Analysis

  • max time kernel
    86s
  • max time network
    189s
  • platform
    android_x64
  • resource
    android-x64-20240611.1-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system
  • submitted
    12/06/2024, 22:40

General

  • Target
    a2bee58ea095c9a9fa25fc9d56484085_JaffaCakes118.apk
  • Size 6.6MB
  • Sample240612-2ln2cstcmb
  • SHA256 95475726606bbde9dc57f0c759c9546d0a9ab2a5b4c4a33fddd559d5cce44583
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 3 IoCs
  • Loads dropped Dex/Jar 1 TTPs 5 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries information about running processes on the device 1 TTPs 3 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Reads the content of photos stored on the user's device. 1 TTPs 1 IoCs
  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 3 IoCs
  • Queries information about the current Wi-Fi connection 1 TTPs 3 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Queries the mobile country code (MCC) 1 TTPs 3 IoCs
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 3 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 3 IoCs
  • Checks memory information 2 TTPs 3 IoCs

Processes

  • com.mobile.indiapp
    1⤵
    • Checks if the Android device is rooted.
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Reads the content of photos stored on the user's device.
    • Acquires the wake lock
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks memory information
    PID:5069
  • com.mobile.indiapp:worker
    1⤵
    • Checks if the Android device is rooted.
    • Queries information about running processes on the device
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks memory information
    PID:5142
  • com.mobile.indiapp:worker
    1⤵
    • Checks if the Android device is rooted.
    • Queries information about running processes on the device
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks memory information
    PID:6330

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        libsgmain_315561600000.zip.tmp

        • Path /data/data/com.mobile.indiapp/app_SGLib/app_1718232040/libsgmain_315561600000.zip.tmp
        • Size 249KB
        • SHA256 d5f192d7f4c3b8ebd19206979d3ab50c5adc2821fd291fc58691cbfb8f344ab8
        • MD5 SHA1 SHA512 SSDEEP

        libsgmainso-5.3.7011.so.tmp

        • Path /data/data/com.mobile.indiapp/app_SGLib/app_1718232040/libsgmainso-5.3.7011.so.tmp
        • Size 407KB
        • SHA256 24addb5e5a182e0f36634c2365606283343d75bfb28ac77a91394256b8b57bac
        • MD5 SHA1 SHA512 SSDEEP

        sdk.jar

        • Path /data/data/com.mobile.indiapp/app_plugin/sdk.jar
        • Size 156KB
        • SHA256 e5dc704f92ca7ebf85e459aa08be538284afe6d566de1d4652e5e421d3592ead
        • MD5 SHA1 SHA512 SSDEEP

        11gpsdfe_1718232055517005069.wa

        • Path /data/data/com.mobile.indiapp/app_wa/wa/sv/11gpsdfe_1718232055517005069.wa
        • Size 2KB
        • SHA256 bb7f71ffde6b0fd85a3bb4618a7518d8288b2fc19d36ea69ba0c7767354282c0
        • MD5 SHA1 SHA512

        13irufhg_1718232065032005069.wa

        • Path /data/data/com.mobile.indiapp/app_wa/wa/sv/13irufhg_1718232065032005069.wa
        • Size 11KB
        • SHA256 ac5abca12d3e8e66ea580ebe05f4acbeac8e0cb7e9753e23276bba8f370c3af2
        • MD5 SHA1 SHA512 SSDEEP

        42u0uvgo_1718232065031005069.wa

        • Path /data/data/com.mobile.indiapp/app_wa/wa/sv/42u0uvgo_1718232065031005069.wa
        • Size 653B
        • SHA256 b0787774ce03dbd072b8749a8e4ba3c7d09d771b2cc6f93544583fa1dc53e6fe
        • MD5 SHA1 SHA512

        journal.tmp

        • Path /data/data/com.mobile.indiapp/cache/httpCache/journal.tmp
        • Size 36B
        • SHA256 7080cb592d5149c858b206d3fd0d5e3e7d601f120af00b2616bee928ee1291ca
        • MD5 SHA1 SHA512

        unique

        • Path /data/data/com.mobile.indiapp/crashsdk/tags/unique
        • Size 213B
        • SHA256 791fb853986094e85779dec32e32a61bd8c8559f1461d3c8cae2e69aa5851d7b
        • MD5 SHA1 SHA512

        WaSession.db

        • Path /data/data/com.mobile.indiapp/databases/WaSession.db
        • Size 24KB
        • SHA256 ad696c86fee23bc47b1de15d87fa58da2dc356b9107c8b317e656f0f2a34e3cf
        • MD5 SHA1 SHA512 SSDEEP

        WaSession.db-journal

        • Path /data/data/com.mobile.indiapp/databases/WaSession.db-journal
        • Size 512B
        • SHA256 643241bff1ab3183bad3832c0d537e0bb8b433e6bb5cc6cced660e3046dbe102
        • MD5 SHA1 SHA512

        WaSession.db-journal

        • Path /data/data/com.mobile.indiapp/databases/WaSession.db-journal
        • Size 8KB
        • SHA256 719779fe6a688f66d635ea8d1f7df7bfcf9b7ecd7d3823a118adf78e6c630b25
        • MD5 SHA1 SHA512 SSDEEP

        WaSession.db-journal

        • Path /data/data/com.mobile.indiapp/databases/WaSession.db-journal
        • Size 8KB
        • SHA256 e980f755b65578e2131308b79d7627040109ac6fcf91ae5644a6b2e4fe7437e2
        • MD5 SHA1 SHA512 SSDEEP

        WaValue.db

        • Path /data/data/com.mobile.indiapp/databases/WaValue.db
        • Size 28KB
        • SHA256 7bfa4033b12ccebbee1a1ada0b3d4a843b205b954d17bfee71d28ed1bf848d62
        • MD5 SHA1 SHA512 SSDEEP

        WaValue.db-journal

        • Path /data/data/com.mobile.indiapp/databases/WaValue.db-journal
        • Size 512B
        • SHA256 622cf0ae9e2823770e01b86e912c6dc09377b6a7ce47c0f2617481ade4df1c5f
        • MD5 SHA1 SHA512

        WaValue.db-journal

        • Path /data/data/com.mobile.indiapp/databases/WaValue.db-journal
        • Size 8KB
        • SHA256 4ea4d09ed2344e417388991c54557488247cb48a6ce616d47695f189b58b6f27
        • MD5 SHA1 SHA512 SSDEEP

        WaValue.db-journal

        • Path /data/data/com.mobile.indiapp/databases/WaValue.db-journal
        • Size 8KB
        • SHA256 b1b4479c57066bd870d501626ae5ba5aec4ea8804494af8ed45c0c1c34195695
        • MD5 SHA1 SHA512 SSDEEP

        WaValue.db-journal

        • Path /data/data/com.mobile.indiapp/databases/WaValue.db-journal
        • Size 12KB
        • SHA256 8ebabaad1eb18bf8bf2b2ca53fa51c7654013b9e2720f072f6884f4e418e56af
        • MD5 SHA1 SHA512 SSDEEP

        WaValue.db-journal

        • Path /data/data/com.mobile.indiapp/databases/WaValue.db-journal
        • Size 12KB
        • SHA256 c92f2e11213e21c3146b5b214835d66982b91deba02436a7da7e4cd7000a15f0
        • MD5 SHA1 SHA512 SSDEEP

        WaValue.db-journal

        • Path /data/data/com.mobile.indiapp/databases/WaValue.db-journal
        • Size 8KB
        • SHA256 a8b43d0a873382aa31260b81efebec3e538a3d3e80dda0cc9aa9c6ef862bcd7f
        • MD5 SHA1 SHA512 SSDEEP

        clean_white_list.db

        • Path /data/data/com.mobile.indiapp/databases/clean_white_list.db
        • Size 12KB
        • SHA256 885e337c2156e4dbf2176a9677ade50418740532d222ccae5ad4aa371b54c6a4
        • MD5 SHA1 SHA512 SSDEEP

        clean_white_list.db-journal

        • Path /data/data/com.mobile.indiapp/databases/clean_white_list.db-journal
        • Size 512B
        • SHA256 b608bcdb359675fb37d3d8b9cac0114e69301d98a300f4ba51b5948b4b155cf3
        • MD5 SHA1 SHA512

        clean_white_list.db-journal

        • Path /data/data/com.mobile.indiapp/databases/clean_white_list.db-journal
        • Size 8KB
        • SHA256 ddf774db5103f3179f41dad1dbd631eb55c56e84da499859804172156cb4236c
        • MD5 SHA1 SHA512 SSDEEP

        common_db

        • Path /data/data/com.mobile.indiapp/databases/common_db
        • Size 28KB
        • SHA256 e5641858e401d0c5dfd97e2929c5a487c92387d1bbb8169237a7803f2d648b9f
        • MD5 SHA1 SHA512 SSDEEP

        common_db-journal

        • Path /data/data/com.mobile.indiapp/databases/common_db-journal
        • Size 512B
        • SHA256 935a86e79dd968930723cd66daed0745ae8d8d0123ae8f29718b637daa8ee256
        • MD5 SHA1 SHA512

        common_db-journal

        • Path /data/data/com.mobile.indiapp/databases/common_db-journal
        • Size 8KB
        • SHA256 8f48593452ed960a5e6213343152879e0af0c7443c14af5caca1d82867ec8c1a
        • MD5 SHA1 SHA512 SSDEEP

        common_db-journal

        • Path /data/data/com.mobile.indiapp/databases/common_db-journal
        • Size 8KB
        • SHA256 dea0ff3cc0514e0c3f6b5e094bc18df61272a55d09e341990e9458ade1eca7d8
        • MD5 SHA1 SHA512 SSDEEP

        dYJmUhl

        • Path /data/data/com.mobile.indiapp/databases/dYJmUhl
        • Size 28KB
        • SHA256 c6e811f1231ef277c26ac681f1b06c051af81e2e171e35cbac02927dbe5c2fdb
        • MD5 SHA1 SHA512 SSDEEP

        dYJmUhl-journal

        • Path /data/data/com.mobile.indiapp/databases/dYJmUhl-journal
        • Size 512B
        • SHA256 f43b097ff80aa0d4f17acb3e0d90ba0273624445034d06590ab65bb9af261776
        • MD5 SHA1 SHA512

        dYJmUhl-journal

        • Path /data/data/com.mobile.indiapp/databases/dYJmUhl-journal
        • Size 8KB
        • SHA256 4ecb51fff0631b6ea76fd895e1b0c879fc1acc8e9e38f9080b87f3b6e0b9b726
        • MD5 SHA1 SHA512 SSDEEP

        dYJmUhl-journal

        • Path /data/data/com.mobile.indiapp/databases/dYJmUhl-journal
        • Size 8KB
        • SHA256 30f07010b26503fde8f0466cfbde10c83a61cdf1e2ca1b74c1d618ffcaefd325
        • MD5 SHA1 SHA512 SSDEEP

        dYJmUhl-journal

        • Path /data/data/com.mobile.indiapp/databases/dYJmUhl-journal
        • Size 12KB
        • SHA256 b970aba36e83c9d84ea542d5f35441ce9ba99cacdf43cf157143186eb5466c02
        • MD5 SHA1 SHA512 SSDEEP

        dYJmUhl-journal

        • Path /data/data/com.mobile.indiapp/databases/dYJmUhl-journal
        • Size 12KB
        • SHA256 57cd59800a737b589638e3cb26b9ca8ffe51e5510db9ecf22ccb9d9045d510be
        • MD5 SHA1 SHA512 SSDEEP

        dYJmUhl-journal

        • Path /data/data/com.mobile.indiapp/databases/dYJmUhl-journal
        • Size 12KB
        • SHA256 b813f44576756c3802331fab47c3adfb2f4e5b503b9197914ec985b9b5c5a531
        • MD5 SHA1 SHA512 SSDEEP

        downloader

        • Path /data/data/com.mobile.indiapp/databases/downloader
        • Size 24KB
        • SHA256 4c7d03827a4f6d21350e296b174a12715bc8830abcac66d4d40b381439468d31
        • MD5 SHA1 SHA512 SSDEEP

        downloader-journal

        • Path /data/data/com.mobile.indiapp/databases/downloader-journal
        • Size 512B
        • SHA256 13c0cbf06a2b3f6bc546dce573cdabd8e738426f7906c69849c62f5c16a8b2c1
        • MD5 SHA1 SHA512

        downloader-journal

        • Path /data/data/com.mobile.indiapp/databases/downloader-journal
        • Size 8KB
        • SHA256 35def4d043602b9e799a38577f4b301e6a5c6b4da7164cfab72bb7a42b7be734
        • MD5 SHA1 SHA512 SSDEEP

        downloader-journal

        • Path /data/data/com.mobile.indiapp/databases/downloader-journal
        • Size 8KB
        • SHA256 ab4fd4772d19779a456f1441a9fe8288180b5ca4ae3609084564c0a4f5a25074
        • MD5 SHA1 SHA512 SSDEEP

        message

        • Path /data/data/com.mobile.indiapp/databases/message
        • Size 16KB
        • SHA256 fa040303c41e638957a9ca75a720cf8ba1b36a0c95383dfc673c0bb388ebc749
        • MD5 SHA1 SHA512 SSDEEP

        message-journal

        • Path /data/data/com.mobile.indiapp/databases/message-journal
        • Size 512B
        • SHA256 53b02d8758a63a547dae95faa302ccf39f3da868f03a9681d1e0ff4187c804bc
        • MD5 SHA1 SHA512

        message-journal

        • Path /data/data/com.mobile.indiapp/databases/message-journal
        • Size 8KB
        • SHA256 87e19dcf8bfb77c7573909408f569277654e0d8a663788812fef1e38459e5fee
        • MD5 SHA1 SHA512 SSDEEP

        pkgcache_basic.db

        • Path /data/data/com.mobile.indiapp/databases/pkgcache_basic.db
        • Size 224KB
        • SHA256 ae19ad69349c4fbc6a3ee2c96903b3a4b1160ed7775f59809e9dfbad75a97157
        • MD5 SHA1 SHA512 SSDEEP

        pkgcache_basic.db

        • Path /data/data/com.mobile.indiapp/databases/pkgcache_basic.db
        • Size 8KB
        • SHA256 7a820a29eac1da22fb9ce79cf2077a0aa80f050a8b7cf241715a8717aa5a4a82
        • MD5 SHA1 SHA512 SSDEEP

        pkgcache_basic.db-journal

        • Path /data/data/com.mobile.indiapp/databases/pkgcache_basic.db-journal
        • Size 8KB
        • SHA256 ea65f4775910a5409f356e02aeaeac4f3d0946fe23f74a8a220553a198ba16cf
        • MD5 SHA1 SHA512 SSDEEP

        .YFlurrySenderIndex.info.AnalyticsData_5TG4JGVTYX3S34VZQT7N_216

        • Path /data/data/com.mobile.indiapp/files/.YFlurrySenderIndex.info.AnalyticsData_5TG4JGVTYX3S34VZQT7N_216
        • Size 88B
        • SHA256 735b01dc08bededa8cf7ebf3b08972cefdc12f498edd968b6664b7b2c2fa491f
        • MD5 SHA1 SHA512

        .YFlurrySenderIndex.info.AnalyticsMain

        • Path /data/data/com.mobile.indiapp/files/.YFlurrySenderIndex.info.AnalyticsMain
        • Size 72B
        • SHA256 801ee8f13155406b640b4d7b630d0473100fcbb82eb727bff03585da4343ebe8
        • MD5 SHA1 SHA512

        .yflurrydatasenderblock.546f8892-2f28-4ab1-ac07-bfdb8a5bbc66

        • Path /data/data/com.mobile.indiapp/files/.yflurrydatasenderblock.546f8892-2f28-4ab1-ac07-bfdb8a5bbc66
        • Size 271B
        • SHA256 83ee98b7cb92498bec88bc3081e6471689525a679bd9cb9793c5251aec214709
        • MD5 SHA1 SHA512

        daemon

        • Path /data/data/com.mobile.indiapp/files/daemon
        • Size 13KB
        • SHA256 103750b77b32d0ca54d76695f47e4378dbce65de66841e5b04cf5ca2e1f890c5
        • MD5 SHA1 SHA512 SSDEEP

        home_app_data_us.json

        • Path /data/data/com.mobile.indiapp/files/preseted_data/home_app_data_us.json
        • Size 52KB
        • SHA256 7b2dd9f83792a4d9ce9d481a7124c276b2c94c339f5463ab6a62b0f026fd5dc3
        • MD5 SHA1 SHA512 SSDEEP

        hot_word_data_us.json

        • Path /data/data/com.mobile.indiapp/files/preseted_data/hot_word_data_us.json
        • Size 7KB
        • SHA256 8ffeb852ae53e0e977df7941a2b444a5b53706b75cf8daf93a6d71f377eefb5b
        • MD5 SHA1 SHA512 SSDEEP

        apks

        • Path /data/data/com.mobile.indiapp/files/whitelist/apks
        • Size 1B
        • SHA256 245843abef9e72e7efac30138a994bf6301e7e1d7d7042a33d42e863d2638811
        • MD5 SHA1 SHA512

        paths

        • Path /data/data/com.mobile.indiapp/files/whitelist/paths
        • Size 150B
        • SHA256 467fd3edb4724e5ed4710b4b2efbfe74139803698d2eff27431c5787b245408e
        • MD5 SHA1 SHA512

        ECBMD-5069-1718232064088

        • Path /data/data/com.mobile.indiapp/files/work/ECBMD-5069-1718232064088
        • Size 2KB
        • SHA256 81e9bffafcec7193b51dcf577cf5f67e78d804503a1d9aa3fd3e84139e872b14
        • MD5 SHA1 SHA512

        ECBMD-5069-1718232065729

        • Path /data/data/com.mobile.indiapp/files/work/ECBMD-5069-1718232065729
        • Size 1KB
        • SHA256 e3e04aa4a81ae782c1a1084b4ef316e0efef1b7182dd24568ad0900425ed6cbd
        • MD5 SHA1 SHA512

        ECPMD-5069-1718232061067

        • Path /data/data/com.mobile.indiapp/files/work/ECPMD-5069-1718232061067
        • Size 1KB
        • SHA256 96f68292d9d565173a5e5c40f0013585c9b87e5e255b7eab7fb63d72ab8a005d
        • MD5 SHA1 SHA512

        PBUD-5069-1718232063764

        • Path /data/data/com.mobile.indiapp/files/work/PBUD-5069-1718232063764
        • Size 89B
        • SHA256 54973455800c0180c0c975994e5b180094cb7522aa5ae3c57934e3031037dabc
        • MD5 SHA1 SHA512

        libsgmain_315561600000.zip

        • Path /data/user/0/com.mobile.indiapp/app_SGLib/app_1718232040/libsgmain_315561600000.zip
        • Size 42KB
        • SHA256 6343f3d34569d3a38b2571ecaf0e754d9c49360296e4ebe23c6813b6bdbbd4b1
        • MD5 SHA1 SHA512 SSDEEP

        sdk.jar

        • Path /data/user/0/com.mobile.indiapp/app_plugin/sdk.jar
        • Size 345KB
        • SHA256 f3af75556e07ef6cafe1d4ea115f4c08716ee79effb07e2b0762b1f04e3455d5
        • MD5 SHA1 SHA512 SSDEEP

        ContextData.xml

        • Path /storage/emulated/0/.DataStorage/ContextData.xml
        • Size 111B
        • SHA256 4d5cf3b9d755a6a7812d58ca57203093129343d6316631cfbaa4e0aa92de2226
        • MD5 SHA1 SHA512

        ContextData.xml

        • Path /storage/emulated/0/.DataStorage/ContextData.xml
        • Size 213B
        • SHA256 ad9632944f94fa02237b8f47fbb46800eec5e8d80b0202d0fcd2639fac789d2d
        • MD5 SHA1 SHA512

        ContextData.xml

        • Path /storage/emulated/0/.DataStorage/ContextData.xml
        • Size 65B
        • SHA256 3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793
        • MD5 SHA1 SHA512

        Alvin2.xml

        • Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
        • Size 8KB
        • SHA256 8fdcd0070b06a79ed3f242e04ab0ce8bf1e69842e4a9614b3a73eb92fe24a9ed
        • MD5 SHA1 SHA512 SSDEEP

        Alvin2.xml

        • Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
        • Size 167B
        • SHA256 72fd458f461f6df11406c8851553d3474f7f944d90297cc6134b6664d895ace2
        • MD5 SHA1 SHA512

        journal.tmp

        • Path /storage/emulated/0/Android/data/com.mobile.indiapp/cache/image_manager_disk_cache/journal.tmp
        • Size 31B
        • SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
        • MD5 SHA1 SHA512