2b2bdc4ba56a9d621df3f958f35ba9919ee0c2b9749487b4aba87884655676e5

Analysis

max time kernel
26s
max time network
155s
platform
android_x64
resource
android-x64-20240611-en
resource tags

androidarch:x64arch:x86image:android-x64-20240611-enlocale:en-usos:android-10-x64system
submitted
11/06/2024, 12:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9e404bc9f22dfe38586636c62c8e1e3f_JaffaCakes118.apk
Size

5.8MB
MD5

9e404bc9f22dfe38586636c62c8e1e3f
SHA1

1f6cb531342d4396bdc53c61bc548a0257d0274e
SHA256

2b2bdc4ba56a9d621df3f958f35ba9919ee0c2b9749487b4aba87884655676e5
SHA512

3a6a32bd1c6e7d40689b36a69e932103ed5b19f4866cb47c9850ef4e462b333a66c97e136a34d87db64a85a2cb7cee77e2eae639381bfbac1586a59511cb93d5
SSDEEP

98304:RtGFynygqCZCJG4bTEaX/gghFr+djjnXW9pECIi01u4LetdQ9TMG8tgT7t9JOsxV:TGMQP1Tvtf+dnXW9GC01u/kMGTJ9Jx

Score

7^/10

collection credential_access discovery impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.kghacc.krqoomu

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.kghacc.krqoomu

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.kghacc.krqoomu

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.kghacc.krqoomu

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.kghacc.krqoomu

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.kghacc.krqoomu

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.kghacc.krqoomu

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.kghacc.krqoomu

com.kghacc.krqoomu
1⤵
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4971

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.kghacc.krqoomu/app_tbs/core_private/debug.conf

Filesize
101B

MD5
290b855c734a916ca00624139db81547

SHA1
d1a12784700ac9e463faa82e2dcf99de40f3c808

SHA256
e353b7291f0a62725347d5a52caff0ad0b97e35aca62fabc32e569a14ac5e6a4

SHA512
7e9d52fd531f1ad717092393e750501c63fe55a80341491ffdb03cce8682e34337b2a3232ce095cccd59d61dc5c5b0b6753c04eeb36766decf8e9cc3120ed3bb

Download Submit
/data/data/com.kghacc.krqoomu/app_tbs/core_private/download_upload

Filesize
84B

MD5
30bb05c692143181685bb20205e1e033

SHA1
74c38a98d58c86748afd2cdfe764339d47b306ff

SHA256
2b383407e5b5acfd18ccc4d3909254a40b0f2d84d62a958e068f9c0d50062a23

SHA512
e8db22e7b3fa928d6b08ccf878a9714a7890af6ad240235c731f0f885e99ebe72f8da43b3490142bbb1b28d8a0fb811c6a83f15831f466ba4687c14d38292abc

Download Submit
/data/data/com.kghacc.krqoomu/app_tbs/core_private/download_upload

Filesize
84B

MD5
c33b147f7aaa28167e2d4224fc1dd6c7

SHA1
1f44bc837eab9ae2e255dbb7cbc5020b454dda2f

SHA256
709b0c597042421347d096054173a61871e2459a0c1c18d6066c1c74d66ff55a

SHA512
8584bd96be484846053001143e90739d8213541a8a140dfb98ad6bf0a82b3e716a684088b087ed0142a0c1882a8bc39b61ad579c7824507c576b2e628d7622a4

Download Submit
/data/data/com.kghacc.krqoomu/app_tbs/core_private/download_upload

Filesize
84B

MD5
ac60bb877c427cda7872b1d1801c442e

SHA1
2e9eb0b5614f0f914811c0f4893e5fa85877bd1d

SHA256
a01bcfaed8f6f31e59de797ce69c8885fd024f0ea3094bd1b43138c84971b19e

SHA512
1652b0e3ceb1e44e938ffd190443632bc072db645d0f3b59bcf863be99aa8311cc198cfda0caa428829b4331df463927da1df720976546f972d80f9e90c851d9

Download Submit
/data/data/com.kghacc.krqoomu/app_tbs/core_private/download_upload

Filesize
56B

MD5
7cd5bb852a9e3181b35d9cca3804c5f8

SHA1
41414fb42156a7f0efa9993f773807a280eba5e8

SHA256
01becd27945bf373e006fc9cab449823755dd927a864b0e51ff314b57309322a

SHA512
3f3cadae3052c48fdb50f9d67a3d4cdd0b934277b2ddbdf2c6112d535389e122070eed15dd79b3085b922f949f60a0abec8bd204387249c486122b320359e7d1

Download Submit
/data/data/com.kghacc.krqoomu/app_tbs/core_private/download_upload

Filesize
56B

MD5
f02701f7377c4f980cecda6eecc87e91

SHA1
28d3b66b3b786eeffd606bfc775fcbfe6cf7c9c3

SHA256
b401be8307d9d0d7a8b862416d9d6acfcc4da874bc5f76b3b26dacf53a4c95a1

SHA512
4d41b22b5ae62327eab43743567431151de7c6185d1ad642e84bf1e3a9c92c5d6f19ad15e2582068c861331e7f565ea99835ef32a358366e01e87882fc5a9b3f

Download Submit
/data/data/com.kghacc.krqoomu/cache/image_manager_disk_cache/journal.tmp

Filesize
31B

MD5
8c92de9ce46d41a22f3b20f77404cc1d

SHA1
8671a6dca00edb72be47363a7071be65cf270373

SHA256
68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274

SHA512
30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

Download Submit
/data/data/com.kghacc.krqoomu/databases/ip.db

Filesize
20KB

MD5
ec550caa32d70a28078f5733611db05f

SHA1
b06f3a6736768d9730d6bdd531a69c3b217d47ec

SHA256
5d5ac7d1ac9a77ee3fe9d4230064ee063eb5a93965bfe1e1c7ff88cc1fe430d7

SHA512
7843594a9c7a6c9f40e1800ffbd5f18fcb681ef22f8d800fc3b86b43e7e7b96c46b6a83ad14ebec00bfd79cd33a34b840a165d430340a7e6254211fa36947125

Download Submit
/data/data/com.kghacc.krqoomu/databases/ip.db-journal

Filesize
512B

MD5
7ee5f3596341909b1ec3b87b63339a41

SHA1
44ac7d8fd522ee5047a47a97d28ebc6f71d9e446

SHA256
c1d2a64cf8ac8f569c8ff1e09c14d354e197301fbe42cf0d932d761764e0aeb8

SHA512
1a8d2d22fb1c886da634057a48e1adb9d7a42eeef56f955f7bf797daaa36105e360289eea696d73d0dc30642ae2263e2b52e0307c166434303a784dae611fd20

Download Submit
/data/data/com.kghacc.krqoomu/databases/ip.db-journal

Filesize
8KB

MD5
978863d3c6fea2bba20b7460a180e27c

SHA1
fc0140238e8581e2618bc3c754640a699e0a3916

SHA256
39d824ea29ce999281b988a0ed2f71b81690ba740aa73bf966ca95042b19f285

SHA512
221a40df98af4ac002c12047f3032724ee1783572e3f4641fa0eaf3631fd9ac079ee54e7e3c9ef71569157e690fde1464470cfc1c372c7898fe2fe338225275f

Download Submit
/data/data/com.kghacc.krqoomu/databases/ip.db-journal

Filesize
8KB

MD5
36c393f45510daa5c4052f2f1912342d

SHA1
d4cae3e620b107e69d259cfb9c9b34c6a533540f

SHA256
aacef7e43d04aab99e87178eb6452f1bb3f8bff3aa869f42bc442e8b0a747fe3

SHA512
2f2bc48264ffd901efcb49099d4b0f202ea74e720d29454d86c8b954e35db177de8e74d4d7fdebd5714f7ae7f832f40dcbe210cda26252b5003ae4926c21c52e

Download Submit
/data/data/com.kghacc.krqoomu/files/files/dpi

Filesize
92B

MD5
db434efa4fb9242d2c0a71bfabfaf2a9

SHA1
9739381e21f4f7eee4500cb02d8d157b2ce6d733

SHA256
dd571043b2b900e2fa7ba4153ce4d79df8e99a4675a15bfa645565e58801e8f2

SHA512
3dbb253f3898a825e8c12ff5af0681ee4f10c0ea2a54ddb7f9a8e56b9dc751d78e0998e75caad9d7c760fee02d095cccf6c942828453f4c4af081ceea322358b

Download Submit
/storage/emulated/0/.nid

Filesize
36B

MD5
0b92865d1de9c39d681781bbc50c1c5b

SHA1
2f1bdd1c5de3d89e6d1c22ed18550e89f3cfe3e8

SHA256
0b2c9e25443b101dae702b2db806ec21c43ad78acf4b9fbdac2095bb8a198c45

SHA512
8f17606e0995a878abc19373f0f1fe37d1b1ed293bb61a8cf9a0fd58a79c9b3859bc94ae2ef543e9458cf1302388f91d60100c0d0907c6d017c122c3467c6418

Download Submit
/storage/emulated/0/Android/data/com.kghacc.krqoomu/files/tbslog/tbslog.txt

Filesize
13KB

MD5
17ecd7fa77aa5b3506f49f77fd785cff

SHA1
cc727bb1fa4f673498414a3fe27667be93f972b8

SHA256
18cde71846e7ed6ac5d422f8bb9baa946b420b2a4a4403b28653327c6227c183

SHA512
9dce5101bac5c9499bccec5dfb6905f067cf8b1be618441440f8497285f52e3be06037c7f04002670cd4d8ffbde6c82ff7af120cecb87a916e254d764fea0cd5

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads