6437b3d17d3ec74e56fd8be10a3903803f4a579db9f7ff465bba59c45999e882

Analysis

max time kernel
174s
max time network
133s
platform
android_x64
resource
android-33-x64-arm64-20240603-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240603-enlocale:en-usos:android-13-x64system
submitted
11/06/2024, 06:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9d58e7d6423c262adad634f56357faef_JaffaCakes118.apk
Size 28.0MB
Sample240611-hq2cpsybja
SHA256 6437b3d17d3ec74e56fd8be10a3903803f4a579db9f7ff465bba59c45999e882
MD5 9d58e7d6423c262adad634f56357faef
SHA1 d1680dc22e55399e8fee37a167913ed551422c6c
SHA512 417a166ae2ea4a24ef42769cb9428966bbc4f87bcb2492ac1f543c55adffd700d9ac0446920e49464918d5bc6bc5c7fda01f74fad86aa4c1220e9d1fc74229eb
SSDEEP 786432:0X6JbBCcEdQjZmaS9o2zc7UnbTDHn1xavWftNI/cQFO82:0KRBCc7jZ/So2IYnbn1UWf3I0QFOf
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

banker collection credential_access discovery impact

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.ypnet.exceledu

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.ypnet.exceledu

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.ypnet.exceledu

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.ypnet.exceledu

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.ypnet.exceledu

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.ypnet.exceledu

com.ypnet.exceledu
1⤵
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4234

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

journal.tmp

Path /data/user/0/com.ypnet.exceledu/cache/journal.tmp
Size 36B
SHA256 7080cb592d5149c858b206d3fd0d5e3e7d601f120af00b2616bee928ee1291ca
MD5 37e8e716e0e2f4a0b05cd9571d95b84d
SHA1 f8d068f6931707bddb8cd69f706f2224ad1fea3c
SHA512 e62b850901835fdb73fa6224618422f721dd765861d42f6bc2dd013413e96bd910ac5313afd9b4f63da74beb12a15fac81b5157456c9caa3031862dab84423f6
MD5 SHA1 SHA512

Submit Download

domain_1

Path /data/user/0/com.ypnet.exceledu/files/Mob/domain_1
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

libcuid.so

Path /data/user/0/com.ypnet.exceledu/files/libcuid.so
Size 109B
SHA256 141acf606501704c904f8fa7038e3950d15cab5a0906034963cbbf847dc385b1
MD5 f2b6ed9c8f1ffbce5912861243614d17
SHA1 80bfc2dfbe7a9e3cd5aa47e833da1f0e1ebf02ff
SHA512 44a404c38748ffb8d62168adf4e4241b958ecdcff59571cea8b7e6206bd8de200d602fe5ab6dc6deff21d5d560833fe2cea9d776c6ccb7c42d38fa66d1a5b887
MD5 SHA1 SHA512

Submit Download

.confd

Path /storage/emulated/0/backups/system/.confd
Size 20KB
SHA256 452b98f7a5ab103891d119c75b2158a53a8a5a86295d5a39d094c3e05c2c4f68
MD5 0ddc066dd1b65ec4fb584cbb35408dd1
SHA1 4c3d4dec74adbf2143b4295f9d647f18aa4e1aaf
SHA512 405e0e741bfd1f917b3feed83bd53d3e77f48076ca98b9eb76e47736c6d3168486291b365d122e3f4809fe3a251499831b0b87e03d9470578b771984cce658fe
SSDEEP 12:TLyKYDyNTSFbyNHUP9YERmBEyPbAVOwG:TLybuLwY/GSEG
MD5 SHA1 SHA512 SSDEEP

Submit Download

.confd

Path /storage/emulated/0/backups/system/.confd
Size 24KB
SHA256 a0a652236d75cd002f8850de2252f8fbc831e43b2da917dc5cdd4451890236bc
MD5 30803013c74755b2a79810d47c2bb9d8
SHA1 81c38079f8509e3479b4dd989614b3212504f7f4
SHA512 b8fad74833377afeed60fdf1df17de32b8d8db6366f04ecb6930c2a1957573f8f8938a27261d564b1babf5f55fe3cfc539ae15c6e6ce0e3f18e358accadecc78
SSDEEP 12:TLWeB5Wzkya9YurNTSFbyNHUP9YERmBEyPbD+:TLZI8YuBLwY/GSK
MD5 SHA1 SHA512 SSDEEP

Submit Download

.confd

Path /storage/emulated/0/backups/system/.confd
Size 24KB
SHA256 904db034090f34a89292ed0cf4f14874eab303b7baecca1c43042a6ab6791695
MD5 3c055a49a704b3eadc9b8b78ffbd6d9a
SHA1 2bc9c189b14d5890d25a7e5624001829baf04127
SHA512 6df0aa07d4314a5e1e60205af9f7fbd7969bf83ed5942af11d5b47e6b03715a6f8c251348349b8c62bf08ae4c408bf8bbd4411f4e464d333b7b85661fe701228
SSDEEP 12:TLSqWzkya9YurNTSFbyNHUP9YERmBEyPbP/Vi86bdn96lrPNz7KAXSGretgYRvyh:TLS8YuBLwY/GSP/Vp6+AKYxy7tkYHhb
MD5 SHA1 SHA512 SSDEEP

Submit Download

.confd

Path /storage/emulated/0/backups/system/.confd
Size 24KB
SHA256 5fa1500b8c44f1d1c21007593af50bda011e7315c77c27343eb43e359fd0c592
MD5 9d3345901fd528a2e94ebabb48b3ee5d
SHA1 9bb53d8b513d9fa8ff4e26a321a6ddd78a263bb6
SHA512 aa1d7beadc49a30dcd170086636d812521e451bd7b84579d185eeebc6dae90ec774c6f65624f0a12addd91677105ae90f2fc78bda6c47247fe42f897b5caedf3
SSDEEP 96:6sBPQvaYJ/EmIUlFd7OQVaQ4TSD2HC7VGJADfuz4zM:68uTj9p94C2HasZl
MD5 SHA1 SHA512 SSDEEP

Submit Download

.confd

Path /storage/emulated/0/backups/system/.confd
Size 32KB
SHA256 b8cc5018b1c519de8af288764e2d189974119e27c3b18694933191780a5f99d7
MD5 631e23ce2e9b0422d3a124a15980030b
SHA1 126ad67399c498936924304a9ca6c698221e0852
SHA512 2a412f484f331013eeb3cbe31a2938944c0d02774f5dcdb5495a1cfd4f618c4b7e307fb384f38cf7b4733e4e63538f4ed27ffbbb1442419f7f8e9cae55e35790
SSDEEP 48:TS15VXBLwpST5eiQDRFfQd2m90LN8IxBn:atBbQ9a2Q0hDxV
MD5 SHA1 SHA512 SSDEEP

Submit Download

.confd-journal

Path /storage/emulated/0/backups/system/.confd-journal
Size 512B
SHA256 7770d5da9224477e0700cbf868d0925804657dad3dead27118f7108868889c18
MD5 2d64843b228b151bebafeedba4533152
SHA1 c2f13dacd8de7cc66fec2397bad6e22b47181eb6
SHA512 aa5282033dd258156d03a8e03ea3cae1fcb2e7b29d5075cf4049fe2d022b006b59d6a95515ba67f9e8fe5a20590ac6afbe093724667fbb692f8c1489b2841f31
MD5 SHA1 SHA512

Submit Download

.confd-journal

Path /storage/emulated/0/backups/system/.confd-journal
Size 8KB
SHA256 dce1ac07e4175c135aa976020fa428d582593fd40a35973ffa1015300e204798
MD5 cf6b82dcd81bb400397569b6a2be42aa
SHA1 3d44c3875b763f4cc6a416ca72b496f52105e3e4
SHA512 6baa5ef32d9c922f405210ed5700607c0fdf529ced5b3c1d6014ea0b8a6c359aa7a611084ba9df581fd079273ee20cb937d820e80fd0507eb1501d954603da8c
SSDEEP 6:7+/l9WzFn1pg9bNFlEuWdOAlOERX4PBX4ogLugMBX4suuKi:7+tYBqLiuWd7RmBEyPbd
MD5 SHA1 SHA512 SSDEEP

Submit Download

.confd-journal

Path /storage/emulated/0/backups/system/.confd-journal
Size 4KB
SHA256 7067a23e9ae3d044b484de641c2e23e9336edef13e2166017e6b3ec7be8b8093
MD5 d6b1488e580bdc5e3194e546486ec9d4
SHA1 fdac4ecd27effd44508dab4d26ec59020fc36e52
SHA512 c2b261938e9ae01941553073c7bc288ded4877b630eb422d62c2aabbbdcf8485bdbbcfe7b34904e4c4e2da03c441e4cfb1f5563154c279edef4267ff8a9d1d81
SSDEEP 6:7+/lgHPg9bNFlLdKEAlOERX4PBX4ogLugMBX4suuKmPC:7+tGqLJdKBRmBEyPbc
MD5 SHA1 SHA512 SSDEEP

Submit Download

.confd-journal

Path /storage/emulated/0/backups/system/.confd-journal
Size 8KB
SHA256 bd1348860b4e0c1ba0cb613b9a0dcacb1cc18376d3f916dfad4c67e17fa87f80
MD5 879c6215449c0c37b8edc7f81cf2e873
SHA1 ee1581df97b4b966c994889371d510cea7adf1c5
SHA512 29b7d46cd9221f0799d4722c634ccb3201a3cae9488b0d859b9174a4ff39a927ca328c23d5be9b0109b84c03f8fdf2768ba2f315552f44e0f56c3ae50ef96f4e
SSDEEP 6:7+/l9BPg9bNFlqhO1oAlOERX4PBX4ogLugMBX4suuKa7/q:7+tjqLmq9RmBEyPb5zq
MD5 SHA1 SHA512 SSDEEP

Submit Download

.confd-journal

Path /storage/emulated/0/backups/system/.confd-journal
Size 8KB
SHA256 1f2ad3e759ae79e55823e300f5e03a03fca2af52a3f916c4007a559052b90ed8
MD5 ab32d81884144d671c65aeb9c079e267
SHA1 8daad9b0e17901c9ecf58b7df86dfdf4da70f8dc
SHA512 67e97c47bb951b6250ac09d639a928b02af44df3c8ed2ee0e1e0f73615f18de304e43aba7c92b2744d10adf67d04a5336db0bd1a2e6d1c908f68eb0f577ecb81
SSDEEP 12:7+tr9nqLyKYDyNTSFbyNHUP9YERmBEyPbiG:7+t1qLybuLwY/GSj
MD5 SHA1 SHA512 SSDEEP

Submit Download

.confd-journal

Path /storage/emulated/0/backups/system/.confd-journal
Size 12KB
SHA256 6f5aaa3c76c84c3da5fd64f8d8450c45c10940f49e2e54e29b18568dc0d9d09f
MD5 4b82c03bf7ddd1456d19772d28848854
SHA1 ff6cc6b901664e47af7a63452121fd3b65239da0
SHA512 12678b4b9e437c5e2bacbb56bad44ecfc5149822aae508cd1e4277deecedd6d2f32602e572c27c8eaa4b5c900c931c4a14726e8601a9a9357c858cf15daf1740
SSDEEP 12:7+tCO0LRqLEgigFydBl9Ye42aqX9YIIkya9YurNTSFbyNHUP9YERmBEyPbXc:7+thgqLrOfnYe5Y0YuBLwY/GSXc
MD5 SHA1 SHA512 SSDEEP

Submit Download

.timestamp

Path /storage/emulated/0/backups/system/.timestamp
Size 25B
SHA256 2281ea49c6a44d017f0444d44b75117dff99ef31fe4eb50bcefbea7172dd7bb0
MD5 543f62d947524e9181af2442dd6130d2
SHA1 d6ac881c2c1a6830d6382014492b119ca6a5e26f
SHA512 8a158cf403b51b475f5542d4f98024f8ace0da34e17b0ae8e89309e5ad3bac686e04edf3d4c837c95ab4dc8be39b5b1d633521c1fe511291494388e8565d8f3b
MD5 SHA1 SHA512

Submit Download

.timestamp

Path /storage/emulated/0/backups/system/.timestamp
Size 55B
SHA256 c718696c945093421a2e9a91417ffb316088812de7ace1cee8adf39ce75e49fa
MD5 6258b8b603ef95f88a7d43ab7498651b
SHA1 6c3801f5194a3e60b64d9e823d59b740b500badb
SHA512 4bb099146094981baa924e1f927c178798c3c86831d577137a77d7b0a29c8c58a13312125b79198957c80b787d896af845332c135c297a27fec15832410f9cef
MD5 SHA1 SHA512

Submit Download

.timestamp

Path /storage/emulated/0/backups/system/.timestamp
Size 84B
SHA256 1d02fc3c545f6755f7df7eac6108e1fec303de9e269f715f63ab4a7f5b016c33
MD5 052c6e5d5a1d8f899604125a802a29df
SHA1 732b0098a6ff1045a0371d9480734c23926ad29d
SHA512 75e79720adf8ce8bfdf04d8180b9f44b814736680451cff6f0435e8390c03da21cbde9f862378a5090a1a509ffd6a218c9d493f0829c2578b4d4639c7df3e3fb
MD5 SHA1 SHA512

Submit Download

.timestamp

Path /storage/emulated/0/backups/system/.timestamp
Size 114B
SHA256 99f0b328cca37dd054faf7744abdb7bd3d7188e9df79f03a96f28dfea4257013
MD5 3b345af1828e119f7c563bf55c5e8c5e
SHA1 4fbf3d46525f220371442d33c84231587673afda
SHA512 acf1b8391fff2a66eec954a8fc29b2b3a1567f978f9eabe0d0fff02bf041b2e3540021b7a2d84aebc51211b09685d54716c8cad0d32dd2e54a9b956e76efeb8c
MD5 SHA1 SHA512

Submit Download

.timestamp

Path /storage/emulated/0/backups/system/.timestamp
Size 138B
SHA256 727bd758f986614eb8484cdc1d5d634c4fe06a918dc538c85198471c1f928417
MD5 18aa0b07fd4e68eccae4cfb2a49f8a9e
SHA1 1076b0ff72fd1919bf138c194549f13da6a86be4
SHA512 4a70fc3d05f3d8ce65f66c8182d72bdc541b0e4507eb8f0857e108b66974a727809a3a4356b579e22b9d82fdef5b48e1080382cb7ab73a7f9fda13ac34e890eb
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads