2d9ab31168e0bd47a62743e37dab92861f593974bde5d7e0f569ff93dbadaf7a | Triage™

Analysis

max time kernel
126s
max time network
162s
platform
android_x64
resource
android-x64-arm64-20240611-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611-enlocale:en-usos:android-11-x64system
submitted
11/06/2024, 14:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9e92e543ada1fda53791aebfc33896d6_JaffaCakes118.apk
Size 1.5MB
Sample240611-sakecs1frl
SHA256 2d9ab31168e0bd47a62743e37dab92861f593974bde5d7e0f569ff93dbadaf7a
MD5 9e92e543ada1fda53791aebfc33896d6
SHA1 684f1f60361c887caedd77e30296e443541c75b1
SHA512 aacd59db6710fba1baf1a0c2da882eb94a16c546fff278fa9531a5d7ab2cc01348aebfc19807c99fd8b87ce72b93a1883b5eca7768665623bf56313b6d4b0e95
SSDEEP 49152:K14WIvKJbecqsPZ/ZZhZhoW2Q+TKgskVh8Zi5F:lWfJTLhBv0Kg9hr5F
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection credential_access discovery evasion impact

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

System Information Discovery

ioc	Process
/sbin/su	com.jakubek.voice.sms
/system/bin/su	com.jakubek.voice.sms

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

Transmitted Data Manipulation

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.jakubek.voice.sms

Queries information about active data network 1 TTPs 1 IoCs

System Network Connections Discovery

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.jakubek.voice.sms

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

System Network Connections Discovery

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.jakubek.voice.sms

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

System Network Configuration Discovery

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.jakubek.voice.sms

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Checks CPU information 2 TTPs 1 IoCs

System Checks

System Information Discovery

description	ioc	Process
File opened for read	/proc/cpuinfo	com.jakubek.voice.sms

Checks memory information 2 TTPs 1 IoCs

System Checks

System Information Discovery

description	ioc	Process
File opened for read	/proc/meminfo	com.jakubek.voice.sms

com.jakubek.voice.sms
1⤵
- Checks if the Android device is rooted.
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Checks CPU information
- Checks memory information
PID:4590

com.jakubek.voice.sms:remote
1⤵
PID:4765

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

System Checks

Credential Access

Clipboard Data

Discovery

System Information Discovery

System Network Configuration Discovery

System Network Connections Discovery

Lateral Movement

Collection

Clipboard Data

Command and Control

Exfiltration

Impact

Data Manipulation

Transmitted Data Manipulation

Replay Monitor

Loading Replay Monitor...

Downloads

com.localytics.android.7e23b434bf9c935840bf4514eaa6c793946180ee7c1989112e032176f9398b27.sqlite

Path /data/user/0/com.jakubek.voice.sms/databases/com.localytics.android.7e23b434bf9c935840bf4514eaa6c793946180ee7c1989112e032176f9398b27.sqlite
Size 64KB
SHA256 b6109ee5ea2721876881c99355323b65da374349b8c91cfea055bbfc1ca1bf08
MD5 32e4fb6fdea626d988274e1cc966fb4d
SHA1 0302b0465d559cd9a46a1ab8ce58bdc5f82b881b
SHA512 ede5d1246d0d78ff36fc118166feab1560362cd562c9fff0bca3a9bd35c0ae6d6b05da6f97a296783695725d27244405efc4b14a3928d7e1bc66040797c9e4aa
SSDEEP 48:TqXocCPunl5tWHLnd7eDGHLE3PQ9iqMGkGGZxycSvlVV5NjeAtn:+4LElSFG+39xR9b5gAF
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.localytics.android.7e23b434bf9c935840bf4514eaa6c793946180ee7c1989112e032176f9398b27.sqlite-journal

Path /data/user/0/com.jakubek.voice.sms/databases/com.localytics.android.7e23b434bf9c935840bf4514eaa6c793946180ee7c1989112e032176f9398b27.sqlite-journal
Size 512B
SHA256 e31fad7f5a4050d2db974c3d67967c2bf5c2bd2a3c86e7ad74cf46595cc4759d
MD5 6d953259f7be9f85b71ccd4401d0efb7
SHA1 348d5814ce36da71e57f249d7dff8c2e2f03de97
SHA512 9d16a5e3fbc62abc7ba5f456aa1c42d99d74d5006b49869727b591abe48cb3e91d2fcfbe9606838e19d8fd770de5b006330f279fbe2eebdef9f52ac6ba5eb758
MD5 SHA1 SHA512

Submit Download

com.localytics.android.7e23b434bf9c935840bf4514eaa6c793946180ee7c1989112e032176f9398b27.sqlite-journal

Path /data/user/0/com.jakubek.voice.sms/databases/com.localytics.android.7e23b434bf9c935840bf4514eaa6c793946180ee7c1989112e032176f9398b27.sqlite-journal
Size 8KB
SHA256 49b37e481a9294c5037040f5ab718b8a525126d6bbbc3ee8cc13ca791f4675b1
MD5 2716831af8c6c321811fb97ae5e7a68e
SHA1 f58cdded9ebf89dca156a7d337de974d14627f64
SHA512 7aa5651cd6a0d3253b32b6803bc3e5378d36c9cef0b6bd43726f95a588fe223e78b3e032a05518983cc72deb4326a5caa23dbffeaad8fb0a5f88b3e573dc3118
SSDEEP 6:7+/l9NwHn1M5Wg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKw:7+tYNqLiuWdYRmBEyPbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.localytics.android.7e23b434bf9c935840bf4514eaa6c793946180ee7c1989112e032176f9398b27.sqlite-journal

Path /data/user/0/com.jakubek.voice.sms/databases/com.localytics.android.7e23b434bf9c935840bf4514eaa6c793946180ee7c1989112e032176f9398b27.sqlite-journal
Size 8KB
SHA256 ab7f80f83e22d01f181afd180b1d9e3b4adfbb38b2b55001e6bf1a2026646301
MD5 d5e240960c48b55ff999465893c46e79
SHA1 9d6486f0b3f231a535c370beaed785d8cdb5be6d
SHA512 bad2c623ce2a6b28564ad6d064a07aac4931552d8269d1b01d2bfc237df4c2bbc5326589d6c311f63a8850a980246f93e60ef85378f7b09a0696dfc8b1df1ab3
SSDEEP 6:7+/l9hOPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKuZlU/5n:7+tLiqLJdeWRmBEyPbhZq5n
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.localytics.android.7e23b434bf9c935840bf4514eaa6c793946180ee7c1989112e032176f9398b27.sqlite-journal

Path /data/user/0/com.jakubek.voice.sms/databases/com.localytics.android.7e23b434bf9c935840bf4514eaa6c793946180ee7c1989112e032176f9398b27.sqlite-journal
Size 20KB
SHA256 59e1e13f5d00419431f27f93949e8df4fc372554cbbb7d1cc25272b03bcbfb57
MD5 afa773caf13c4b1f89cb0014fee57999
SHA1 925f5086d96f13d26a5e5c31c4ff04dc5e76262b
SHA512 443604a02a7fcb90b671f5a693afcc1f3b0bdf0fb202a304f5248e9451c8f053ab9054812bddb0b8a7f5a274ee9028a6042145e910eff196bd988c64f8f844a6
SSDEEP 48:7MjqaXocCPunl5tWHLnd7eDGHLE3PQ9iqMGkGGZxycSW:7+N4LElSFG+39xRW
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.localytics.android.7e23b434bf9c935840bf4514eaa6c793946180ee7c1989112e032176f9398b27.sqlite-journal

Path /data/user/0/com.jakubek.voice.sms/databases/com.localytics.android.7e23b434bf9c935840bf4514eaa6c793946180ee7c1989112e032176f9398b27.sqlite-journal
Size 24KB
SHA256 ab63b6c6816e6f5001c309de98a089a07dc86c89a776738f835c3d0cc1fbf264
MD5 ef906a3ce9c79242d1e98b0de4014376
SHA1 5d61876f248cc8f6e853cc1b9eee92e6c8aeac53
SHA512 92d9e2c4874b5e19026962c08b63b563792320cd83d8d9deff2e93451cc4f11ac62e12edcbb9505216dafbbac39951b3d5a755cc6b8a5a3a75c956567a782ed8
SSDEEP 48:7MPmqqXocCPunl5tWHLnd7eDGHLE3PQ9iqMGkGGZxycSW:7Am94LElSFG+39xRW
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.localytics.android.7e23b434bf9c935840bf4514eaa6c793946180ee7c1989112e032176f9398b27.sqlite-journal

Path /data/user/0/com.jakubek.voice.sms/databases/com.localytics.android.7e23b434bf9c935840bf4514eaa6c793946180ee7c1989112e032176f9398b27.sqlite-journal
Size 24KB
SHA256 500629d81cee081a6bbd493d30f62a117c465e2f05a0b10310f0b1729e2a0c61
MD5 afbfa4616082920c0b656d26c89bc7a0
SHA1 077c356c8ed1b1ec38744e5d51e8ba80c0e74cf6
SHA512 b64d64342044b1a91fe85985596bb926c8a5bd76a643aca345e3d895fca2348361783d9ad1fb6d49c5453955f7afc42356d6d09512fda5e66e1cc897703c1417
SSDEEP 48:7MViIvqaXocCPunl5tWHLnd7eDGHLE3PQ9iqMGkGGZxycSb:7yN4LElSFG+39xRb
MD5 SHA1 SHA512 SSDEEP

Submit Download