogLugMBX4sN:TLpEu2a4dL+DMqRmBEyPbBvOw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Freq.db-journal

Path /data/data/com.hao.filejiamidashi/databases/Freq.db-journal
Size 8KB
SHA256 faeb345f1af964c66d917b8f195e0a585ce5f0d643f3b6811c5697caef35ef7a
MD5 da404a03115ae3b8a979bc1de07b0b8f
SHA1 a1008ca2d9943f58792e45eb7865f9543d552d18
SHA512 a4042afa8c9f9b4ad3a79687979f9772ede77cb6c3dc0e9b54fcfcc63e8af8c1886b2716893fa1f81098a2df2b874744c9b3b86fa05062f4b64150a1fa010001
SSDEEP 6:7+/l9vHFPg9bNFlLdrlOERX4PBX4ogLugMBX4suuK0h0lGl//+:7+tNhqLJdTRmBEyPbb0lGlX+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Freq.db-journal

Path /data/data/com.hao.filejiamidashi/databases/Freq.db-journal
Size 512B
SHA256 e8285183939f48fbc74a27a9028f0c45c56ca80cbcac54761a70d87fcc56f33a
MD5 6f8638cea6f23f8caf2eb9ddc87d2c6b
SHA1 a768481fd4005204675343ab6d350abf7cee0d43
SHA512 1c3ff6bcb737c9989ae81360e922337f56fcac18c6775771498cabfc109e0732bc7f3d9a538990db42ddf8fad72245c050dd097ab87efa169eb82c8dddfa8add
MD5 SHA1 SHA512

Submit Download

Freq.db-journal

Path /data/data/com.hao.filejiamidashi/databases/Freq.db-journal
Size 8KB
SHA256 a15150876dce8baf8554c1ec4f6d8409f2f6e1d2d4e0979f92d1230da07d3106
MD5 104eb0231344420def798516cbf5e7ef
SHA1 ee2ca5670d23e669e0b9a2e6046c07724673c57f
SHA512 e385a2328651beec47bfd8e830f067db7496dec359b6bd7c476ab08f0adfd074649c177913be143b543d570b4b15527719d729789810b0ec0c53efbdb548667f
SSDEEP 6:7+/l9OBOn1YRg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKR7n:7+tAFqLiuWdwRmBEyPbW
MD5 SHA1 SHA512 SSDEEP

Submit Download

__pasys_remote_banner.tmp.jar

Path /data/data/com.hao.filejiamidashi/files/__pasys_remote_banner.tmp.jar
Size 293KB
SHA256 97969fc3626963ffbc21ec263ea92a196f149e122ce878c03ae011094a634d3e
MD5 d871231612da34aecc674af4eb4ffedb
SHA1 952315133180bb2e247e97e9b14f0f0bdf2494b4
SHA512 32c259e6be6cdd8a140257fac772aca2571ae35a3b97330b4c65c0284657fd88bf8a687324d1cb6894007783919c8672c637c3adc223ef379a26eae8b760b38d
SSDEEP 6144:Jym7w37d3bZ0urP8QKgVdzAct2JgwxZqP:Em03bQQKgVdzAc5+ZqP
MD5 SHA1 SHA512 SSDEEP

Submit Download