Analysis

  • max time kernel
    33s
  • max time network
    132s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240611.1-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
  • submitted
    12-06-2024 14:27

General

  • Target

    a0fe08922e5c9dc631d43cd126621c65_JaffaCakes118.apk

  • Size

    12.6MB

  • MD5

    a0fe08922e5c9dc631d43cd126621c65

  • SHA1

    2c84de7e3e38762b1e6669d3f61adfc1cba9bd26

  • SHA256

    093f59e21155961b3103d1b366b1bbc12727bd124c408dd95787323b3ea0792b

  • SHA512

    e8ba8625deed098121a605597e1b1b4b2b0f2ce74a1ea53a017a77885c78de448b7b59416c00a1d5508a3cf7e767a00f2d6209a3780799dd3d247a8156d6823c

  • SSDEEP

    393216:8fOIqk9YT7PnR97RgPlycEQivGnwetBULr45vOXVqF:xWYT7PYoOptWYBmG

Malware Config

Signatures

  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • de.nr.android.app.locator.premium
    1⤵
    • Obtains sensitive information copied to the device clipboard
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Checks CPU information
    • Checks memory information
    PID:4441

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/de.nr.android.app.locator.premium/app_fiverocks/events2
    Filesize

    16KB

    MD5

    39adbdea5ba969c32f6b37fb71e4b99c

    SHA1

    0a0fc2b036d865d4cb50b59aaadaf68ed97acbda

    SHA256

    e3d96c59a96b1b21ba0bb28c88f5cac87f94f13993ed55bda33aa63b2baeacbf

    SHA512

    f740c0b7f4c2c00171ca84ce82e610ef7655cdf7c57b2f22ef48f43c60a5390d20d96bb8910f5dcc9f2f0130ea3feb553f77fc8f862ab5d5c0c6abeda9e907d3

  • /data/user/0/de.nr.android.app.locator.premium/app_fiverocks/events2-journal
    Filesize

    512B

    MD5

    585c758c20d3d7a45c3bc4562541acdd

    SHA1

    f334b54de9f1486ac17d01ec7cd72f5e4df6b0fb

    SHA256

    2760778cdc9be6a51c73d9ddcff5e3b9277c37dcaad252560a426c1dc6fa5602

    SHA512

    343940126a0456bd3f579465cfc117da557ce693e576392b71eb96ca7ea1fc4e6b9ef56814c24eeb2bcc9f4ab9726a919bea126b10bb850cb9027c7e8c938bb6

  • /data/user/0/de.nr.android.app.locator.premium/app_fiverocks/events2-journal
    Filesize

    8KB

    MD5

    c32000f2815c83d6e946515a0c341cbc

    SHA1

    d0a93f99eba041ca589287b3766bb43bfa8006e3

    SHA256

    2ce25cab5d35631dc8e171498cd66e2e648d9f37e22d63e9319e6c5f835fbe8a

    SHA512

    b4f842e927eda159ecdb1a0fe23182f6975a86daf57df588f58086332508cc725107362986828c3c3472c317aeaf62de2f18c45d17fb2e1e2aadc89ae4009ed0

  • /data/user/0/de.nr.android.app.locator.premium/app_fiverocks/events2-journal
    Filesize

    8KB

    MD5

    b175b7a9d640d938005631f68921d729

    SHA1

    4b4093b8f4136ec8d006e035ef1e98301134dc64

    SHA256

    dbf25d618b92da6f2823d0e28f01fa323631814365cd8befae3fbf61a9282ac3

    SHA512

    100223cbc2461f6eb67418fcba7d0bfacaf8c1a69cbd556abac15c518a57dfa60a5f1f1d693f1e96c6f79ed988d3442a3c1c7b725689e3056691ea7873500990

  • /data/user/0/de.nr.android.app.locator.premium/app_fiverocks/events2-journal
    Filesize

    8KB

    MD5

    2708e571829d333d5ffb63746812a7df

    SHA1

    e3ff628f656b2f717ec7e4070e1f6027e9e4263e

    SHA256

    006987df6d297293dd57c928138a7023c506f9ec90d3135fee845c6d83caa68a

    SHA512

    673a863ec4a85647dc2524d2ef913ff2eace4848d4dfcf8dcc7d3292eb0fd0f11e02b8c3e8e9a3ab53a9ab6e8702436029b556083d61b979d25dd291c2d21f3f

  • /data/user/0/de.nr.android.app.locator.premium/app_fiverocks/events2-journal
    Filesize

    8KB

    MD5

    c8246b63c39b0a77b565fad0d096cee1

    SHA1

    ff22b9f13469dd72b126323b1af2bf6e25173ccc

    SHA256

    6bbb1a2facb82e9f75ffcf070c33aed4d8464278f53c021b090859b1a297f999

    SHA512

    9aaa3255d9afb6aa62b33c948630cbd99239f08181ac78ca7d0bf5071ae2c3bc8e28f169ce396dc818f18b3675ed3b23f923021aab88e490764af4219a98d18a

  • /data/user/0/de.nr.android.app.locator.premium/app_fiverocks/install
    Filesize

    36B

    MD5

    1f53cc359c8bf22bc9dc51b81e595ba9

    SHA1

    5685d8cabbecc3062445129f45c9a54288bced83

    SHA256

    06914fba634a3407c2dce1ccb54712a0596c8e547de7909b5cb35191c5909f5c

    SHA512

    525af9c5f1b1aa41a015d53e9819e34f4a6cbd7f05b46c55472573e5cc4cb70039de615335c6d792d38ce799f4a7cc8f32e207cce0e4ca9f84ee42e2c112ae7c