c324e0125aa7e4ec912f55bc51426774c8833363bc43ccc1df4e6437128f1286

Analysis

max time kernel
3s
max time network
132s
platform
android_x64
resource
android-x64-20240611.1-en
resource tags

androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system
submitted
15-06-2024 00:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac522929ae914a28b35b7258c2339e52_JaffaCakes118.apk
Size

24.8MB
MD5

ac522929ae914a28b35b7258c2339e52
SHA1

ee0d7c891caa1513049ddffa0b09f15f90d1b271
SHA256

c324e0125aa7e4ec912f55bc51426774c8833363bc43ccc1df4e6437128f1286
SHA512

305c08852a17d737a75cde39868a3d0b15d104c3919eb0b0ebb5e325a58176179e955c3857c0969c24a8a080eb6c69d492e08d7afb896b324118766cf02e3720
SSDEEP

786432:Pp0jZPY64tJk6KJv0fRUodWkZqKl66Ixx:Pp2PYj+MfRgTD7

Score

7^/10

discovery evasion persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.coolang.oem/app_plugin/PlayerUIApk.apk	5074	com.coolang.oem

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.coolang.oem

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests dangerous framework permissions 3 IoCs

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.coolang.oem

com.coolang.oem
1⤵
- Loads dropped Dex/Jar
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:5074

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.coolang.oem/app_plugin/PlayerUIApk.apk

Filesize
143KB

MD5
453960899faf2f8710b4a89f40ff3070

SHA1
83b43b3fa9be3074300a336772d5360a5b5e4b95

SHA256
fb48fe020d71a13ce48fee53e54cb6e0120dd3fb94519ea376f170b18fb60a4a

SHA512
1824db0130b002f908f63703f247a4fce985a92b4389b6de66c991fd19ef47f724b3c71d045bb13f71c22fe2965a61b023249f1758236b69bcbef3ac522742fb

Download Submit
/data/user/0/com.coolang.oem/app_plugin/PlayerUIApk.apk

Filesize
285KB

MD5
ac0c01be752771d01bec41ace38a337a

SHA1
341f50c23a97d311bcb6971ff4732b20fa32d4fe

SHA256
4b89f24a04562e927cf38149227f05f9049b2507adec6bdb67b808d68ad4a316

SHA512
0d326ebff770f6a20b8db1e5de8df12d6a36799e03622fe89ca08bb51e799950590bd19d027342f0031256d54676c1244900d46ed02e79fd543e36671ed9208b

Download Submit