2d560439776a0a4b4a87085762213e2dab9e0b5c8182836c4054d954be957c6f

Analysis

max time kernel
23s
max time network
165s
platform
android_x86
resource
android-x86-arm-20240611.1-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
submitted
15-06-2024 02:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

acaa5d82516d48ec1beb39d528624088_JaffaCakes118.apk
Size

1.9MB
MD5

acaa5d82516d48ec1beb39d528624088
SHA1

f532d72a837d24b89b83c63ec97ef29eb2f6425e
SHA256

2d560439776a0a4b4a87085762213e2dab9e0b5c8182836c4054d954be957c6f
SHA512

2a7d4e2cd766062d9d5968158b0c0aee8dcfa41440662e78be61a25d0fe96473eb2c546c30349011f40786514231cb0399c267d91634557c1d2a4acfa13f12b3
SSDEEP

24576:gVhZrwAxILwHjeR3jC4fXShWCy1YQF1fiW6yL0/ht5O1jEexTyzPu98LLUVWnNn0:chZrbjyJhXIWPT352/h3MTb0QE73ZLG

Score

8^/10

discovery evasion execution persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4288	com.imangi.templerun.hack

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.imangi.templerun.hack

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.imangi.templerun.hack

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.imangi.templerun.hack

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.imangi.templerun.hack

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.imangi.templerun.hack

com.imangi.templerun.hack
1⤵
- Removes its main activity from the application launcher
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4288

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.imangi.templerun.hack/databases/evernote_jobs.db

Filesize
16KB

MD5
5d85664f8e614fcaef42be2e6f649027

SHA1
09c6288922102f6114a823f4992415fd3373d61e

SHA256
55f8907e91226ef43a05583c7b4623b4e26994b62d20c8603975ccc1fa3b9409

SHA512
3d6006a3e82d00fe9bc443e940acc5df12ec84114fcbcf8fbc8099c085cb1229b21a217b7445129b50558bfef5100894686d7359eb80b7ef087b65c7be3bc6e9

Download Submit
/data/data/com.imangi.templerun.hack/databases/evernote_jobs.db

Filesize
16KB

MD5
6bd7115bf5be1c4292ff6124f7ff5979

SHA1
6806c31dd6c626e3d304d8367021c15449a0b6d1

SHA256
5b7957b09953eab2f8d03b597bc62afec31d2097f93344792ada2bbed4227542

SHA512
afc67985e834fef6871fe11cdb12ae6a4ec1b09968b6b8db76275028b9ae9a4afe7030a79fdd31b326712173c31b665f6d6a013dd3abdad90f185026df87df68

Download Submit
/data/data/com.imangi.templerun.hack/databases/evernote_jobs.db-journal

Filesize
512B

MD5
d74b1a22eaaed65750073f9c4043b505

SHA1
9eb4fd1e84e20d2d88435bef7865291cb9c79e6b

SHA256
beec6f1076fb256a4f0d9bb589cbaf5e1877da5f63d8963fe713998d4d2efbe6

SHA512
7bf68f77b951cbfe1700924841994809dbdec11c4e59524064448e6b674133a16b74884c82adaed202b4caf1a37acb52965d8083a512d47af0ec9abad933bdcc

Download Submit
/data/data/com.imangi.templerun.hack/databases/evernote_jobs.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.imangi.templerun.hack/databases/evernote_jobs.db-wal

Filesize
28KB

MD5
daa47e6920ee18c4a9e5f3d5d6abc4c7

SHA1
f8fe18e671ab03779eed580597e5d280be908747

SHA256
2d90535d130996cc4389038e63d3e4633473ee790f81d00bf8766f0d403960c8

SHA512
9fb7b0ecd2a553aa18df68d5aa12849c47a717803f8662bb02bea53b2bbf459af1099155dea094b8107ae62a4a0180453194c432e2b502886bb6d13450d37668

Download Submit
/data/data/com.imangi.templerun.hack/databases/evernote_jobs.db-wal

Filesize
4KB

MD5
93b83276c442494a217346a99d90acfe

SHA1
fdcb4911d88cb27c6ed18a8dd83960a11b1e886d

SHA256
30701647a8aeb8ecb0bcb61d7c6a5f6f07357e7511b6d77fb7a77dbce9a43acd

SHA512
d8c30b12dcd891946b3f2a5ce181e03dd69feb2b82cc58465429285ac9a04f24d2a6cbd0b01623f8d099c76cc657b8f3f716b3d30cfcf29d5faf1245a18c3a00

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads