Analysis

  • max time kernel
    49s
  • max time network
    169s
  • platform
    android_x86
  • resource
    android-x86-arm-20240611.1-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240611.1-enlocale:en-usos:android-9-x86system
  • submitted
    15-06-2024 06:42

General

  • Target

    ad3549428f982733f6cda941f9168d32_JaffaCakes118.apk

  • Size

    3.0MB

  • MD5

    ad3549428f982733f6cda941f9168d32

  • SHA1

    7faf54893eb20e31db3ce2c6dd34ef72d51c5109

  • SHA256

    f2246526f002e68a7672a2730dcce54b41fe604512054ff18f83cd5fabcc84b4

  • SHA512

    ffae34ea519598c17fdccad3617139d719133835d3eae788656acc8d3def35edc123c47aadf6052b5d12e9a19191dfa799042e41779b3fc24de632fe75ca3cb9

  • SSDEEP

    49152:039PNz37WFRagCb4qjH7OxofIsoES76khGgUUHWPORJund8cL0NLcXbYFv9Kvdv7:kL7gR3Cbfz7OxkCTG6QO3ud8G8LCuoVD

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 3 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.tw_words300mrib
    1⤵
    • Checks if the Android device is rooted.
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4193

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.tw_words300mrib/cache/1582435991586.jar
    Filesize

    9KB

    MD5

    e8e0527a01aefdb89afd2c508f131da1

    SHA1

    f1103e6b260c657ceb3d95f1b023af3fda8b133a

    SHA256

    f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce

    SHA512

    fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34

  • /data/data/com.tw_words300mrib/databases/guest.db
    Filesize

    28KB

    MD5

    4330812459b53e9dc05d15829fec99c2

    SHA1

    f0abe6b9296ef96969a1f20b023fd43816e6d779

    SHA256

    f3cb3793de5322440e5fd38e29f0130d8aa9c4c21ca7346bc3a11cc9488569c1

    SHA512

    2b61e975f9a2f91e609a02c0e4cb8e16aace7cd044b6766bcc10b781fe8951faabb7379d40b4059948d6d3c4fb23a530f54816809b82c0cb8078706e5690c6a6

  • /data/data/com.tw_words300mrib/databases/guest.db-journal
    Filesize

    512B

    MD5

    63abab2af3d8b06f9fc575353804218b

    SHA1

    6613d36a75f8f620a15a3e3789c3fffeb3c80ba2

    SHA256

    027c75482441a905e551592eca65d9d7579de1181136bdc2e23d83392165c2c7

    SHA512

    570fc689a0f70d1a70938c5ffe6801070f6842d6c1025b7b5cff5b7ad3d95ea26df37264e972a21af133f00366b7e7c535bb457a3c6b555f67c424b6d7e5402a

  • /data/data/com.tw_words300mrib/databases/guest.db-shm
    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/com.tw_words300mrib/databases/guest.db-wal
    Filesize

    402KB

    MD5

    944d8528e4791f232df28a1ab8744453

    SHA1

    92c2c16cf3f5da66c047556adb47013a0a48efde

    SHA256

    545e39ea451126945de9ad31b8f87732b3ea9df404858f560a8ebf347beed8c5

    SHA512

    a1a5bfcfd562534e87cc323736ac61a173b9fa8cbe236c7a8e04f772c31f271bb3e6469f49ae4175dba272ca725fa36dedfe4bedff43e02365085242d46406cd

  • /data/data/com.tw_words300mrib/files/1718433816650b.jar
    Filesize

    202KB

    MD5

    7b0966b78cae7137c0b71a62c774464c

    SHA1

    4f59edd544097834555f7c576f8529a67fac2e34

    SHA256

    bb3f843f2f36340d0f98d78de1feaad6d5592963e85c712e93b127ab09b7712a

    SHA512

    2449bbb5817e8a1c87e3f52cc18669923c7ebaec7cf39dccb6c193ac0d54202219cf4839946a836e7d534650b97ba0b84bdcbb375fdafe9269e3236e1b8c4c12

  • /data/data/com.tw_words300mrib/files/coma.sdjfoa.sdfjaios.wcsywc.jar
    Filesize

    43KB

    MD5

    0b9415889afc67442b2475098f2226eb

    SHA1

    27057c7f324f2b748a1721c4e964a8a516e1a73e

    SHA256

    05ea8fae2e5a47d5795398d9957cdb8fd4b43bfef06a32acac5433d7ad3fee6f

    SHA512

    08cedb67b73086aa372550fdb1d7a797c9cd10b2bbda203d89fde069151dfb323f7322ae07cb9d9580bdc96e268b1b576cdd30e381b296970a0a67aaa9412694

  • /data/user/0/com.tw_words300mrib/cache/1582435991586.jar
    Filesize

    20KB

    MD5

    fde2ee00cbd121cfab5290b078aa3ceb

    SHA1

    e2b77d5320e155e413d040a8c20020962065b2f8

    SHA256

    2897b0812077c654a9b3fbb0b6303d5cde681eeba7ad9981de65716c7810d685

    SHA512

    a9326aff8e454a2b4ac09984ef2a65fddd4dc146b4c44d839035549bff8c9fdaae490326d0b018f76c1ca2e4fb25426d74f550ca0950982fba632a023af99a56

  • /data/user/0/com.tw_words300mrib/files/1718433816650b.jar
    Filesize

    470KB

    MD5

    dbe519e58153cf7c17d2d8ca27cb84bb

    SHA1

    3c14c5be0839a49809abdd37f265cb43f3b2ba54

    SHA256

    595a8774153c52517d7ae99b43f48fb2a2d5299648cf2e7b73b0be5a842d41e5

    SHA512

    2418edccb2debf1facca88ed2f2845f33e1efb0d907e37b697b61594b9039303761f3274e78c1bcb0b8bfae49333e72546c54faf68fe016283768823816988e1

  • /data/user/0/com.tw_words300mrib/files/coma.sdjfoa.sdfjaios.wcsywc.jar
    Filesize

    114KB

    MD5

    eba5fb8f2d4071032981ea1dd2273500

    SHA1

    637a909485112e2cb5346f74af9fe408f4e68879

    SHA256

    443757fb1f99e50f0e7f575c42a43482477d8a23853ce42ed3b1e092752e6c82

    SHA512

    75d45bd8c4892fc26287ca6294e9cd29a4576091d2040feb2ae21be99d1ebc6f72812a513642450fad581e50d7d46d80831ebc4008f3bf199a1b45fcf96632ad