01049b9102fdc8e2cf8fb48db3c24e240e8e62aba06f38276a38125d45a12953

Analysis

max time kernel
16s
max time network
159s
platform
android_x86
resource
android-x86-arm-20240611.1-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
submitted
13-06-2024 08:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a49242522bcc91436deab009fbc290d2_JaffaCakes118.apk
Size

6.5MB
MD5

a49242522bcc91436deab009fbc290d2
SHA1

07ccbf75e3e71c07afa4ef1abb468b7bc88cb2ec
SHA256

01049b9102fdc8e2cf8fb48db3c24e240e8e62aba06f38276a38125d45a12953
SHA512

b4b39b3940e997657668b23768e1f88e3393be6878e1f39d045c2b6b05a39753ca9323a6d0dd5d58347d7211eb1abcb8c63f10aab7b71a5e3519cc891b9b9870
SSDEEP

196608:iLQnoPP9yhqLxVLpCq8VjlHXVa0pEklN+Lhalf6:znoPP9yhqLnp8PFa0pEkKhF

Score

8^/10

discovery evasion impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs
evasion

T1426

Processes:

com.kakajapan.word/system/bin/sh -c type su

ioc process

/system/app/Superuser.apk com.kakajapan.word
/sbin/su /system/bin/sh -c type su
Queries information about active data network 1 TTPs 1 IoCs
discovery

T1421

Processes:

com.kakajapan.word

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.kakajapan.word
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

T1421

Processes:

com.kakajapan.word

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.kakajapan.word
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

T1624.001

Processes:

com.kakajapan.word

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.kakajapan.word
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

T1471

Processes:

com.kakajapan.word

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.kakajapan.word
Checks memory information 2 TTPs 1 IoCs

T1633.001

T1426

Processes:

com.kakajapan.word

description ioc process

File opened for read /proc/meminfo com.kakajapan.word

ioc	process
/system/app/Superuser.apk	com.kakajapan.word
/sbin/su	/system/bin/sh -c type su

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.kakajapan.word

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.kakajapan.word

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.kakajapan.word

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.kakajapan.word

description	ioc	process
File opened for read	/proc/meminfo	com.kakajapan.word

com.kakajapan.word
1⤵
- Checks if the Android device is rooted.
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:4287

/system/bin/sh -c getprop ro.board.platform
2⤵
PID:4350

getprop ro.board.platform
2⤵
PID:4350

/system/bin/sh -c type su
2⤵
- Checks if the Android device is rooted.
PID:4378

logcat -d -v threadtime
2⤵
PID:4405

logcat -d -v threadtime
2⤵
PID:4423

/system/bin/sh -c getprop ro.miui.ui.version.name
2⤵
PID:4444

getprop ro.miui.ui.version.name
2⤵
PID:4444

/system/bin/sh -c getprop ro.build.version.emui
2⤵
PID:4473

getprop ro.build.version.emui
2⤵
PID:4473

/system/bin/sh -c getprop ro.lenovo.series
2⤵
PID:4498

getprop ro.lenovo.series
2⤵
PID:4498

/system/bin/sh -c getprop ro.build.nubia.rom.name
2⤵
PID:4523

getprop ro.build.nubia.rom.name
2⤵
PID:4523

/system/bin/sh -c getprop ro.meizu.product.model
2⤵
PID:4548

getprop ro.meizu.product.model
2⤵
PID:4548

/system/bin/sh -c getprop ro.build.version.opporom
2⤵
PID:4573

getprop ro.build.version.opporom
2⤵
PID:4573

/system/bin/sh -c getprop ro.vivo.os.build.display.id
2⤵
PID:4600

getprop ro.vivo.os.build.display.id
2⤵
PID:4600

/system/bin/sh -c getprop ro.aa.romver
2⤵
PID:4627

getprop ro.aa.romver
2⤵
PID:4627

/system/bin/sh -c getprop ro.lewa.version
2⤵
PID:4651

getprop ro.lewa.version
2⤵
PID:4651

/system/bin/sh -c getprop ro.gn.gnromvernumber
2⤵
PID:4675

getprop ro.gn.gnromvernumber
2⤵
PID:4675

/system/bin/sh -c getprop ro.build.tyd.kbstyle_version
2⤵
PID:4699

getprop ro.build.tyd.kbstyle_version
2⤵
PID:4699

/system/bin/sh -c getprop ro.build.fingerprint
2⤵
PID:4724

getprop ro.build.fingerprint
2⤵
PID:4724

/system/bin/sh -c getprop ro.build.rom.id
2⤵
PID:4749

getprop ro.build.rom.id
2⤵
PID:4749

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.kakajapan.word/databases/bugly_db_legu
Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.kakajapan.word/databases/bugly_db_legu-journal
Filesize
512B

MD5
6038168b406e04d94e7d600233ebffa3

SHA1
d745cc4674b0b33bbaf3789604c73c0c5730e804

SHA256
2d023a88ebe4fb2c169ef3a051505a2783b897ff7af16f66671e1d9cce637d2d

SHA512
66413876263dd6947a77e1a3a630371b5bef525452a5078c47231491995bd720e37219eed46324ebd6c1ca2c070cea10b7cbc8d387d4bfa631d2dc22c33efb53

Download Submit
/data/data/com.kakajapan.word/databases/bugly_db_legu-shm
Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.kakajapan.word/databases/bugly_db_legu-wal
Filesize
197KB

MD5
7a96ef1863df31d497fdbd3a0c39a148

SHA1
8a2987059ea787d0cabcb392aba4bb8bbf7246b0

SHA256
e6321a4bae4c3df66e1416accc991a5a93497627b28c3eedcd10ca3256dad65b

SHA512
8d37b6cbb08da617e3503391803a8728957229d11ea46fb671a37437ffd4ef9843df8943e240f09b4d9a2b6b4508f2264515a5b70fbf2ce76b43778f6382739d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads