Analysis

  • max time kernel
    173s
  • max time network
    189s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240611.1-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
  • submitted
    12/06/2024, 09:14

General

  • Target
    a027813482b259f8839d0d712a2b5aa8_JaffaCakes118.apk
  • Size 12.3MB
  • Sample240612-k7ddbaxbrc
  • SHA256 908174a824f24f671be6a634a49463c4193f5688a8c104fec9b444b262fe3feb
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 7 IoCs
  • Queries information about running processes on the device 1 TTPs 4 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Requests cell location 2 TTPs 4 IoCs

    Uses Android APIs to to get current cell location.

  • Queries information about active data network 1 TTPs 4 IoCs
  • Queries information about the current Wi-Fi connection 1 TTPs 4 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Reads information about phone network operator. 1 TTPs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 3 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 4 IoCs

Processes

  • com.sogou.androidtool
    1⤵
    • Checks if the Android device is rooted.
    • Queries information about running processes on the device
    • Requests cell location
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Checks CPU information
    • Checks memory information
    PID:4458
  • com.sogou.androidtool:remote_proxy
    1⤵
    • Checks if the Android device is rooted.
    • Queries information about running processes on the device
    • Requests cell location
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks memory information
    PID:4776
  • com.sogou.androidtool:push_service
    1⤵
    • Checks if the Android device is rooted.
    • Queries information about running processes on the device
    • Requests cell location
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks memory information
    PID:5052
  • com.sogou.androidtool:channel
    1⤵
    • Checks if the Android device is rooted.
    • Queries information about running processes on the device
    • Requests cell location
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks memory information
    PID:5310

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        MessageStore.db

        • Path /data/user/0/com.sogou.androidtool/databases/MessageStore.db
        • Size 36KB
        • SHA256 2d23a423eafa48dc712396d9a9390de1fe79f4e0d24ed9423c5e9e5c506316b7
        • MD5 SHA1 SHA512 SSDEEP

        MessageStore.db-journal

        • Path /data/user/0/com.sogou.androidtool/databases/MessageStore.db-journal
        • Size 12KB
        • SHA256 40a6fbd9d90f813abe5c83be26972753b09f7435f699832565bab73fd3586c4c
        • MD5 SHA1 SHA512 SSDEEP

        MessageStore.db-journal

        • Path /data/user/0/com.sogou.androidtool/databases/MessageStore.db-journal
        • Size 12KB
        • SHA256 5d273148edaeb13bd4ec031634204f8a8f22afcf831a4aad99815b6cc9f1a752
        • MD5 SHA1 SHA512 SSDEEP

        MessageStore.db-journal

        • Path /data/user/0/com.sogou.androidtool/databases/MessageStore.db-journal
        • Size 12KB
        • SHA256 810538a63556832fda72d34827487807bfdbd2cbd207247d856adc778a99eb78
        • MD5 SHA1 SHA512 SSDEEP

        MsgLogStore.db

        • Path /data/user/0/com.sogou.androidtool/databases/MsgLogStore.db
        • Size 56KB
        • SHA256 a49248a2336dd7c433d8155d8854f03fe36d60b3c640a5d9d7ee7821d62bd25a
        • MD5 SHA1 SHA512 SSDEEP

        MsgLogStore.db-journal

        • Path /data/user/0/com.sogou.androidtool/databases/MsgLogStore.db-journal
        • Size 512B
        • SHA256 909009f0ab67d464b498bc95606bff49267d7900b436410fed971092b9f8abd8
        • MD5 SHA1 SHA512

        MsgLogStore.db-journal

        • Path /data/user/0/com.sogou.androidtool/databases/MsgLogStore.db-journal
        • Size 8KB
        • SHA256 cab249ad278fca7e43e4f23e1fed7ffa2d2ad135a344074c6cb5459d36be70b3
        • MD5 SHA1 SHA512 SSDEEP

        MsgLogStore.db-journal

        • Path /data/user/0/com.sogou.androidtool/databases/MsgLogStore.db-journal
        • Size 8KB
        • SHA256 6961bc00b2e923a964464f7f8de642cdaf18ee10144a40fde082b4ad2dbf75d9
        • MD5 SHA1 SHA512 SSDEEP

        account.db

        • Path /data/user/0/com.sogou.androidtool/databases/account.db
        • Size 12KB
        • SHA256 d2ab452d9360848f46af866b870b5c6fc98230b09c72b89cb1a4b2778586678e
        • MD5 SHA1 SHA512 SSDEEP

        account.db-journal

        • Path /data/user/0/com.sogou.androidtool/databases/account.db-journal
        • Size 512B
        • SHA256 4a708a3c8d066530b03446787ab4dd74ee482f9754371ab3767b96990e7ba7e9
        • MD5 SHA1 SHA512

        account.db-journal

        • Path /data/user/0/com.sogou.androidtool/databases/account.db-journal
        • Size 8KB
        • SHA256 7b34619b8485de7f555d28639da2c4efb3938066a35c7679dfe8619f7cb272ed
        • MD5 SHA1 SHA512 SSDEEP

        account.db-journal

        • Path /data/user/0/com.sogou.androidtool/databases/account.db-journal
        • Size 8KB
        • SHA256 31ee9b60dfdf97772b6ec572b9e03cb9b7fe0f93b40220d3c7e30560c7c6342a
        • MD5 SHA1 SHA512 SSDEEP

        bugly_db_

        • Path /data/user/0/com.sogou.androidtool/databases/bugly_db_
        • Size 60KB
        • SHA256 5376ff2725ff53a18ca109790eba4d22059b467371d19d3e67edf1f73cc0a858
        • MD5 SHA1 SHA512 SSDEEP

        bugly_db_-journal

        • Path /data/user/0/com.sogou.androidtool/databases/bugly_db_-journal
        • Size 8KB
        • SHA256 6eb8035876caf371294dc900c4504f9051b63ecf53d24ab4f18d1995fbd4f83c
        • MD5 SHA1 SHA512 SSDEEP

        bugly_db_-journal

        • Path /data/user/0/com.sogou.androidtool/databases/bugly_db_-journal
        • Size 8KB
        • SHA256 2f95a004984b1c5df28cfc32e07bc8fd7d9f873f385fc3e70d80692fb525f88b
        • MD5 SHA1 SHA512 SSDEEP

        bugly_db_-journal

        • Path /data/user/0/com.sogou.androidtool/databases/bugly_db_-journal
        • Size 8KB
        • SHA256 7eb2dbf04c99d38e1ef88833dd672c63df8e0789e064444a868fe02e1ac1a66e
        • MD5 SHA1 SHA512 SSDEEP

        bugly_db_-journal

        • Path /data/user/0/com.sogou.androidtool/databases/bugly_db_-journal
        • Size 12KB
        • SHA256 4da292c0569f8cfb5e2b366e4cb19d45db402084c73f9a94d3a1a631ef3d4244
        • MD5 SHA1 SHA512 SSDEEP

        bugly_db_-journal

        • Path /data/user/0/com.sogou.androidtool/databases/bugly_db_-journal
        • Size 12KB
        • SHA256 cc09c4be48fad52504f47b6953c1f09e485aabda32338b0b2e6d07f8a85b0664
        • MD5 SHA1 SHA512 SSDEEP

        bugly_db_-journal

        • Path /data/user/0/com.sogou.androidtool/databases/bugly_db_-journal
        • Size 12KB
        • SHA256 0db25550fea802700f76a067d8bd7edb0c2cd618706c779440945b9a535d5da9
        • MD5 SHA1 SHA512 SSDEEP

        downloads_classic.db

        • Path /data/user/0/com.sogou.androidtool/databases/downloads_classic.db
        • Size 28KB
        • SHA256 fed4fe36b9be49602c9e44a3c3db111c24c9749fa4360401698f8baaff2afac8
        • MD5 SHA1 SHA512 SSDEEP

        downloads_classic.db-journal

        • Path /data/user/0/com.sogou.androidtool/databases/downloads_classic.db-journal
        • Size 512B
        • SHA256 fa145fec848fd9b9a5a59b3efd29b9c7c3125aef81ffb69276697523bbf26d94
        • MD5 SHA1 SHA512

        downloads_classic.db-journal

        • Path /data/user/0/com.sogou.androidtool/databases/downloads_classic.db-journal
        • Size 8KB
        • SHA256 9d6d78dfbd261a914b0fac1939eb7042d34a60313b42d61d20da8f5ed0559d54
        • MD5 SHA1 SHA512 SSDEEP

        downloads_classic.db-journal

        • Path /data/user/0/com.sogou.androidtool/databases/downloads_classic.db-journal
        • Size 36KB
        • SHA256 f2434b69ad5ddbdeb3796b9e34fa428cf6fc31bf987dee42c12816e3632a128b
        • MD5 SHA1 SHA512 SSDEEP