2d9ab31168e0bd47a62743e37dab92861f593974bde5d7e0f569ff93dbadaf7a

General

Target
9e92e543ada1fda53791aebfc33896d6_JaffaCakes118.apk
Size 1.5MB
Sample240611-sakecs1frl
SHA256 2d9ab31168e0bd47a62743e37dab92861f593974bde5d7e0f569ff93dbadaf7a
MD5 9e92e543ada1fda53791aebfc33896d6
SHA1 684f1f60361c887caedd77e30296e443541c75b1
SHA512 aacd59db6710fba1baf1a0c2da882eb94a16c546fff278fa9531a5d7ab2cc01348aebfc19807c99fd8b87ce72b93a1883b5eca7768665623bf56313b6d4b0e95
SSDEEP 49152:K14WIvKJbecqsPZ/ZZhZhoW2Q+TKgskVh8Zi5F:lWfJTLhBv0Kg9hr5F
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection credential_access discovery evasion impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/sbin/su	com.jakubek.voice.sms

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.jakubek.voice.sms

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.jakubek.voice.sms

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.jakubek.voice.sms

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.jakubek.voice.sms

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.jakubek.voice.sms

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.jakubek.voice.sms

com.jakubek.voice.sms
1⤵
- Checks if the Android device is rooted.
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks memory information
PID:5190

com.jakubek.voice.sms:remote
1⤵
PID:5379

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1633

System Checks

1

T1633.001

Credential Access

Clipboard Data

1

T1414

Discovery

System Information Discovery

2

T1426

System Network Configuration Discovery

3

T1422

System Network Connections Discovery

2

T1421

Lateral Movement

Collection

Clipboard Data

1

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

1

T1641

Transmitted Data Manipulation

1

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

com.localytics.android.7e23b434bf9c935840bf4514eaa6c793946180ee7c1989112e032176f9398b27.sqlite

Path /data/data/com.jakubek.voice.sms/databases/com.localytics.android.7e23b434bf9c935840bf4514eaa6c793946180ee7c1989112e032176f9398b27.sqlite
Size 64KB
SHA256 69b242c8d292f3a8ecfe368f3736c5d90f68d5ebba31f407a24d35854cd00912
MD5 280c02d866bcc1c7588a5955dcde1e31
SHA1 1538c2755e97480dc3762115e9c7e673f1c8891c
SHA512 762da96edf792e4757ede9b8e8df0550a29c8a76d4989546422f1044d545e82d598e7a771f9c7143cdac469b0635aa158fc7e02c45a69fc0aef41737561d40e9
SSDEEP 48:TSXocCPunl5tWHLnd7eDGHLE3PQ9iqMGkGGZxycS:24LElSFG+39xR
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.localytics.android.7e23b434bf9c935840bf4514eaa6c793946180ee7c1989112e032176f9398b27.sqlite-journal

Path /data/data/com.jakubek.voice.sms/databases/com.localytics.android.7e23b434bf9c935840bf4514eaa6c793946180ee7c1989112e032176f9398b27.sqlite-journal
Size 512B
SHA256 53a2faf8fb84251f9e8ea83bc751386971121ca0f3528dab935fe6a9cbf8a847
MD5 8728465cfff920ec2e7bf2ddcdac68a4
SHA1 17cbd5d357d70b691ba18bb8a5ac9132f4038cd8
SHA512 fa57d14854f7090f38248d11b1cf4bc7ea02088938cac7a9a0a86b8d56342c73a1bbc320be43c1f7df472ac644d15529248e91de69c3940e660747c393048650
MD5 SHA1 SHA512

Submit Download

com.localytics.android.7e23b434bf9c935840bf4514eaa6c793946180ee7c1989112e032176f9398b27.sqlite-journal

Path /data/data/com.jakubek.voice.sms/databases/com.localytics.android.7e23b434bf9c935840bf4514eaa6c793946180ee7c1989112e032176f9398b27.sqlite-journal
Size 8KB
SHA256 ded48d0092dcf1a9bba054b4bdd66b4aca4b5fd4fbf355149e5b88fdec301310
MD5 52bcd3cd39a64dcd0b4abdf70960ecc2
SHA1 1d3eb3b7605a4a9bad3d0e05794ea38faf1953b6
SHA512 623cf876743a17435110f61cf3e3d221c3859538fd813d0ab768b64653dfcb17357a7635e88536717e639f8fddd63254b04d01d65db3c53167faac0a982b12e0
SSDEEP 6:7+/l90kOn1Mkxvg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKwZn:7+tnEqLiuWdwRmBEyPb3
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.localytics.android.7e23b434bf9c935840bf4514eaa6c793946180ee7c1989112e032176f9398b27.sqlite-journal

Path /data/data/com.jakubek.voice.sms/databases/com.localytics.android.7e23b434bf9c935840bf4514eaa6c793946180ee7c1989112e032176f9398b27.sqlite-journal
Size 8KB
SHA256 13bc694d9db2cef3452c80bbe8b6b6566bbe62b7e32b15fa0de68cb46a7308ae
MD5 9d5864a77e5c5fd8ace9aba0ea58b274
SHA1 c84c238e964f03c2641550e5a55cc7b27a464cf8
SHA512 7c715783f23fa763e140c4a799d9526aed4b7d81ee45e996f98ee3a9a9d98d0cc491104a4907cc278a602e7bed4f508f03fc8736dac29d0218c45eaae36d064c
SSDEEP 6:7+/l96HlPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKSa/ke:7+tgBqLJdTRmBEyPbMke
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.localytics.android.7e23b434bf9c935840bf4514eaa6c793946180ee7c1989112e032176f9398b27.sqlite-journal

Path /data/data/com.jakubek.voice.sms/databases/com.localytics.android.7e23b434bf9c935840bf4514eaa6c793946180ee7c1989112e032176f9398b27.sqlite-journal
Size 4KB
SHA256 e588ca3faee62b3b65f9fdc0e900791b8342177763c94142508eca4c4133a6f6
MD5 09762bfbbf735ce85c2cfa33646413cb
SHA1 4801dc3ae710dc6ff221d5f7c572c56d15852fe7
SHA512 46c94a20ef9d464f7f8ca11befa78a546eebb5f004eec02378833e7791d2888cc2a3bc2d590526458b1413642617a894c9bf5e8e1ed2563f11f5aff5663a4da6
SSDEEP 3:dllvHNllrFll:9
MD5 SHA1 SHA512 SSDEEP

Submit Download

1.1-64941.stacktrace

Path /data/data/com.jakubek.voice.sms/files/1.1-64941.stacktrace
Size 897B
SHA256 1f57f353e38230684fc9e401ca35eb2037e23ac18ab6d1f35f5f38dbf5e244aa
MD5 43a199d08975c6b787c4bfa8654b9ade
SHA1 c85bfb710ca5bda9761d3e04ec08f7b00a9b46ae
SHA512 7f8e7e6cf96365bb897d392251caba8ecc1a29ddd5a37eb4d482f5de5de06110558db36a19d42350c8843dca67aff067cfd810757c84b497b544317ac525d6bb
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads