b517ca8608438fe55add7e8decd3bcfde30ca59ebbc64a80e9faf6ee27824c9d

General

Target
aadbd5a9fd195b43da3598411a5fb7ec_JaffaCakes118.apk
Size 31.7MB
Sample240614-vr3ndazbjf
SHA256 b517ca8608438fe55add7e8decd3bcfde30ca59ebbc64a80e9faf6ee27824c9d
MD5 aadbd5a9fd195b43da3598411a5fb7ec
SHA1 b468f04135d8936033dba12a5f5c6864f51531ba
SHA512 fb6f261647f722ea4eaaef7eea54813a82ef9d456725168370774a6812bcff17d496265018f03f8ba02e61e3e148cd55d6db2c734ec0cf3c63f74735add68147
SSDEEP 786432:/5V81gJdOSiUGjcC11dAGi8oKzSdKLVNFtgP/0qDkU:Ie7iUGj7KjrKSKLV3aiU
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.FunLab.GameMaker

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.FunLab.GameMaker

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.FunLab.GameMaker

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Checks the presence of a debugger
evasion

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.FunLab.GameMaker

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.FunLab.GameMaker

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.FunLab.GameMaker

com.FunLab.GameMaker
1⤵
- Checks if the Android device is rooted.
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:5040

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1633

System Checks

1

T1633.001

Credential Access

Discovery

System Information Discovery

2

T1426

System Network Configuration Discovery

1

T1422

System Network Connections Discovery

2

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

bugly_db_legu

Path /data/data/com.FunLab.GameMaker/databases/bugly_db_legu
Size 116KB
SHA256 139ea73dd098cbaf2858debdc8c3c8592a780e26fe7c5c20ad3fdb573e79bcc0
MD5 75b613fc42cf308825e5fb5c4921adb1
SHA1 187c2322ceb70f6be0fd0ea2fb9963729b7746dd
SHA512 f5ffb292319c0476012c47a9c336b1765ed859ad465ae0e267902d056c29075fc67a836f6764e9722ecdf6d0c3688dd5ba5e48d21d4a8159334c610a3fa664d9
SSDEEP 768:RXXPons46jwTI+8RjwqpgdytRHBjw38gtkMonKjwVE/tAMjw7CpnWjwRFvnNSlqQ:
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/data/com.FunLab.GameMaker/databases/bugly_db_legu-journal
Size 12KB
SHA256 f06684262fad5393871bb3fcf906b4c565f9d010291cb74c27d318f28adc1ad1
MD5 657da1647d141058ea7a566e530594ba
SHA1 550a9ac49725de16853a88fd68f6b3ce545db227
SHA512 acd30912008d289113c5761c7e5847b56b1458adbe0704e414cca54d5e0dac8bd3883e371ffd78f687c0baffb56fbbd036589d872e6b54c57991548a475a0b0f
SSDEEP 24:7+tEqLmt+qqn26VnrQiVicXX+MgeRKkYBg72m/mpLwBpGSxpJ:7MEqzfrQiw6uMg6/YBg72meposSJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/data/com.FunLab.GameMaker/databases/bugly_db_legu-journal
Size 512B
SHA256 d9b3cb1b664d1cbae2813a3137d1441f3f8c6b73c1878a8dd32db15989703b05
MD5 537a6892e78dd0d85fef769f529d987e
SHA1 3e93d6fa8f8394b83a0d728a1b0e0fdecf2d6dbe
SHA512 a0189da348ee3556af966fa9ce043341c668b7ca41f1e623624a47f2c073deec0a7524dfc13c120f0a0b7f0a874901025919d1eb5177dd9e21847a05111112fb
MD5 SHA1 SHA512

Submit Download

bugly_db_legu-journal

Path /data/data/com.FunLab.GameMaker/databases/bugly_db_legu-journal
Size 8KB
SHA256 39c4111d888fd5fc7872bc63cd81bae981b86adcaea5c6b1765354851d622943
MD5 582a331dc651c3e4f4b3015084609aec
SHA1 d2e237abf6911373514b21519d1aa228503dc6ab
SHA512 d12d6109ddac8ce3ef3082c82b08134c84979018717d34b88bbb0165571984497da8de029d426d53f3e23cfb8fca4139b86ae45e15a1ae03fd7a1087061c2ee6
SSDEEP 6:7+/l9E0Fn1cpg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKp:7+tboqLiuWdwRmBEyPby
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/data/com.FunLab.GameMaker/databases/bugly_db_legu-journal
Size 8KB
SHA256 b148e381a25519a768f090fc902213b14699dc5cc9e5ec3ac79a219c70d229d2
MD5 a3076f9b85cdbbbb38c1ab7383d8d107
SHA1 55164a698e8d129e05f2de854da51b81027ee0dc
SHA512 b70cafdcd8c9be4aeaac8e81689225c51918374aa18a9cc8a702cbd69f0c457fa48c330914e55d19d3a3358819c77bb6322ada7a56688365855823cc415e83fc
SSDEEP 6:7+/l9hOPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKyM/J:7+triqLJdTRmBEyPb2J
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/data/com.FunLab.GameMaker/databases/bugly_db_legu-journal
Size 8KB
SHA256 adbb38064750c0b332cd0286634aa37e92b6feab14ac45207b348e8974cdf6d9
MD5 bd4d277b97fbe2b796cf3dc0e950e895
SHA1 8f003f55f1ed5e2fe7a40cc1c09f93019c9accb8
SHA512 169caa97506263d79ef83caabebbe2b50505b22ebecabc0e01c815966f99425eff7c91046b90d535ac6bc0fdff0e4550691c8878d43bbb8b3ceb18b274da5339
SSDEEP 24:7+t6WqLTt/qqn26VnrQiVicXX+MgeRKkYBg72m/mpLwBpGSTn:7M6WqDfrQiw6uMg6/YBg72meposSTn
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/data/com.FunLab.GameMaker/databases/bugly_db_legu-journal
Size 12KB
SHA256 b6968b2dcaced7485ee8d8d93d27934967c05f31e2dfc478a2d09e9f9211fd06
MD5 587ec383dc0e18fdc9fc444834653561
SHA1 8f482172852d7a7e24daca659fe046d67e8ba6c0
SHA512 03901756f06d4c02a3ba45efd3f9080df2754fa796644be18ddb0e656282949f11b3383113e65538e63eca521106f886a945ac28e708ee3ad682a26f7179293a
SSDEEP 24:7+tpqLMvtslqqn26VnrQiVicXX+MgeRKkYBg72m/mpLwBpGSE:7Mpq3DfrQiw6uMg6/YBg72meposSE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads