449a67e03e05e2035b33fd253bee3f8bcf9c54c85e2bfde571e7e5d44ae485bb

Analysis

max time kernel
34s
max time network
151s
platform
android_x64
resource
android-x64-20240611.1-en
resource tags

androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system
submitted
15/06/2024, 23:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b0a418ce4f5439ddcb9c864e5ffd45a4_JaffaCakes118.apk
Size 7.8MB
Sample240615-3b7ldsshkq
SHA256 449a67e03e05e2035b33fd253bee3f8bcf9c54c85e2bfde571e7e5d44ae485bb
MD5 b0a418ce4f5439ddcb9c864e5ffd45a4
SHA1 c193efe7fddffc9ec3db481ee179f55723c9c82c
SHA512 39fd4aee81c8fd89b465c5d6d904af11bd1e730c7afef6f781e0fe3e4c5047af03ae98329b4541671f5b49d230d958270bc217b909e529c0aee3157018472500
SSDEEP 98304:ho8sr3DIVnWwCBZUcJbzpWrW4ShYSDUBbo4CFDv/3IOcVx9DUzOpHw0DCq1di466:hmv7prh9DubcqVoyt6q+46rPW
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery impact persistence

Malware Config

Signatures

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	ir.corona.viruss

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	ir.corona.viruss

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	ir.corona.viruss

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	ir.corona.viruss

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	ir.corona.viruss

ir.corona.viruss
1⤵
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:5155

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1424

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

216756b7-b71a-4bf7-a592-f055699b1d86.jobs

Path /data/data/ir.corona.viruss/app_com_birbit_jobqueue_jobs/files_jobs_default_job_manager/216756b7-b71a-4bf7-a592-f055699b1d86.jobs
Size 778B
SHA256 d4bec4deaa25ea06c6938f13b417135d6627160cf72347ddcd309ef69141c445
MD5 510aaf38c0e06d400c819caddacda95f
SHA1 a839fa7fec66a2c13113d070ce7972c4494e82ce
SHA512 adc30a676491f187445e0e235bb01e72af475951dfce38295d98da378b36e2d4782a01bd1d1b109e6c3d523f314f7397d3b21e45b900093904479b9f08834f49
MD5 SHA1 SHA512

Submit Download

245bda17-21c2-4796-b33e-c1ac71a35872.jobs

Path /data/data/ir.corona.viruss/app_com_birbit_jobqueue_jobs/files_jobs_default_job_manager/245bda17-21c2-4796-b33e-c1ac71a35872.jobs
Size 278B
SHA256 bc94ab388a3240cc0c62ea8bee9e71565dfb91912431820de6149ff6c5384f4e
MD5 2fe25e9702b55ef369fdd29b556bcac8
SHA1 da032b2a1299466d02345b0cd92ed1cba5d9152c
SHA512 1020c0a86592d5762daa49dd64b24d55f8709d1decfc0c95588451e67aa89f27acb0af77db484350e7a4daa448890d8a7bd719f9874f081a5e9f069b5a60202a
MD5 SHA1 SHA512

Submit Download

40497b76-940d-4d5e-b6e9-5cfbcc82ccfa.jobs

Path /data/data/ir.corona.viruss/app_com_birbit_jobqueue_jobs/files_jobs_default_job_manager/40497b76-940d-4d5e-b6e9-5cfbcc82ccfa.jobs
Size 176B
SHA256 90949c83a3d90fc0128f0d5df662aef3699971ce9e63ab067382f970cbab8918
MD5 f56f328eea1d5c96a1b96dbbf59488df
SHA1 440c784cacff61932e2f61580b7cfdc3a4943c95
SHA512 36e370cf16dac8b173fa182960789974d4087a7b607042000118ce518db8f1eaf93cf4f3be42c1c26ab53e87ff54da33b4c57a3a15e5cd47f2c2b66efe8b3edb
MD5 SHA1 SHA512

Submit Download

f245988e-6b80-4409-bfe1-a0eed1ef4441.jobs

Path /data/data/ir.corona.viruss/app_com_birbit_jobqueue_jobs/files_jobs_default_job_manager/f245988e-6b80-4409-bfe1-a0eed1ef4441.jobs
Size 179B
SHA256 9537553772c29c4303e606e458fd9598c14f1eee3cadfb446e241638bee3ccdb
MD5 ac58f99a1b179d71e8621412ad31c6a1
SHA1 b51fdad95876f5615735c2ab411031ff67d5e946
SHA512 faf45d5eb4b890216e6ad33825ffc02cbc57914628e625164f9cbdacd5962ce8ca8f473ded2f56eb4d4006fc7cafa9cff8c9f76655f17f83f38d3e89b8d7e67b
MD5 SHA1 SHA512

Submit Download

cheshdb

Path /data/data/ir.corona.viruss/databases/cheshdb
Size 24KB
SHA256 4f4987ac3d84abad3490459fa7a32b7bfadaae5f329e15dcff36e07d34faaeb1
MD5 259a1e4e7ebc4b0d0341ffcf0c3bc2ea
SHA1 9b8da5a0b24833a3e84567d9d8ee0d2f54d7b48c
SHA512 dc1296e2b0b18dd83a3782acb700e155ea9a60ef193bfa8c98999e7cc3c5b73a97c20a974cc956ab438aeeba812ec2d2f401fb2e714bb9bb5fb421fa4b7a2313
SSDEEP 12:TLLZO5aaocVkzONTSFbyG7uYy8oRmBEyPbD3OwGQ:TLLaZVbN38GSzGQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

cheshdb

Path /data/data/ir.corona.viruss/databases/cheshdb
Size 20KB
SHA256 96d35bec27e5125ded8acd4fd39706e82f878ed884957af6d76a20365c6e4a24
MD5 c9205574ae1d93626d299d8060c1f8c4
SHA1 fc8bffe3e4cc07af39604232910b9365210dc7c3
SHA512 3296732b92b89faac04f82c990763cb4581000d7545cf8a7f09cfdcad5828107eb83ce654c83c73365e057706ba4f36e9a15e4a689638163b8cfe2b2282e7bd3
SSDEEP 12:TLWHUO5aaocVkzONTSFbyG7uYy8oRmBEyPbP/3Vpn:TL2vZVbN38GSP/lpn
MD5 SHA1 SHA512 SSDEEP

Submit Download

cheshdb

Path /data/data/ir.corona.viruss/databases/cheshdb
Size 20KB
SHA256 c8092296754e86961aa31bbba4f459f5d6dc02b1b67dd0661344d1d18e27abf7
MD5 2aa1b33313ea319a958b7ae3ec785861
SHA1 726993b86945616481e096d0bb63549b3602a9fe
SHA512 cde21febf83637476b3e3a3071c544c986ef17960d473a8e9e49d9ce4e13093c289536759077d9533be1f4ca215eee840386ada337defa7eb67635c66e96e061
SSDEEP 12:TLi4O5aaocVkzONTSFbyG7uYy8oRmBEyPbP/hq+AOJn1e8SH4sVVz:TLiLZVbN38GSP/hVre4wVz
MD5 SHA1 SHA512 SSDEEP

Submit Download

cheshdb-journal

Path /data/data/ir.corona.viruss/databases/cheshdb-journal
Size 512B
SHA256 8b7e5f79af74d0091bd61ee738c424823fa25e3ee12f39f2b9408e69c136091c
MD5 3fd049b9089dcca6438050b7e49cf61e
SHA1 eeeacac941d3f952852e4669afdf17f53fe76bb1
SHA512 7569266d9d0f3572abff56459ee45b0d65e6d62cb63de4f9a5d787c0e1dbf1bc8db47d2d3750bb41fb6fe74f68f29f7308342ab4e50ff5c7af9d01f561d5fa75
MD5 SHA1 SHA512

Submit Download

cheshdb-journal

Path /data/data/ir.corona.viruss/databases/cheshdb-journal
Size 8KB
SHA256 65e232f13b14e7ee114e72155f3deefacdef2b06a1b68c59732a8b272907eb76
MD5 c31e2971dd1b6d1487a85ed8d54ef934
SHA1 6216c8f35d88d7b22b9d9ff0ff3ebbb1ecd48495
SHA512 fe891e73d7fd1ada429b77138608d69373f626c5c730beee58a57f4f1b48419551cb753c79ac864867c5c44a9009d19cb4b52eeddc2690b264a3df1df77d4626
SSDEEP 6:7+/l9J2N/Gn1Ypg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKFn:7+tqVNpqLiuWdwRmBEyPbu
MD5 SHA1 SHA512 SSDEEP

Submit Download

cheshdb-journal

Path /data/data/ir.corona.viruss/databases/cheshdb-journal
Size 8KB
SHA256 966bf53ddfa443295239a0c0076465f07b8e7fd598f92005910ce6550df3bf16
MD5 0c474419961259a66e5efb4b884f2cbc
SHA1 37335441609e657d6e52b319e7117e606d47d920
SHA512 c4293076b01ee03554fd5ee15a92ff18fc381a24843fa4629b4156cf20d46912844eff0369f753aa393a6278550fba6f0c2118f2d7382ebf3635a27e04fc31b7
SSDEEP 6:7+/l9l6sUHPg9bNFlLdrlOERX4PBX4ogLugMBX4suuK+6/N:7+tavvqLJdTRmBEyPbPKN
MD5 SHA1 SHA512 SSDEEP

Submit Download

cheshdb-journal

Path /data/data/ir.corona.viruss/databases/cheshdb-journal
Size 8KB
SHA256 39139f2c98f39fa05bee6b8e9304a3aa9382d6f770de7984a6812994bdba0207
MD5 e12ee71cf4eae281511e329b8b53b32d
SHA1 54906b30e350a22a4efdf2ce091ec07c65015ce0
SHA512 3c37230db10f874976d9974bb8eee7839358c8e68ed29cbc472a8e0d0da807f0f3a4ba43af66b5ee6181d4800262d99dc24c8af32dd43118c82831eb87c88627
SSDEEP 12:7+tTWqLlO5aaocVkzONTSFbyG7uYy8oRmBEyPb3:7+t6qL+ZVbN38GS3
MD5 SHA1 SHA512 SSDEEP

Submit Download

cheshdb-journal

Path /data/data/ir.corona.viruss/databases/cheshdb-journal
Size 12KB
SHA256 bebcd489e9310377e9fe5518b306784138bbe94281b3bb656eac3441e1b5da8d
MD5 45c345d74409f712ea9e781aea287e9a
SHA1 bc4828217dabdae8a1e0531cc4b372eaf91ec313
SHA512 bb6d58aae804c4cbcafe3f62f46662f15149a4d5a90aaba5b96d1bd4adc27ff118a489c3a16b6333eef3ef5e415dd6f01250e3c9f70eac6d008c21d2ce7d26af
SSDEEP 12:7+t/qLLZO5aaocVkzONTSFbyG7uYy8oRmBEyPbc:7+t/qLLaZVbN38GSc
MD5 SHA1 SHA512 SSDEEP

Submit Download

cheshdb-journal

Path /data/data/ir.corona.viruss/databases/cheshdb-journal
Size 12KB
SHA256 fac80543edc390a8ab6a333f4422ed6cb93764a67011b35a6d455849989fa4aa
MD5 07b8cdab7fc7f2255109dbf9b7e647b0
SHA1 139bf5f2761d9e270b2e23c4537c9356bd255236
SHA512 753cdef13463caedffd6cb44766ae3ff792d8712e5189997e401e8623153bca7c0ff61a0b6b4a156767e9ca096b0b29e18db986b523e0c41ab67c7cd3d486629
SSDEEP 12:7+tv71e8SH4sViM2iqL1O5aaocVkzONTSFbyG7uYy8oRmBEyPbj:7+tBe4wiM2iqLOZVbN38GSj
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_default_job_manager

Path /data/data/ir.corona.viruss/databases/db_default_job_manager
Size 28KB
SHA256 6dcec7146d3b80d2970f670b2644ba23b2aa25d9e496d7bed91401b7e7438bd2
MD5 3369e93d584904099f7ce3015597f425
SHA1 86f887e783527186b18242591738f212deb53d00
SHA512 ef3c3b8381a3be842a8650649d2b8cbb5027d5f790727390e636c79b248453e6eac656678bbf514541ccfad9ef8279ee75f7447f2077017477f56df58bece09c
SSDEEP 24:TL456zEyC7xKIK5whKOELcGFM9ikxzGSileBl:TxzdCw5UfoSq0
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_default_job_manager-journal

Path /data/data/ir.corona.viruss/databases/db_default_job_manager-journal
Size 20KB
SHA256 e183d1d583aa1a9c0d6ccb7bcbfdf5fab1674130d4398662d1d8e3a169fbd82f
MD5 7548ac3c9409c8e81765c554e3bf097a
SHA1 63f735c8eeeec0bc77bf5b227f3246866068d106
SHA512 a8fe3f054decdc075eaf5b445b41082701127b62a29ade552eddeab35d2cfcab4bb578ec9d222a1dcffa0a37d3557c381273a33a34bc3a36b52317974aef74b6
SSDEEP 24:7+tMLS22YqLEn0y6zEyC7xKIK5whKOELcGFM9ikxzGSG:7MM+22Yqo0nzdCw5UfoSG
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_default_job_manager-journal

Path /data/data/ir.corona.viruss/databases/db_default_job_manager-journal
Size 20KB
SHA256 0dfa8152d2c729cd7319a4a1c90cbdaf46bdb2452351203a6f078b423798afb3
MD5 4495cbc32f9ab5ca3b52deb7ad84f369
SHA1 b43dcab69088d3b9305bef31b15e60a4c0a8368c
SHA512 5df7de50bab8db060d324520e7c800294afb6b7f7374317a0a93c822aab0dff9e8b3429590e0e8b8935776eb36163b0bac41498ab862c1923624252541114532
SSDEEP 24:7+tVOO3QEtZQ6qLyQC6zEyC7xKIK5whKOELcGFM9ikxzGSNNVqLWr6zEyC7xKIK5:7Mkl6qBzdCw5UfoSNfqRzdCw5UfoSK
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_default_job_manager-journal

Path /data/data/ir.corona.viruss/databases/db_default_job_manager-journal
Size 512B
SHA256 a9f94fbf2bd8ed0b11406eec42818325c05b991f657aa9dde1e30e997ef9d29f
MD5 cb568d95f7adff4d8e8435743f1cb77f
SHA1 96df9df54f2a2a9c0b1dc022f5c791c615ff1a92
SHA512 ad5ac79eb9815609fba736ff71b66646c4f4ce60f92f4223dc981caa3028316d04ae21bbcd6f7249b9f7febd31fc5da5d79a557d75a852ad99f684a97e046945
MD5 SHA1 SHA512

Submit Download

db_default_job_manager-journal

Path /data/data/ir.corona.viruss/databases/db_default_job_manager-journal
Size 8KB
SHA256 e823b06756eeed9cfc51b1bf4732f2d7e4d4f9aafa391bf02360c622c6392b96
MD5 6d96984d12febf6fde7e3bbe49366f83
SHA1 da7218207aeb7e40e1d06c7f2cfe828405925694
SHA512 957ae9ac796ddf3d9d788867b59e4792fee80d8367de1962c2155d8a3915116ad74226d00683d5902c3d845380c724fc28d580e9c91ad575ad87d873512efadf
SSDEEP 6:7+/l9BAluHn1P2vg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKDn:7+t8UUvqLiuWdwRmBEyPb0n
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_default_job_manager-journal

Path /data/data/ir.corona.viruss/databases/db_default_job_manager-journal
Size 8KB
SHA256 30b6ffaf4ac4fd3f8e1dd03a8a400481d138bf019949f33b5c1ba08b4c21a134
MD5 124d646f8c24fe51eff12ef8f52df2aa
SHA1 fff9cf029ebed8ad2b293bc1a6ac0cc4a62ac210
SHA512 3da19f8b21a134605b3eee20aa396554aacb001068c22c2194ac06bdf386b21f2b4c44cc76986e78e27514ab33f40d74cfb1d227ead0c423913c80351595885f
SSDEEP 6:7+/l9rIiGPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKwi/D:7+tJaqLJdTRmBEyPbUD
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_default_job_manager-journal

Path /data/data/ir.corona.viruss/databases/db_default_job_manager-journal
Size 12KB
SHA256 dd7161d3bc37213a723decdcaee341f247b39fed9a2239f25967eb5d92a48e6b
MD5 1f7d2994f8681715b11834fe0157362d
SHA1 b27a02ce6d6b78743ab8bba83c3220d7b35a9848
SHA512 fc08aa4f4c2a8fd03ea3680b433fc1278eec04ce9a560b572d887e109cc3049b657717a6dd1e637a4e03c895d741e3a2ccecb963ccefdcfde1a082b9da5a106e
SSDEEP 24:7+tSqLr46zEyC7xKIK5whKOELcGFM9ikxzGSy:7MSqBzdCw5UfoSy
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/ir.corona.viruss/databases/google_app_measurement_local.db
Size 16KB
SHA256 672c923b05359ec59e88f4730a22dcd20d3dd615d1b45513a2b0813619a19824
MD5 3035fe8fc3fdd3e2f183b911dc7c2ad8
SHA1 390e122dc0962336a556b02c636e7d17b1fd734e
SHA512 2320fb917adc45ebf26da53b17b288ae57a68202dca746a1f1c2a7ca75dcaaf9e7590b09c57f7ebaec3213603284d9d6e04e54592a3c1fdf1f2b58228bf8f465
SSDEEP 12:TLWuEOe9zmzrfRmBEyPbBvOwu8FAiOLauK/6AUvkWlf/:TL5epmzr0GSNuOKary5tt
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/ir.corona.viruss/databases/google_app_measurement_local.db
Size 16KB
SHA256 b9ec7ef3639b78ce794fd930256c63a5971d6c591a575b72c2565e88b226f0f8
MD5 9af32e6e45cad9c22a0beff7e5a3b5a1
SHA1 5a29f2bc3632484e3b47e1c6f08bf5f9de1cc49d
SHA512 eccbc029247794c094a0ee62de06ac5017ef3c8097d132efb40af9487224eababd73ed51be4e681cefa2d9bb8b1041bd51fb26ddaa2f0b15368b1114ce5d1837
SSDEEP 6:l9bNFlsls1ylO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/Wzl8:TLiEy9zmzrfRmBEyPbP/W
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/ir.corona.viruss/databases/google_app_measurement_local.db
Size 16KB
SHA256 d50783e016559013c2c6299c2e1c2719fa085b7a7827704794d22520603d4712
MD5 2cf75c2e19722534b535106a341f889f
SHA1 1cb74934efb237e58747dff9b75ad129fd094837
SHA512 b73bf02c52eb8fa491152d46a4d8796281bc25f78154dccb380835f9e0b2f1f734bf550032e904c4c577df0d983676dd26ffd0a94daf5003dcc9e48897ab6cec
SSDEEP 12:TL1Ev9zmzrfRmBEyPbP/n06iv2OS/U/vkWlfe:TLQpmzr0GSP/n0vOTstk
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/ir.corona.viruss/databases/google_app_measurement_local.db
Size 16KB
SHA256 054d8384806ea8634bd69b9ab7820a32e8f8545d69b81655de525ac7032c571c
MD5 62a48441c971800382680c5af07d8a84
SHA1 ae5ea53c543f7a85bbba8fc16d81803cf720947e
SHA512 470ea9a38e0b5ba416edf6f6aa4b69f43789107a15c0254d0b94831f11c5c084f5f9f3218d6ade9bfea1087a9843287d3f14d2badd041e48c341e54da7bcdcb7
SSDEEP 6:l9bNFlils1QvlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/WblE:TLIEQv9zmzrfRmBEyPbP/W
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/ir.corona.viruss/databases/google_app_measurement_local.db
Size 16KB
SHA256 9b08a96d83afb1a0af37a8936d20bf8fedbea27bc9ba9348b5956e5ef8b984c0
MD5 f8adb5e771c0a12a8d1c6361702afb00
SHA1 803fb0934259eaa6e7cac024550003748c100148
SHA512 1bf19b2088445ade6ee7d54e1c46c63bee98309d29ebf823b9752e5b97bf963da7ce873e230b5a899180900fec0d2306a3c70a7822d68001c557c20674d31ccc
SSDEEP 12:TL6uEp9zmzrfRmBEyPbP/oToiOLaVLAK1+o1GtElcvawWlw5:TL6Xpmzr0GSP/+KaVLMJtEqaZA
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_app_measurement_local.db

Path /data/data/ir.corona.viruss/databases/google_app_measurement_local.db
Size 16KB
SHA256 3248996b7d923110c3a0e609ad14a7f85aa399d0583401cd91b136a2368caece
MD5 022add3e2f0cde4a6c2fff583bed00c2
SHA1 2e6f114ef3ed7cdd9eacbe01797b73482699fda9
SHA512 b076b9c84e33b58678b1900411d1e097c40ca5bf4a6121fb3c77c011b2d1b189f275d7169cb707b0b3f6bfac56765cec7bdcc1055618dcc15999a7ba7364f33e
SSDEEP 6:l9bNFlkls1KlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/Wq7llll:TL6EK9zmzrfRmBEyPbP/WQllll
MD5 SHA1 SHA512 SSDEEP

Submit Download