Analysis
-
max time kernel
179s -
max time network
130s -
platform
android_x86 -
resource
android-x86-arm-20240611.1-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system -
submitted
12-06-2024 11:07
Static task
static1
Behavioral task
behavioral1
Sample
a07061faa8213d27754c0f8c50da7d85_JaffaCakes118.apk
Resource
android-x86-arm-20240611.1-en
Behavioral task
behavioral2
Sample
alipay_plugin.apk
Resource
android-x86-arm-20240611.1-en
Behavioral task
behavioral3
Sample
alipay_plugin.apk
Resource
android-x64-20240611.1-en
Behavioral task
behavioral4
Sample
alipay_plugin.apk
Resource
android-x64-arm64-20240611.1-en
General
-
Target
a07061faa8213d27754c0f8c50da7d85_JaffaCakes118.apk
-
Size
7.4MB
-
MD5
a07061faa8213d27754c0f8c50da7d85
-
SHA1
ba10b7f54cf725f39763ad9e3bb9e4ce4965e253
-
SHA256
171b0d607eb19ff1816012769e9a1c0671b16d238ec2b0a6295f9316345af4ed
-
SHA512
c7c80cd840b6bf5df82fb267a53c1dea20293ee892e0fc0fbca1e8be7f5784c81d9265acf04ac01ad62c50532826f8f41117df6824db393dc8ab5dc641c44692
-
SSDEEP
196608:apcr/Aya7rbC+btfiyJSQTZMkLF6CTYAkUrl9FufoZc7cY7:aeLmTtKzQTp6CTY9woBw2
Malware Config
Signatures
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
Processes:
com.cdjm.app.gdmahjong.coredescription ioc process Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.cdjm.app.gdmahjong.core -
Queries information about active data network 1 TTPs 1 IoCs
Processes:
com.cdjm.app.gdmahjong.coredescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.cdjm.app.gdmahjong.core -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
Processes:
com.cdjm.app.gdmahjong.coredescription ioc process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.cdjm.app.gdmahjong.core -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
Processes:
com.cdjm.app.gdmahjong.coredescription ioc process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.cdjm.app.gdmahjong.core -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
com.cdjm.app.gdmahjong.coredescription ioc process Framework service call android.app.IActivityManager.registerReceiver com.cdjm.app.gdmahjong.core -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes:
com.cdjm.app.gdmahjong.coredescription ioc process Framework API call javax.crypto.Cipher.doFinal com.cdjm.app.gdmahjong.core -
Checks CPU information 2 TTPs 1 IoCs
Processes:
com.cdjm.app.gdmahjong.coredescription ioc process File opened for read /proc/cpuinfo com.cdjm.app.gdmahjong.core -
Checks memory information 2 TTPs 1 IoCs
Processes:
com.cdjm.app.gdmahjong.coredescription ioc process File opened for read /proc/meminfo com.cdjm.app.gdmahjong.core
Processes
-
com.cdjm.app.gdmahjong.core1⤵
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4240
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5c31bc4083347695263eb9075d3719d37
SHA1a00569b46e6d7a97aee30ec4681d4a6782d725b9
SHA25661a04457f37cdb6f4c63c0e0cb6b6cfa0b680fef581bfbe59e0a034b02f1d53d
SHA512d59c98d46873d7dbb78f8e51d86c2b71773bf96cda4aaa368c88a08719e4618a29db537045a4c07dfc26b4627aab00765fc41f713f56a6f8165a408893b2cbe7
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
44KB
MD5d6c37a943891612312e6e9653d4e9d23
SHA1ffe3d0e76ddcfb0ecc69993764edbe05e746ddb3
SHA256dfadb33809490837528d5e3efb5621405e651c7b905e0bd2160ded82ecd63d17
SHA512ac4af6e5c5f13e7f187cae93f2fcaa2cdcd347d8f231e105fe8d35ebe93e2e8522d7d18fe9a6222becf19dad8d9f47cb1775b200e57a8aab8f712ac76c39583e
-
Filesize
512B
MD5cc222296e9a7a7ae638d186f00437fa7
SHA13009318002d7a8843d4823b0925692c2bd9e473e
SHA256be5204648a6f9413dd40a4700afe908d78de31808a55b2b6c4eead762e08d677
SHA51285c9c992a3f4887951fc37e2be4fb6e3f025d98945c13e820645918a8134c51af695ecd887c353bd9fa2c370366021b1152ebc7da466abc78887a02ad43bd2a0
-
Filesize
36KB
MD5c174bbc39c99858338ca9ee9086b2eec
SHA10b29416c6ae9436e952e47f5d4b1e1f6cdcdabb6
SHA2565d04372aec3196bf98b09c2462caaf2697191f3aca21b9280435a5e6205bb365
SHA512c3f967f6fff52f3860e60b6b606a6b3fbb283c8ffcd96aec052a1313bca9725c7b9d2784505603a3819c71fc8b583b3f38dc03540cb5133f09c8a3ccacd43049
-
Filesize
512B
MD51b78367fdf28b6af15e5769f60d5b633
SHA15e8ea1b7fa0132391a2c7a054407d2dc997f146a
SHA256fc006d8b66ce7bd4d97cee684db17472af5596f3e948f8677bcb716314984d36
SHA5128080fda004363e4547a6b9ed34cda4ff7ce850ee4ea87ecbb6fc5803ce74a9891d4db3883ef9c033c4cddf2b1a695a66787bbfd8cad232d7630821e7bf344426
-
Filesize
32KB
MD55928bad6414775206a7c7f25a0627ee8
SHA18a0d0383e6f9c3fd084596063ddafe036e79160f
SHA256cf9cc930c10b144bbb5cf90511a5e229cf310d5a958d7a9e165a538606da2b15
SHA51277f26f3857262fb6e65db896da80d2f424c6c67ac4e593420e5dcb061506f45348b28878354664d0da0096b0aa1c38fd8f5543e4a3fd54d6187474939997a60c
-
Filesize
13B
MD5907809c7a0beb0272cfb3c0ea089b19f
SHA199e2f552fb9d3d618a48236eddfd108188aef9cb
SHA2566bd2dc0b7ab7bf46f4119bbb09fddce969c83aa896312a4874df89451d58cf53
SHA5121a53e006b98b802f3addbd8ef9d85b6962f570e76c0dfca93abd295e41203025637a801ddcd41d5ff8cefc75e5f49ec040d167a8b69048245f09e5eabcf6bc63