Analysis
-
max time kernel
127s -
max time network
147s -
platform
android_x64 -
resource
android-x64-20240611.1-en -
resource tags
androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system -
submitted
15-06-2024 03:12
Static task
static1
Behavioral task
behavioral1
Sample
acb50a5ddc692be06ae0acdb4d92bd24_JaffaCakes118.apk
Resource
android-x86-arm-20240611.1-en
Behavioral task
behavioral2
Sample
acb50a5ddc692be06ae0acdb4d92bd24_JaffaCakes118.apk
Resource
android-x64-20240611.1-en
Behavioral task
behavioral3
Sample
acb50a5ddc692be06ae0acdb4d92bd24_JaffaCakes118.apk
Resource
android-x64-arm64-20240611.1-en
General
-
Target
acb50a5ddc692be06ae0acdb4d92bd24_JaffaCakes118.apk
-
Size
12.2MB
-
MD5
acb50a5ddc692be06ae0acdb4d92bd24
-
SHA1
2197990e8eb1447e9d6326dbf0a4200f537506b3
-
SHA256
42e581f9d9f3293de31480360a6634377491a202242d642d45af50ebc082f52d
-
SHA512
145c191044ab825faa890498d588ba8d83bf3e52f87725f54a612444c95b108f655a83ba987c6837e070fc0b273b0d44fac44267f5f72be6b4d7bb7e1e9d98bd
-
SSDEEP
196608:MXubikGstyw7oDADBk0uzH7Lno9ai3VRz9wbnX005DW7/rdi43ORA7sR:BQwEDUBk0ujpsRwbnk0Q7/ZikORf
Malware Config
Signatures
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about active data network 1 TTPs 1 IoCs
Processes:
com.AndPhone.game.beyondthewardescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.AndPhone.game.beyondthewar -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
Processes:
com.AndPhone.game.beyondthewardescription ioc process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.AndPhone.game.beyondthewar -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
Processes:
com.AndPhone.game.beyondthewardescription ioc process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.AndPhone.game.beyondthewar -
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
com.AndPhone.game.beyondthewardescription ioc process Framework service call android.app.IActivityManager.registerReceiver com.AndPhone.game.beyondthewar -
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.AndPhone.game.beyondthewar1⤵
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.AndPhone.game.beyondthewar/files/mobclick_agent_cached_com.AndPhone.game.beyondthewarFilesize
98B
MD5ac28c7d283d06fadd41b3951e4d423cd
SHA17f88050f1470a66b91d39ecc5a56bff7ec255e37
SHA2565bc0bda82292575173c3aeb718dbdcbe6b6865f2efd7d60ca07222df6bd8cdb3
SHA5125ba82c67b40872f11f7af36c77275963a25a05af1359b1550c16eebc81b22a5819271f6fd7c707a1d7236ab6c2226fe277c9fe0ee8905fc40f25f37e3e0b2ea5
-
/data/data/com.AndPhone.game.beyondthewar/files/mobclick_agent_cached_com.AndPhone.game.beyondthewarFilesize
197B
MD58a60720931b6cc4f1a02dd323533ed42
SHA124fceb1b6469876278c23f41a8091d2f90afcd55
SHA2569e3dc1d0e50280a2b3532da262e686cb4c0642e41e5002f0aa6bc735aa439e09
SHA512d890737f5828ae23ffa06ad6c32fa08902334702a8e533d39f0e916244278d44d2195591323eca65a25d89acbaf253bed8272001dc67f2f041e2b19d423b1c95