Analysis

  • max time kernel
    64s
  • max time network
    151s
  • platform
    android_x64
  • resource
    android-x64-20240611.1-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system
  • submitted
    13-06-2024 00:02

General

  • Target

    a30f0843c579505b6149e69daeda3d58_JaffaCakes118.apk

  • Size

    906KB

  • MD5

    a30f0843c579505b6149e69daeda3d58

  • SHA1

    9a8c6cb3f3a7cdab071caa2869ab9bffe7474f63

  • SHA256

    4a9d76ef21a86f91fb239054fdbeb47d77bb21179b3702887ca0604248c25867

  • SHA512

    0033d87d539ba5d2b244758b73c3ee1058c40d86dccf2f64ebc31548f61ba4a74f39d572430f3d3df1a7c4bfe8aadf35779311b4501033a7fe001e8e923ff4f5

  • SSDEEP

    12288:izgX/bmAT/tK3bvE1caV2W43mmaO3brR6tdQ0p9ttS2bWkB2eT5TMzAx3ZXb9A1n:IAbpeTAO32dRLty2/T5TTL8

Malware Config

Signatures

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Requests cell location 2 TTPs 1 IoCs

    Uses Android APIs to to get current cell location.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
  • Reads information about phone network operator. 1 TTPs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.sim.gerard.bgubhun
    1⤵
    • Requests cell location
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5132

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.sim.gerard.bgubhun/databases/lcdownloads
    Filesize

    16KB

    MD5

    0a2ba49032b8868e7e307195a92a3463

    SHA1

    05f3d6d75a6d19068e0c7a609aeabe5d639eb945

    SHA256

    ef820a304ba1e7633f04e956b628bd2ae19c940ed9385c19a7ba00aecd29fd1a

    SHA512

    08fa17e17d7c3c88ff4d093e008ffbd3e2b2ddb8ca0041476b3baee7a31c06a2896632c842a2298684f0dbb8a15b950836669d7d749757fbd5d3718d79ca30e4

  • /data/data/com.sim.gerard.bgubhun/databases/lcdownloads-journal
    Filesize

    8KB

    MD5

    a78c58049a8bbddf02327ee122d7a156

    SHA1

    79d0a4d43e3ad16b18a83b8691dad4d70c14b5f4

    SHA256

    817eff7b6325e2ba29194062a79af00c2f49d3259285e28b6d848d0a5b077b3a

    SHA512

    067612b752ba2eba439170dab71a9ae9ce079396012e2e8424620b22d60e808b30c0e9a8cae07ea85ceecf022ba32de0af410368dcdd87d076ba7803d0b2d57f

  • /data/data/com.sim.gerard.bgubhun/databases/lcdownloads-journal
    Filesize

    8KB

    MD5

    6922ab10be3e9c903fcdbcead6bf2ca7

    SHA1

    95da0441ff72bbe064c4b04feebc0d88fc5f00ba

    SHA256

    5a0bb56b8cc4fba546b4c4631e170fe7c3fe885dc5b4cbde1fd67ccc389b8aa5

    SHA512

    7767061cb0f85e595c5da1bcc94f6820eae2f4362ba6157ad213f9852961fe139c33337afe0b49159f0831de58a79289a7b1090df5ff6304864e9df0be6faf42

  • /data/data/com.sim.gerard.bgubhun/databases/lcdownloads-journal
    Filesize

    512B

    MD5

    bfb44578e4df1b482fe260ddd1a049c9

    SHA1

    ee2e9c4f7116a92dbe563f2c7499baf0506497f3

    SHA256

    e57e181ca1598c59470be7c7094a6e06d29a8facde5d216134546ec355647afc

    SHA512

    3de0c5fd4f8ea9f4e04050958d0bb2753d356ac761b92cf5fc6d0c54c409f790d141be2cea7aa1ae4bf1a6692cfa42dd774c846ae594ce91156283acec1bf73b

  • /data/data/com.sim.gerard.bgubhun/files/setting.txt
    Filesize

    102B

    MD5

    d904514dcf72e0aae8a6183b3220977e

    SHA1

    ce62e1dbb8b20292aa7580d1f3499c3f2c1c5c2d

    SHA256

    4dbbd8c6247aa1c3f6f1e781123c0ba46cfcd07dc4a90c720bfaaba94a7927d0

    SHA512

    30bbe3f927176eb0569841b1835362882f3417e4d1ca2338ef012e327dc883cd540e2cc133bc1ab4995c65a54bfe9cd091bc833ff930743d16f613825d87b241

  • /storage/emulated/0/Download/9j/1.dat
    Filesize

    15B

    MD5

    6a5db17ef8a43dcf81b848c15a8bbc21

    SHA1

    e6ee102b54ed36ae8f9a61d4b585b87e05ee7f59

    SHA256

    e4b2cccde8a5db70fdcbfcb7eaf74771aa2200081d7e5c671b92afd41e999118

    SHA512

    7723f274e5ccb84d4dc8f92bbf58f052b2135bb89a688cb6a7824510cb1d122fc218cd32ec1c5d5454d6a66c9a9407183ffb2b1c0eb00722b57b8d517392147e

  • /storage/emulated/0/Download/ads/clst.dat
    Filesize

    15B

    MD5

    daca150bd0e691724c3e00d163515bc9

    SHA1

    09d96deae86123b51f21b429229d25f5e1d4838c

    SHA256

    b374af53726b9c72266ed0112cb278f7bf274737d909157c1e1c450b475a4b74

    SHA512

    e0d5a8d207d47e297eafc97a811cd08262cb3cbef3c9c171789df15944bdf8b7126106d56ce1cebd64912e21c48bc7a7ef755647e9bec4b06b62731270e71df8

  • /storage/emulated/0/ljk/capin/time.dat
    Filesize

    15B

    MD5

    ba1359d94d8bd78cf6b732027bffca47

    SHA1

    6bfa656280ca69c6254360ec613df3b2554685cc

    SHA256

    77cc99206d9f35ac283554cff8f6337e97e5b91f126ee394f73a49003e39b54d

    SHA512

    5ec3b231172c00f6d6d6196232f9e9f6615a1f79e8d4781c7d6a4b0877b5f0b643e850947fd65c9acb2cda39fa8c9b5113000243f9b43358892151efb2994869