Analysis
- max time kernel
3s - max time network
130s - platform
android_x86 - resource
android-x86-arm-20240611.1-en - resource tags
androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system - submitted
14/06/2024, 18:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ab23649235b0ff1c38c014c9cf9667ac_JaffaCakes118.apk
Resource
android-x86-arm-20240611.1-en
7 signatures
150 seconds
General
- Target ab23649235b0ff1c38c014c9cf9667ac_JaffaCakes118.apk
- Size 3.6MB
- Sample240614-w339qasamd
- SHA256 e6fa67c12ddc03ad94b9ca6ecdb5fc0aa185a815baea5bd65063ddc881622775
- MD5 ab23649235b0ff1c38c014c9cf9667ac
- SHA1 e08b89f5336ad7cb354d51fd48c580130f2ed4f5
- SHA512 c2411ae27211b72320df05e46e70c4cfb206bb19a5c4f373a6dc189ad76d86bc537661d1911953557ccc9bf89bcd2e191ec9bdebd1ee167c552bae912a7cbf59
- SSDEEP 98304:rRUapU9jfGGWYnQUiq89ycFanArMJvgJ69wng20FBk4y5niLe:reTlW+e9yZA4J20FK4y5niC
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Checks if the Android device is rooted. 1 TTPs 1 IoCs
ioc Process /system/app/Superuser.apk com.yiwyxb.dk433504 - Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.yiwyxb.dk433504 - Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.yiwyxb.dk433504 - Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.yiwyxb.dk433504 - Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
description ioc Process Framework API call android.hardware.SensorManager.registerListener com.yiwyxb.dk433504 - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.yiwyxb.dk433504 - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.yiwyxb.dk433504
Processes
-
com.yiwyxb.dk4335041⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
PID:4295 -
ls /sys/class/thermal2⤵PID:4339
-
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /storage/emulated/0/Android/data/com.yiwyxb.dk433504/files/tbslog/tbslog.txt
- Size 114B
- SHA256 6742c9ba883074f9fc4fddcccec559143b7b161b5238ce5deaecb887e13a5028
- MD5 f20617b4113bc31b4d438e78b01cff0d
- SHA1 8b43e1fda3d545b4715992867dc6fa037e282aa5
- SHA512 589d9a3a642ab900d327b72c577d2e783c84a73c04229216a2094aa771bfee43275ae59746ce39d70fb787b33dbfc30fa66c3bff9cd6baab37ae5bb717417bec
- MD5 SHA1 SHA512