2463b6d9b961fa7ea4af411bc85ee9381fc92d71018bc40c450c83d535d02d07

Analysis

max time kernel
174s
max time network
179s
platform
android_x86
resource
android-x86-arm-20240611.1-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
submitted
13-06-2024 07:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a47741d64dec571d8cc58d741ad3276b_JaffaCakes118.apk
Size

30.5MB
MD5

a47741d64dec571d8cc58d741ad3276b
SHA1

80ceec6a3199cac1bcb9d664d75b5a0b28dbcdde
SHA256

2463b6d9b961fa7ea4af411bc85ee9381fc92d71018bc40c450c83d535d02d07
SHA512

5b8ad8960f8a5100b765ac32c6cc26c2166c9ddcf005541c05b183da244d9b357811b6c7a9edb371a34d45c164db07e7172eb7306a663facda0c945eaf80a563
SSDEEP

786432:RnRvb/s3H7z8vA9Krg3+4Zk6a/e1Eg+Uaad1sxhj:JRvb/s3EYHHBa/eKHU/sxB

Score

7^/10

banker discovery evasion execution impact persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

T1418.001

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

T1424

Processes:

com.crazycoinfarm.micom.crazycoinfarm.mi:mobguardservice

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.crazycoinfarm.mi
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.crazycoinfarm.mi:mobguardservice

Queries information about active data network 1 TTPs 2 IoCs

discovery

T1421

Processes:

com.crazycoinfarm.micom.crazycoinfarm.mi:mobguardservice

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.crazycoinfarm.mi
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.crazycoinfarm.mi:mobguardservice

Reads information about phone network operator. 1 TTPs
discovery

T1422
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
evasion

T1628.002

Processes:

com.crazycoinfarm.mi

description ioc process

Framework API call android.hardware.SensorManager.registerListener com.crazycoinfarm.mi

description	ioc	process
Framework API call	android.hardware.SensorManager.registerListener	com.crazycoinfarm.mi

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs

persistence

T1624.001

Processes:

com.crazycoinfarm.micom.crazycoinfarm.mi:mobguardservice

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.crazycoinfarm.mi
Framework service call	android.app.IActivityManager.registerReceiver	com.crazycoinfarm.mi:mobguardservice

Schedules tasks to execute at a specified time 1 TTPs 2 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

T1603

Processes:

com.crazycoinfarm.micom.crazycoinfarm.mi:mobguardservice

description	ioc	process
Framework service call	android.app.job.IJobScheduler.schedule	com.crazycoinfarm.mi
Framework service call	android.app.job.IJobScheduler.schedule	com.crazycoinfarm.mi:mobguardservice

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

T1471

Processes:

com.crazycoinfarm.micom.crazycoinfarm.mi:mobguardservice

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.crazycoinfarm.mi
Framework API call	javax.crypto.Cipher.doFinal	com.crazycoinfarm.mi:mobguardservice

Checks CPU information 2 TTPs 1 IoCs

T1633.001

T1426

Processes:

com.crazycoinfarm.mi

description ioc process

File opened for read /proc/cpuinfo com.crazycoinfarm.mi

description	ioc	process
File opened for read	/proc/cpuinfo	com.crazycoinfarm.mi

com.crazycoinfarm.mi
1⤵
- Queries information about running processes on the device
- Queries information about active data network
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
PID:4288

cat /sys/class/net/wlan0/address
2⤵
PID:4343

com.crazycoinfarm.mi:mobguardservice
1⤵
- Queries information about running processes on the device
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4602

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.crazycoinfarm.mi/app_crashrecord/1004
Filesize
229B

MD5
83d9ee118b94996f69643ab8a17325bf

SHA1
dfdb80297d0745c862389b7c96950fc0dfee50a9

SHA256
9cccfc4aead5b050f3fe3a6bcb4d63c69079dbe330e4f4b46b7a0142e0cd0923

SHA512
a2abf77ef3e193642e570344adda0f570c52fade6d4ca5fc0871b82e492699bc54f86e6feaf8a1a1e3a892d42c1d61aa878b3f6af4e099fecc95850def92dd6c

Download Submit
/data/data/com.crazycoinfarm.mi/app_crashrecord/1004
Filesize
201KB

MD5
2ab8c9c6dc712f823a0d8ae57713f9a0

SHA1
5813f98b78bedf08fd16ec3c904c780ab8adbb80

SHA256
1c8627de47c24fd92178c68b2330e2a31a06f08918c78b0efae5c1b3ec886903

SHA512
24c69a6e928183e8ac3a108a9cd9756971c1dccd70aac7e4bea77906c1b4039ad4ea1e6527a4b4efe8594651c86c68123a8de828b32d5875dd4d594b7e7d03f9

Download Submit
/data/data/com.crazycoinfarm.mi/databases/bugly_db_
Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.crazycoinfarm.mi/databases/bugly_db_-journal
Filesize
512B

MD5
c2fd276a2b30a0c04a7956bc697c379e

SHA1
fa7a9f6683ec977980a9f9a71c394b1362a98d81

SHA256
980084dee6e8ccd4de14bfa346a2a8c9b7217e681efe50d529a166ce2be015fa

SHA512
434dd9a0c1339d317fb4757eea724d0274ba9a733d2e27b5cbda8e83241ed82a1790378c4a8dfc73a71b14c4c4587837feca8becdfcb5adab4d4a77b7ed990b5

Download Submit
/data/data/com.crazycoinfarm.mi/databases/bugly_db_-shm
Filesize
28KB

MD5
1c53ee5baac18994368486acbff070c0

SHA1
ca1cb0752cde4fc0644c16096aab301294478b8e

SHA256
97ce34d89b1b86cb1841571f2d024d79af1cdd1d966e22ac85dd2ac98d96b545

SHA512
0c33e286b6e1bd85087d239ed90e536045d8624d8574a48b55706930657075207592f419e7af09a60ce0c1ce65cee8d01b22adcbe6b653e783f1ad0f256dea58

Download Submit
/data/data/com.crazycoinfarm.mi/databases/bugly_db_-wal
Filesize
72KB

MD5
0b89f0f1b339ef7dee93a3ebd0034aa3

SHA1
63e2a6e37f6f3a60e86238d0c3edcefcb979f07b

SHA256
e0711416f3df96bfd81cfd66bf0a40837a48fa8a9de9ecbc4fa306647d560f93

SHA512
b9acb7c83cb60e4feba1d0a30dacf81313200e4ac3aa5746be73615b9d00b9cb1c929416b3c3f0d8b945f7c62f20e9da8b1b2ff73ce053d64931806f19fed02e

Download Submit
/data/data/com.crazycoinfarm.mi/files/Mob/PUSH_SDK_RECEIVED_MSG_1
Filesize
100B

MD5
7bb10e48bbca68c0dd378228217fbcfe

SHA1
573d263a07216645aad0c2b0b0d595f77f324149

SHA256
a6dc3063a1aef5e18b052cf6fd7a797494a1810575b705fde8518da99b68daf5

SHA512
b0c7b03b5dcd40d2ff4bf83cccc52ea6c2f09f0f8ab75a1faceed2c54f13ae31748769bd06b4c983087e7bbbd03aaecded33459c112156602056de55e7b2b081

Download Submit
/data/data/com.crazycoinfarm.mi/files/Mob/mob_commons_1
Filesize
39B

MD5
f7d2e87e0ffb9b85e3797d360ba9f3cb

SHA1
35a64b91673f86c69f48c981b2a37de8d39bff56

SHA256
a214c7e49c56096fe9dd4fedd2c649bc3836c6a70d57d895097476a3a610c1cd

SHA512
c63484dd15e97367260717a802cf0a4151a3cee67fc0fe27d8e1a88d6851aa5e7d296d8101b0ae1ad0af9560a40fa0ebaa495c8af160a7609f1e5bf8c57680f4

Download Submit
/storage/emulated/0/Android/data/.mn_410185822
Filesize
194B

MD5
45d39a2a270d76f791fea479e0a25c8e

SHA1
d58885adb93af62f692fb331763453e29301efe9

SHA256
bbaa026e9b96f0fd509a64f730a565f929afe8daf2063f5160c7ee3312034cad

SHA512
55ccb772ea4a24256e24c599098d3592bddf74d5568413a43862dd047dcb9a3176ca01465e373d651e57575623eec5abdf29d065d7f42f90acdce8f60cc72d28

Download Submit
/storage/emulated/0/Android/data/.mn_410185822
Filesize
146B

MD5
4451a1c9e417425072a84432c8c81b33

SHA1
7c36e856a8950e5ddb012550063e4a1f6061349c

SHA256
5dbb908a35490753c0dfb235732eb17ec3e3802971d4f2007ebf641d0d4feb64

SHA512
e408a57c56b9181f86900c3500190eeea43b30fc5ef1fe810e38da7cccfa5accedd1702ac74fc0e7e528181638aa4f5b221ab61cd1275a95e74461932ab402cf

Download Submit
/storage/emulated/0/Mob/.mcw
Filesize
82B

MD5
761a11a8adb3bd33f7d6f6f7f6911fb5

SHA1
5e7bcdc71c62c856bf059c4b0950b7aa4c4d55ec

SHA256
2de6c7c17116a9928fe92c3b6f32232acce574c0e5f4f00a0879af3da975a7d9

SHA512
3917cd6459dd537a945f76c1e927b94c68c4860bf79974389d35be7df272b86fa5795da5adad69c8c07d5a6557b6e50a795035bbe31e9ff8c094b148039fb084

Download Submit
/storage/emulated/0/Mob/comm/.di
Filesize
57B

MD5
70a42cba408700f9a6c01c7941a8829e

SHA1
eab01cc2c0671538795fb0b1146017dc099d0984

SHA256
499576707ce2623293166979e59c832be5b8636c64ad39aa63ebcf961910c35f

SHA512
8900d4dc8eed0430babbacb72942401bd22ef7fe5430cad90d3ce0c2c53010220d666aa0e2eb1026f3ec81d574c7fa12585b49222a5f15b01637f6ba134fe70c

Download Submit