910bb070a20acb859d771e105fb9ccc650f68bb8dda6af7dd582675490586294

Analysis

max time kernel
8s
max time network
159s
platform
android_x86
resource
android-x86-arm-20240611.1-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
submitted
14-06-2024 01:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a7a24b455b3596cf81956168c3ddb713_JaffaCakes118.apk
Size

31.4MB
MD5

a7a24b455b3596cf81956168c3ddb713
SHA1

e8f8d94bab306b3aaca6046c01c863475591f615
SHA256

910bb070a20acb859d771e105fb9ccc650f68bb8dda6af7dd582675490586294
SHA512

f7de7c731129d04a0b84ee4536335f7c5a31288ef88b1cd70e42abdff0b1bd8b22b6ad5373874c74fbbdc9cd0f9720cae8f2e5dc3203927eb61f112ac173f30b
SSDEEP

786432:8SdCzB5tzq4cvikRCZEwf3JT/siw4C6elQNQsX1Vj:mViQZEgYkWleXD

Score

8^/10

evasion impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs
evasion

T1426

Processes:

it.rortos.extremelandings

ioc process

/system/app/Superuser.apk it.rortos.extremelandings
/system/xbin/su it.rortos.extremelandings
Checks the presence of a debugger
evasion
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

T1624.001

Processes:

it.rortos.extremelandings

description ioc process

Framework service call android.app.IActivityManager.registerReceiver it.rortos.extremelandings
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

T1471

Processes:

it.rortos.extremelandings

description ioc process

Framework API call javax.crypto.Cipher.doFinal it.rortos.extremelandings
Checks CPU information 2 TTPs 1 IoCs

T1633.001

T1426

Processes:

it.rortos.extremelandings

description ioc process

File opened for read /proc/cpuinfo it.rortos.extremelandings
Checks memory information 2 TTPs 1 IoCs

T1633.001

T1426

Processes:

it.rortos.extremelandings

description ioc process

File opened for read /proc/meminfo it.rortos.extremelandings

ioc	process
/system/app/Superuser.apk	it.rortos.extremelandings
/system/xbin/su	it.rortos.extremelandings

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	it.rortos.extremelandings

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	it.rortos.extremelandings

description	ioc	process
File opened for read	/proc/cpuinfo	it.rortos.extremelandings

description	ioc	process
File opened for read	/proc/meminfo	it.rortos.extremelandings

it.rortos.extremelandings
1⤵
- Checks if the Android device is rooted.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4323

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/it.rortos.extremelandings/databases/DownloadsDB
Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/it.rortos.extremelandings/databases/DownloadsDB-journal
Filesize
512B

MD5
60181f78a072fa2ff394ceb34f1bbea3

SHA1
3c1943ec9ca199a5ac47a367721f65e19981489f

SHA256
dfae6209ba02cb42e10c8dbe6a005e0ace63e44c11b534b45ab7467befbe7823

SHA512
6983466ecd2cac00a0817181f146e404f1e369411a121ffd4c445ae8c4d66a0f36ac0fb5ea54023198867727c172908cf23fb8a63526df6d01b88805ec718219

Download Submit
/data/data/it.rortos.extremelandings/databases/DownloadsDB-shm
Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/it.rortos.extremelandings/databases/DownloadsDB-wal
Filesize
40KB

MD5
2b64978b505155253124783ffe5749ab

SHA1
28c2bb3e6dd63b7bc6d9b06266bec7e4e7019503

SHA256
3cd0a9edd857251c9ac7987ee757854382582a22ac10f0c735e1fde8649a3329

SHA512
654122c12bf7ebdfc8f32340f3529c8a61a78d9549487bb4bc4b01c5fb45e3a5bf73bb8c13784b7e6693c27c7de927ac7f7ea8b162c6f98e115b9136378684c9

Download Submit
/data/data/it.rortos.extremelandings/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/666BA2BD016D-0001-10E3-22D7ACD93D32BeginSession.cls_temp
Filesize
79B

MD5
f9e804e095d3b6d8708c873aae0f3351

SHA1
939ae1b4395c2c574162eb6a0bb3a72d8e745c65

SHA256
062445647ec800eb4fd80a9e1c9220873a0120e6b78f4d5af789e016b35a9237

SHA512
c7d63463eb2e718702adb8bc762771a00c7c3ad17ef0e9c8a5ed2125de8c9c855a9779f9a8ad1faf651b7f316a1bf2bf2e674889450338afd927a1c909352514

Download Submit
/data/data/it.rortos.extremelandings/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/666BA2BD016D-0001-10E3-22D7ACD93D32SessionApp.cls_temp
Filesize
138B

MD5
c06692dfb7faf5e71b440af63c81f45d

SHA1
17d649a2697389954beba031b47704910b52e3e9

SHA256
ae3ee303b0ca43e02becbed959e1b0b42ece67357e78d737d51fa29ec5c2e158

SHA512
2a68bc7088c4deeccb054430ab5264f7d6f475a847772dff4908ee2d7ca097ec4d3723a189608622fb8d6ff34a36d7490ccb700998efa88cc9a06a23385d49e0

Download Submit
/data/data/it.rortos.extremelandings/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/666BA2BD016D-0001-10E3-22D7ACD93D32SessionDevice.cls_temp
Filesize
131B

MD5
10e6499930be82720ed65c3a1e704bca

SHA1
6180ea40bd324bd8f735e9edd523cbdc1744c14b

SHA256
4f0dc81dff91def8b5d42c8af625b67d1df08842fdf72300a2295a01a17136b4

SHA512
d69510a93a102c48d9a593a9c4547beed507402243f277572f941e68fe4a2b10adac13ad8b68f252023e776888ed8d2af9b661deec655b6c0727e37aaa3bff10

Download Submit
/data/data/it.rortos.extremelandings/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/666BA2BD016D-0001-10E3-22D7ACD93D32SessionOS.cls_temp
Filesize
14B

MD5
9b3d4522944ce6396563812bfdb92fa9

SHA1
6d2a6133c8f01938a48ccc77ef86ad8ca335c020

SHA256
d32805d685a3f50caa7f1c0bd7c8804c4d937a866513289f60e3184f7a591ed9

SHA512
091d87643712530bf9006135db42a5a50742bb5ca3026bcc5f2c1c17bf4fd984a8938d29263b0abde3d15cac196d2230902534e200b0b79485e3a1bd97d95727

Download Submit
/data/data/it.rortos.extremelandings/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap
Filesize
3KB

MD5
2ca3aeac87864afa109e1b5c4263dff0

SHA1
83ddd3a41e36699fe622ab04eed97e6c0378df21

SHA256
0d6d56cd333bbe74cd2b49ebeedbcc810168b788dda7ceeb68eb2159df1d4099

SHA512
508f8faa1e0486edab5b53aa2c6513de96de6135d05338110b2bb85810b45c409d1d9edf7e77a159a5684d3e33be77c73196e96940e40bfb0e5c9703f74242b9

Download Submit
/data/data/it.rortos.extremelandings/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap
Filesize
526B

MD5
b77dbb5051e5b9d2c712184f298b896a

SHA1
ac3affbbc6c4e757e751443a06c04a8b992ac66e

SHA256
f277b48eff95e6d02f0e94f2cb000a50d224a978c8faaf4aeac0e7b1d698a946

SHA512
2d0bc843ffec83d1b61eca560444f031d4e84db29703647eb5adaf418a9e8105f990275d71f1daa04fd445d6677ec73cb3a740bbd359a05e5bb8512f3fa7e0e0

Download Submit
/data/data/it.rortos.extremelandings/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap.tmp
Filesize
16B

MD5
c33583fae4e0b61cde1c5b9227963237

SHA1
fe2ebe4d27469af1460f7e852031a04208ef629b

SHA256
35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc

SHA512
fa09047004bec791b23f0dade0b64f8ab9bbd67555505e0d0818f6e89dfe56f474df80db0786d081d36adf23a5bacea40275ba043444a3a85d3d9612575bdd1e

Download Submit
/data/data/it.rortos.extremelandings/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_5755b218-51f5-4bda-9b2a-4fb0ccbd0a0d_1718330045950.tap
Filesize
400B

MD5
46eee39cdff3f68ac9f7b3a5fa87e31d

SHA1
c893592ad0201da01461b484e629732cdab06284

SHA256
71a566770f68423c6860c30c2e4d7018177e615691070eab9ca8adc4e56405a5

SHA512
58c54a29843d4cb4df767fde0eadf03a1e428c64d3e033be5e2480ec478baddddd175e7a8468a2392449628b2502b1432a8c36205215e6870aa2713d17d78d26

Download Submit
/storage/emulated/0/Android/data/it.rortos.extremelandings/files/Unity/533f7175-deb3-45cc-ad62-af7cef3f3a7a/Analytics/config
Filesize
293B

MD5
8673a8ac0b06a9d056d08d62f857ba4b

SHA1
a351bea1932270bafbe468584058fef20dcfc31e

SHA256
83b3f90c4edf1f122c8faf9784ca0aee4dd017c65493ac181c1814211703db96

SHA512
edf28eb7fcef654f139285d308f817ee230d6f064a4c865109d6dfe6f73c11f8f35737c8159c8a302118237ab980899ba5773f547cc9da4028643a53b08e324f

Download Submit
/storage/emulated/0/Android/data/it.rortos.extremelandings/files/Unity/533f7175-deb3-45cc-ad62-af7cef3f3a7a/Analytics/values
Filesize
132B

MD5
f4fc584463db18d2f51a352d427604f8

SHA1
5b89ac635522ac62012e8a55853904399988da7e

SHA256
db0aad0aee5372043afaa8b758fd7cc28dd2e755bae748e238277f410861f6ad

SHA512
02aaafc391d5cdaae7cc988794d9611007f3eed1bec268a8376fd91eec2b06681bc5e98cd028c48653e0fb7a36a495e80fb8ddeac7137005b92261fa139edb50

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads