7e746c3c5142e98586814745f1f2eec25e263363654b9a063fd1892911758a54

Analysis

max time kernel
179s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240611.1-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
submitted
14/06/2024, 02:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a7be8f8877e66f5749aeb3f8638dbc65_JaffaCakes118.apk
Size 16.6MB
Sample240614-c7anessdne
SHA256 7e746c3c5142e98586814745f1f2eec25e263363654b9a063fd1892911758a54
MD5 a7be8f8877e66f5749aeb3f8638dbc65
SHA1 baca354e6a27c766300895a7f45a979fd3bf8dea
SHA512 f1c23e4011cb28146e21120c4469e8c838472b7847b2e52b72afb8a848cccaf68da1d1f0a893eed830205b5106ea821427c2364aa52b82c7090ca896dcae4c67
SSDEEP 393216:NJ61qycsdedJUBwofHl4mDTLaPzR6PsKs6HGb13LP0fgp5Lj0433GDLk:NwL84/fmmD/jPsKs6chPUQo83CY
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

discovery evasion execution persistence

Malware Config

Signatures

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	com.keerby.formatfactory

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.keerby.formatfactory

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.keerby.formatfactory

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.keerby.formatfactory

com.keerby.formatfactory
1⤵
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Schedules tasks to execute at a specified time
- Checks memory information
PID:4651

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Foreground Persistence

T1541

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

moment-db-2.0.1.455

Path /data/user/0/com.keerby.formatfactory/databases/moment-db-2.0.1.455
Size 1.0MB
SHA256 51fb7f742423271209d4e7ec7b8e340ae9ba51f0d0e735c1c1e56ba39bfed4be
MD5 e1a1de3def00cc187f7d7539541f07c9
SHA1 18447c2d1b3834d5f3021482024c63c60d4a3dce
SHA512 d5cf22a28bebde6ec37055a8e01a03ea2757984a3641fdac553de14b1c79795ddea68f5621edb73feaa0edebbd3fcc4ee91516e9ba625ba55390d776f3fe9189
SSDEEP 24576:yvSGBWX/UY1FCXtbiiCMdNL7Dn7ODNNdfq76ItlLNp78sL+ZCUr4VxcMp30UT/aI:yvQSWiCEEhuL+0JFp
MD5 SHA1 SHA512 SSDEEP

Submit Download

moment-db-2.0.1.455-journal

Path /data/user/0/com.keerby.formatfactory/databases/moment-db-2.0.1.455-journal
Size 512B
SHA256 da3a5b0a2ed922b12fd75479991f7d2ad23909728871313b0c37566abca9c016
MD5 94a281194893c5f60e34f27c02350b75
SHA1 6f1c15b149835e9fcb47b0197a4ece46e2ada402
SHA512 0e526168c81fd0ab977d248b07083fc74e88b23317221f8618388e13c1f46c6f580c644dda07dfd8fd5039b1cc021e4e5be91f175274e555a7b9e5cd0305987c
MD5 SHA1 SHA512

Submit Download

moment-db-2.0.1.455-journal

Path /data/user/0/com.keerby.formatfactory/databases/moment-db-2.0.1.455-journal
Size 8KB
SHA256 dadddd25771a0ebfaf3adb8c70c73e7e6fcf884efdee744407c65958f18deae2
MD5 55ce6a45e9d7d402fe0eb97ca28b1adb
SHA1 175254c3ae4474736c69a40afa19f4f0ed2e3683
SHA512 98ebec173d21a30ed7150d585b0120672ff7a9c5b1e71a923b142e1e2c77ef8ba7698499b82e46115cce3990fd4d62fc6a8cb3cf2c847faa2918d0097e3f49c7
SSDEEP 6:7+/l9Wn1Rvg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKy/:7+toqLiuWdYRmBEyPbR/
MD5 SHA1 SHA512 SSDEEP

Submit Download

moment-db-2.0.1.455-journal

Path /data/user/0/com.keerby.formatfactory/databases/moment-db-2.0.1.455-journal
Size 8KB
SHA256 635b5ec20c95f7c95b1193cdb205a2c1d4dade39aa609c297d0b16b6b02355be
MD5 468bbe47dbfff1a5e5a2f70de343ab6f
SHA1 d5bfe2a992fadf731bce438e351eb8fe7c1b294c
SHA512 3d4e868a7b44adad503eb5c4b16c21de1770274ab80886bbebcd70212b644d57e08bd6d1acb4fbfd0a3ae85143df6e970308eee8f4434fc9eb99a3e7ae2eefd9
SSDEEP 6:7+/l93HGPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKsds//H:7+tVH6qLJdeWRmBEyPbLsXH
MD5 SHA1 SHA512 SSDEEP

Submit Download

moment-db-2.0.1.455-journal

Path /data/user/0/com.keerby.formatfactory/databases/moment-db-2.0.1.455-journal
Size 8KB
SHA256 3b3d744055e48272e325e140bd11e977b6972f31d3ee8deec6d2daa380095090
MD5 ed1ba5d4d89c49203c9dcd17d9da509c
SHA1 09835584dfa498bf16089a796ae95bbf90fc9c19
SHA512 57a5b9f27dbdd7c2cd0a5bc50de15e20d590835959382a3312ace5217a9cc72667e895e8b671ef27ee00f5c01071a98bb9d2897a9a9addf4e7df62101e07002f
SSDEEP 96:7uwRdon/O+qxhnh6nt1GUpW1eDY7zNYHDz5g:7uw3hAt1tpagW
MD5 SHA1 SHA512 SSDEEP

Submit Download

moment-db-2.0.1.455-journal

Path /data/user/0/com.keerby.formatfactory/databases/moment-db-2.0.1.455-journal
Size 12KB
SHA256 01d884105868b8d23e5058f20bf54f4b45eeab3adb9ed97c9bae2040727b1937
MD5 9cccd3b697a4bbeb30573242a6c48226
SHA1 56f51c8ed790c7b422cc55a6d28cb937d50e8320
SHA512 b3d04e48b9d7cab700af894da6b25cd073532c77d5b2fe4a1bf0d494bbfc9dbc93ad1a8d09f64ff265f1f26a5a92e173d1227b3216a1ef828a927d73d038b624
SSDEEP 96:7RjxWdon/O+qxhnh6nt1GUpW1eDY7zNYHDz5B:7RjxIhAt1tpagX
MD5 SHA1 SHA512 SSDEEP

Submit Download

moment-db-2.0.1.455-journal

Path /data/user/0/com.keerby.formatfactory/databases/moment-db-2.0.1.455-journal
Size 8KB
SHA256 f4411029d47e741330f9080ce1660698a121f7e9bd01b80a3d4df3fa8a8f7faa
MD5 b8c40383f536159589b7d4a7031e2ad8
SHA1 12cbfcdbefd165c077550f7dcf87e515534b26fa
SHA512 86dbfb971c96f9a9997ab71edd0ab89dbc00d59a6692d93f768d71b26f57c55de175d67830302d63806012118800697cdb062097a1106d60e0b72717df5839c7
SSDEEP 96:7HJndon/O+qxhnh6nt1GUpW1eDY7zNYHDz5c:7HJ9hAt1tpage
MD5 SHA1 SHA512 SSDEEP

Submit Download

video-758662-30_o_1717503724.mp4.tmp

Path /data/user/0/com.keerby.formatfactory/files/data/appnext/videos/video-758662-30_o_1717503724.mp4.tmp
Size 6.0MB
SHA256 827499e4da18aece3557253042c48aca45b2c3b68639913dc631cff8880ad9a5
MD5 bfc51454f1b17631056ec1e647fbe628
SHA1 29906854e3f341535ade258fcedb7f5155506543
SHA512 5df7387c3bb29057718833f79f919ef2ef3cf80bc8a594220a256da19f36dd105e7ae1cc7e13ebab7fd3ad93098c462ba9ef38f3a295eb5625281b5d311cebab
SSDEEP 196608:O12Tz7a+jHPrFMkndxalA1zrUJUCQ5d5wi6W:CUtnaGwUCm/wiV
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_config.dat

Path /data/user/0/com.keerby.formatfactory/files/data_config.dat
Size 7KB
SHA256 d8a6bf69026f98c2402d2c0f54b26681ae50111db6be2f88b90727dbb0af6f2b
MD5 c9007118db70f1ce1459c90b682e1ba4
SHA1 bd6d6f063704a0e17849d1ae671599560de97618
SHA512 387eeb1c36c9c0a9b4d0d5cfaf8cc62d13798dd08bcbc876801bac53c667aa0a17e6ef8be9754f23bf9494b3d42bc0e4b63ed189d89e14ff708e4c31456ed156
SSDEEP 192:ORxOmrkpRIGMYvtbGdea5UBSdWVMwtm/9Nr37FL8BdDPGYUnCjnm4:L
MD5 SHA1 SHA512 SSDEEP

Submit Download

ffmpeg

Path /data/user/0/com.keerby.formatfactory/files/ffmpeg
Size 19.3MB
SHA256 657dc77c18734a86ede823194fd280a94f045003d272233a41afc36ac7e64622
MD5 4f38697eff723edef4f37d29030ac59b
SHA1 3d84fd531451d45654957c453e35aaf53d0c0e2e
SHA512 cbae661f497213d08de8bb295fed9a6e0387595a3f055abbb956386a09145f4670b830289e67e1ed12182bc988190db63429848cc8c6201f8d02796f7da07878
SSDEEP 196608:G9QdGc0G/rjlCczaEBGxiprMGzVQV2bd0eAYCpPpI+CBGm:Gg3lB2cXqV22eAYCpyr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads