Analysis
- max time kernel
125s - max time network
186s - platform
android_x64 - resource
android-x64-20240611.1-en - resource tags
androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system - submitted
14/06/2024, 05:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a8362a776bb9db93224d6712b9f81ecf_JaffaCakes118.apk
Resource
android-x86-arm-20240611.1-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
a8362a776bb9db93224d6712b9f81ecf_JaffaCakes118.apk
Resource
android-x64-20240611.1-en
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
UPPayPluginEx.apk
Resource
android-x86-arm-20240611.1-en
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
UPPayPluginEx.apk
Resource
android-x64-20240611.1-en
0 signatures
150 seconds
General
- Target a8362a776bb9db93224d6712b9f81ecf_JaffaCakes118.apk
- Size 30.8MB
- Sample240614-gh63jsxcne
- SHA256 49cd21b7daf72b56fe64bf6cefe71a132c5fb004b9af25c30f0c107256e445b3
- MD5 a8362a776bb9db93224d6712b9f81ecf
- SHA1 fbdba65ade66f3e433025db703cd373391f5ec9a
- SHA512 7e6b0f71415487d735c1cf0ab103eec6758b7fcfccd04cc29d20ef10b6d2e1a394e822a7fd200c4976386ae2b3b510e1655018d4ad98a969b8c11b4ccad217b7
- SSDEEP 786432:4Dt9YwgPxEfXu6KJQXpf4X4p7H94Mr0rL0xCzBOtGN7WfEFPS2t3:4D7V26qQ5OCHaw5yEGxd1
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Checks if the Android device is rooted. 1 TTPs 1 IoCs
ioc Process /system/app/Superuser.apk com.ifreetalk.ftalk - Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.ifreetalk.ftalk - Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.ifreetalk.ftalk - Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.ifreetalk.ftalk - Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.ifreetalk.ftalk - Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.ifreetalk.ftalk - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.ifreetalk.ftalk
Processes
-
com.ifreetalk.ftalk1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:5091
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.ifreetalk.ftalk/app_crashrecord/1002
- Size 232B
- SHA256 bdfa9713eba8b33db2daf7979626507a331ca410c0221a1924ec6dad4975da34
- MD5 08f86bb3fcc07cd1264b577f71df803f
- SHA1 b6ca1e5f9cabaa82c80927efa311735b49c06fec
- SHA512 cc8117f81fdfecb20afc15d16b5901cd2e9d5fa4015b7ff43ad281c612ae53791c3869a94ffdb63d54b8f1dcab343af7ae6cc7ef19e2aac10e1829cad35a8e40
- MD5 SHA1 SHA512
- Path /data/data/com.ifreetalk.ftalk/app_crashrecord/1004
- Size 232B
- SHA256 b54c90a0451f0107504207ad9819ab1a85ecf2f5bc868977f85eb4cfd1063b9b
- MD5 2401531e6015b9df2640580643887ff0
- SHA1 6b15ffb3b9832dc86de3c60e052d02803d7aa888
- SHA512 62c84f260c242744560decda17d4d97d9f4c85b397a87a9bbb8411e70e01615560f3ec912bc06286d2e7ebaab67c7f066464ebbffa11ae9394fa962862986923
- MD5 SHA1 SHA512
- Path /data/data/com.ifreetalk.ftalk/app_crashrecord/1004
- Size 58B
- SHA256 988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
- MD5 0d210bfb2a0e1f1b4c082a6a0f79de07
- SHA1 bb8ed9e364db79d1d9f2fcde3f15091893222faa
- SHA512 536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1
- MD5 SHA1 SHA512
- Path /data/data/com.ifreetalk.ftalk/databases/bugly_db_
- Size 52KB
- SHA256 507ad392b2e896307194b0c30764c4282fa529a0c6201f8df35a4e299dda67bf
- MD5 e87b9917fb3739becd805e02437d279d
- SHA1 91eee39a460371a16fa164efa6f812263c967e88
- SHA512 ea0da5ec5456b474dcd1a3fd63abf9829f23f3a22daae0cfae20b840f83237a3a18dceaac35b082fe71c24c2272f7f85ce8ae6521db65ee99427929662c6ebfe
- SSDEEP 48:Tk85WuAriStwwuMN5meposScco/CiWKXa:r53Azwccm3WK
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.ifreetalk.ftalk/databases/bugly_db_-journal
- Size 8KB
- SHA256 f1695943afd2c382d7424328bca82f6ccf49872b971e068c5a8076e8994b7dd9
- MD5 16a2184aa10b4cb6b71587471668d6f7
- SHA1 ad44ec8df1affe81128a8ef7c29b6d3d14273783
- SHA512 73c19aa2c7ae407579f8ff85d373ceca02fc9606c0a208085c62689b750c6699d0fcb8adf400cab534115524a56541b296e80b2022d2bd1607ab634d188a9e83
- SSDEEP 24:7+t0qLKXQEJBq5JQfs6y2nriS3dVi6fXX+McEnKwm/mpLwBpGSF:7M0qOJ85WuAriStwwuMN5meposSF
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.ifreetalk.ftalk/databases/bugly_db_-journal
- Size 512B
- SHA256 340f0a3b33465e943f8ecec92ebc226f1eb732b5ed09230126466739e4ffeb94
- MD5 a48f35361024299ae5140f23d6c79cec
- SHA1 b6c4b26218b400c46d462c4dd633c856953f34a3
- SHA512 21cbfd4752ed6f2bb0b1403ccda28345e1609243db71e4dcf57cab5111dcaa89f5c5ed62eade0d48efbb2972c59af931ae78e9ea1430b91ebf17bff31379d022
- MD5 SHA1 SHA512
- Path /data/data/com.ifreetalk.ftalk/databases/bugly_db_-journal
- Size 8KB
- SHA256 d1daf9a91360bd1a17f920711d37c32ce333d66af1dfdd5a461351b6d5b03b0e
- MD5 2dc837dd1fe75687effbb40c70a5aee4
- SHA1 6c2560df5c22af7c1adbdddf20d6c14df74d7ede
- SHA512 b96a863d2cce4bfc7b237f42b0efc421e7cbca25e042e268c8321628e66580a9efd57ca05f8271f508850547df11e37453cd516a1c9f1702feae78860ae7f397
- SSDEEP 6:7+/l9Btgn1Jl/ng9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKw9n:7+tXtKl/nqLiuWdwRmBEyPbfn
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.ifreetalk.ftalk/databases/bugly_db_-journal
- Size 8KB
- SHA256 54d01f5dc22377bfe0f103803e1eccf507ac307afdd481efc0c48f4d29a2a825
- MD5 3298071351963ff67fd544d701721a9d
- SHA1 60a71a2dcfcb9d2681b2d46f1be2c01f85402876
- SHA512 7ef21eb2fe2e6fddd49c3dd3045e49c836a50f91af95ad560de58248b27994e46d91ba1a051128699012d165165a749974b33f5e82ac30291d5058035d8e9757
- SSDEEP 6:7+/l9GW4Pg9bNFlLdrlOERX4PBX4ogLugMBX4suuKkbZM//:7+tMNqLJdTRmBEyPbbs/
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.ifreetalk.ftalk/databases/bugly_db_-journal
- Size 8KB
- SHA256 a10af2da44979736a71b27e4292879ab8a0ad102feacf2bb9444e7e03a7bbc14
- MD5 1fb474d2a9c59ba9c4f9db1870c5cef5
- SHA1 ee8d823648d1556eb7c094a6c514481ecc7acbb8
- SHA512 485db7402b47164a6c048a495015273103c8b44d72f55f39ce671b3ca3c768a44f56766acb66c2f2f0118fef6d6152a6873fe2db269199e6b49dda16f94cae92
- SSDEEP 24:7+tjqLLQLBq5JQfs6y2nriS3dVi6fXX+McEnKwm/mpLwBpGSu:7MjqE85WuAriStwwuMN5meposSu
- MD5 SHA1 SHA512 SSDEEP
- Path /storage/emulated/0/Android/data/com.ifreetalk.ftalk/files/tbslog/tbslog.txt
- Size 4KB
- SHA256 52cafccb7704ecd7dfc5d34430f86a75cd26473121fe97eeebdf135c006f0194
- MD5 b51414d3d876df52e419b51b19317cbf
- SHA1 386a35b4075a8440c5f65b11c53db6441bcd1f88
- SHA512 a216f823d56ac5c5067a1f16ed7b240134c924de10d506e140efb52f546589242b59c1305ca8ce52dd0a03482cc2a7b9e39d1ff13f406aeacd16aacdb6ae1b3c
- SSDEEP 48:oJk8kI9BvjbdLNN20Zjv6Q8jvfPVIpI71hl8LbVtUbEGbeiL/bjv9WV:KhNP0HLLpeAfs
- MD5 SHA1 SHA512 SSDEEP