Analysis
-
max time kernel
33s -
max time network
132s -
platform
android_x64 -
resource
android-x64-arm64-20240611.1-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system -
submitted
12-06-2024 14:27
Static task
static1
Behavioral task
behavioral1
Sample
a0fe08922e5c9dc631d43cd126621c65_JaffaCakes118.apk
Resource
android-x86-arm-20240611.1-en
Behavioral task
behavioral2
Sample
a0fe08922e5c9dc631d43cd126621c65_JaffaCakes118.apk
Resource
android-x64-20240611.1-en
Behavioral task
behavioral3
Sample
a0fe08922e5c9dc631d43cd126621c65_JaffaCakes118.apk
Resource
android-x64-arm64-20240611.1-en
General
-
Target
a0fe08922e5c9dc631d43cd126621c65_JaffaCakes118.apk
-
Size
12.6MB
-
MD5
a0fe08922e5c9dc631d43cd126621c65
-
SHA1
2c84de7e3e38762b1e6669d3f61adfc1cba9bd26
-
SHA256
093f59e21155961b3103d1b366b1bbc12727bd124c408dd95787323b3ea0792b
-
SHA512
e8ba8625deed098121a605597e1b1b4b2b0f2ce74a1ea53a017a77885c78de448b7b59416c00a1d5508a3cf7e767a00f2d6209a3780799dd3d247a8156d6823c
-
SSDEEP
393216:8fOIqk9YT7PnR97RgPlycEQivGnwetBULr45vOXVqF:xWYT7PYoOptWYBmG
Malware Config
Signatures
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Queries information about active data network 1 TTPs 1 IoCs
Processes:
de.nr.android.app.locator.premiumdescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo de.nr.android.app.locator.premium -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
Processes:
de.nr.android.app.locator.premiumdescription ioc process Framework service call android.net.wifi.IWifiManager.getConnectionInfo de.nr.android.app.locator.premium -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
Processes:
de.nr.android.app.locator.premiumdescription ioc process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone de.nr.android.app.locator.premium -
Reads information about phone network operator. 1 TTPs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/user/0/de.nr.android.app.locator.premium/app_fiverocks/events2Filesize
16KB
MD539adbdea5ba969c32f6b37fb71e4b99c
SHA10a0fc2b036d865d4cb50b59aaadaf68ed97acbda
SHA256e3d96c59a96b1b21ba0bb28c88f5cac87f94f13993ed55bda33aa63b2baeacbf
SHA512f740c0b7f4c2c00171ca84ce82e610ef7655cdf7c57b2f22ef48f43c60a5390d20d96bb8910f5dcc9f2f0130ea3feb553f77fc8f862ab5d5c0c6abeda9e907d3
-
/data/user/0/de.nr.android.app.locator.premium/app_fiverocks/events2-journalFilesize
512B
MD5585c758c20d3d7a45c3bc4562541acdd
SHA1f334b54de9f1486ac17d01ec7cd72f5e4df6b0fb
SHA2562760778cdc9be6a51c73d9ddcff5e3b9277c37dcaad252560a426c1dc6fa5602
SHA512343940126a0456bd3f579465cfc117da557ce693e576392b71eb96ca7ea1fc4e6b9ef56814c24eeb2bcc9f4ab9726a919bea126b10bb850cb9027c7e8c938bb6
-
/data/user/0/de.nr.android.app.locator.premium/app_fiverocks/events2-journalFilesize
8KB
MD5c32000f2815c83d6e946515a0c341cbc
SHA1d0a93f99eba041ca589287b3766bb43bfa8006e3
SHA2562ce25cab5d35631dc8e171498cd66e2e648d9f37e22d63e9319e6c5f835fbe8a
SHA512b4f842e927eda159ecdb1a0fe23182f6975a86daf57df588f58086332508cc725107362986828c3c3472c317aeaf62de2f18c45d17fb2e1e2aadc89ae4009ed0
-
/data/user/0/de.nr.android.app.locator.premium/app_fiverocks/events2-journalFilesize
8KB
MD5b175b7a9d640d938005631f68921d729
SHA14b4093b8f4136ec8d006e035ef1e98301134dc64
SHA256dbf25d618b92da6f2823d0e28f01fa323631814365cd8befae3fbf61a9282ac3
SHA512100223cbc2461f6eb67418fcba7d0bfacaf8c1a69cbd556abac15c518a57dfa60a5f1f1d693f1e96c6f79ed988d3442a3c1c7b725689e3056691ea7873500990
-
/data/user/0/de.nr.android.app.locator.premium/app_fiverocks/events2-journalFilesize
8KB
MD52708e571829d333d5ffb63746812a7df
SHA1e3ff628f656b2f717ec7e4070e1f6027e9e4263e
SHA256006987df6d297293dd57c928138a7023c506f9ec90d3135fee845c6d83caa68a
SHA512673a863ec4a85647dc2524d2ef913ff2eace4848d4dfcf8dcc7d3292eb0fd0f11e02b8c3e8e9a3ab53a9ab6e8702436029b556083d61b979d25dd291c2d21f3f
-
/data/user/0/de.nr.android.app.locator.premium/app_fiverocks/events2-journalFilesize
8KB
MD5c8246b63c39b0a77b565fad0d096cee1
SHA1ff22b9f13469dd72b126323b1af2bf6e25173ccc
SHA2566bbb1a2facb82e9f75ffcf070c33aed4d8464278f53c021b090859b1a297f999
SHA5129aaa3255d9afb6aa62b33c948630cbd99239f08181ac78ca7d0bf5071ae2c3bc8e28f169ce396dc818f18b3675ed3b23f923021aab88e490764af4219a98d18a
-
/data/user/0/de.nr.android.app.locator.premium/app_fiverocks/installFilesize
36B
MD51f53cc359c8bf22bc9dc51b81e595ba9
SHA15685d8cabbecc3062445129f45c9a54288bced83
SHA25606914fba634a3407c2dce1ccb54712a0596c8e547de7909b5cb35191c5909f5c
SHA512525af9c5f1b1aa41a015d53e9819e34f4a6cbd7f05b46c55472573e5cc4cb70039de615335c6d792d38ce799f4a7cc8f32e207cce0e4ca9f84ee42e2c112ae7c