Analysis

  • max time kernel
    3s
  • max time network
    130s
  • platform
    android_x86
  • resource
    android-x86-arm-20240611.1-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
  • submitted
    14/06/2024, 18:27

General

  • Target
    ab23649235b0ff1c38c014c9cf9667ac_JaffaCakes118.apk
  • Size 3.6MB
  • Sample240614-w339qasamd
  • SHA256 e6fa67c12ddc03ad94b9ca6ecdb5fc0aa185a815baea5bd65063ddc881622775
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 1 IoCs
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs

Processes

  • com.yiwyxb.dk433504
    1⤵
    • Checks if the Android device is rooted.
    • Queries information about running processes on the device
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    PID:4295
    • ls /sys/class/thermal
      2⤵
        PID:4339

    Network

          MITRE ATT&CK Mobile v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          tbslog.txt

          • Path /storage/emulated/0/Android/data/com.yiwyxb.dk433504/files/tbslog/tbslog.txt
          • Size 114B
          • SHA256 6742c9ba883074f9fc4fddcccec559143b7b161b5238ce5deaecb887e13a5028
          • MD5 SHA1 SHA512