Analysis
-
max time kernel
99s -
max time network
132s -
platform
android_x64 -
resource
android-x64-arm64-20240611.1-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system -
submitted
15-06-2024 06:42
Static task
static1
Behavioral task
behavioral1
Sample
ad3549428f982733f6cda941f9168d32_JaffaCakes118.apk
Resource
android-x86-arm-20240611.1-en
Behavioral task
behavioral2
Sample
ad3549428f982733f6cda941f9168d32_JaffaCakes118.apk
Resource
android-x64-20240611.1-en
Behavioral task
behavioral3
Sample
ad3549428f982733f6cda941f9168d32_JaffaCakes118.apk
Resource
android-x64-arm64-20240611.1-en
General
-
Target
ad3549428f982733f6cda941f9168d32_JaffaCakes118.apk
-
Size
3.0MB
-
MD5
ad3549428f982733f6cda941f9168d32
-
SHA1
7faf54893eb20e31db3ce2c6dd34ef72d51c5109
-
SHA256
f2246526f002e68a7672a2730dcce54b41fe604512054ff18f83cd5fabcc84b4
-
SHA512
ffae34ea519598c17fdccad3617139d719133835d3eae788656acc8d3def35edc123c47aadf6052b5d12e9a19191dfa799042e41779b3fc24de632fe75ca3cb9
-
SSDEEP
49152:039PNz37WFRagCb4qjH7OxofIsoES76khGgUUHWPORJund8cL0NLcXbYFv9Kvdv7:kL7gR3Cbfz7OxkCTG6QO3ud8G8LCuoVD
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 4 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.tw_words300mribioc pid process /data/user/0/com.tw_words300mrib/cache/1582435991586.jar 4455 com.tw_words300mrib [anon:dalvik-classes.dex extracted in memory from /data/user_de/0/com.google.android.gms/app_chimera/m/00000000/AdsDynamite.apk] 4455 com.tw_words300mrib /data/user/0/com.tw_words300mrib/files/coma.sdjfoa.sdfjaios.wcsywc.jar 4455 com.tw_words300mrib /data/user/0/com.tw_words300mrib/files/1718433815660b.jar 4455 com.tw_words300mrib -
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
Processes:
com.tw_words300mribdescription ioc process Framework service call android.app.IActivityManager.getRunningAppProcesses com.tw_words300mrib -
Queries information about active data network 1 TTPs 1 IoCs
Processes:
com.tw_words300mribdescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.tw_words300mrib -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
Processes:
com.tw_words300mribdescription ioc process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.tw_words300mrib -
Reads information about phone network operator. 1 TTPs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes:
com.tw_words300mribdescription ioc process Framework API call javax.crypto.Cipher.doFinal com.tw_words300mrib -
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.tw_words300mrib1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/user/0/com.tw_words300mrib/cache/1582435991586.jarFilesize
9KB
MD5e8e0527a01aefdb89afd2c508f131da1
SHA1f1103e6b260c657ceb3d95f1b023af3fda8b133a
SHA256f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce
SHA512fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34
-
/data/user/0/com.tw_words300mrib/cache/1582435991586.jarFilesize
20KB
MD5fde2ee00cbd121cfab5290b078aa3ceb
SHA1e2b77d5320e155e413d040a8c20020962065b2f8
SHA2562897b0812077c654a9b3fbb0b6303d5cde681eeba7ad9981de65716c7810d685
SHA512a9326aff8e454a2b4ac09984ef2a65fddd4dc146b4c44d839035549bff8c9fdaae490326d0b018f76c1ca2e4fb25426d74f550ca0950982fba632a023af99a56
-
/data/user/0/com.tw_words300mrib/databases/guest.dbFilesize
28KB
MD5b2322d65a319b055e0c219703fadfc7c
SHA1630e25120adb2ce272e6ae2ab29fd1acd95c7d1f
SHA2563c9d3d8ed7c0c14aef4ef5c100723847db20786ea283a268410900bc6e2a22aa
SHA512cfb834db05bec1e8b9adcbff4a3e29fe1081cab8559da30b5d8005189dccb70232eb7fac89bd81085ba60e5875adddf3d40aff398e652bab67431a280ae4f522
-
/data/user/0/com.tw_words300mrib/databases/guest.db-journalFilesize
512B
MD5e57f389272f892731b4ab45e4b7eb3b6
SHA1c25d00a317160409b53cddfa0c523443bd2477d2
SHA25664464e5053a3a8f548e5a7bd9e4afcc7710df48df9369de80af5d55b87291723
SHA512e45387e22ce5a8f8e6be9b1fc73e496e858b1baeb0ddafe58f26e3f8ee89aba41e6be085c23c13048826ec298bca765e9f46ccd987f973930efcc0cbd4bf32e3
-
/data/user/0/com.tw_words300mrib/databases/guest.db-journalFilesize
8KB
MD5565f78e45b268d4c4dbeea79cbff4b9e
SHA1b347fb2cc7e5f7d4831663ba27b6b2738c75ebe3
SHA25636fa62af914a1b96086a4256aa49effb08b73617de987111225c01b2b2a2f1dd
SHA5125b2fbd61daa289e79baf5dd59f1eaab5a3b12c55b13aa46d984451ea29ed1b7ead6c55bfaa80de31a5f6d1e52b9b73e1ec2d10e2d40ca53017bc5c88028f3d73
-
/data/user/0/com.tw_words300mrib/databases/guest.db-journalFilesize
8KB
MD518468c328005af7a9d77d1a1fec77043
SHA18cc1446357a930a83e7ca371a26420f9704d9b51
SHA256f66f5d94d4f4344dd4de1f018fd181399fca7b976763c177b7d1c71b4b087655
SHA5124239bf8e26aace3018013f8494b58ab48d82276358253c34645834ea51ac12eb5898b1f6034918ecf3cd8de4e72817ce449bdb3b412bd82c6330dc25abfec31a
-
/data/user/0/com.tw_words300mrib/databases/guest.db-journalFilesize
12KB
MD594332873ad8b4d3a6756f37b36b024b5
SHA1d005eba241d483b0df735836eae403febede5140
SHA256eb4e9ad227c84d36af892ca34e7d90aa4829915c6489d667c288271a9021858a
SHA512ca6a05e23626dc772226687baa6f4b41c141d05ded935f9508d01b86861b7e072ffd8592c03f469ed41367e26f8c105eb79415e913b2bb6f6958607bb0357d9b
-
/data/user/0/com.tw_words300mrib/databases/guest.db-journalFilesize
12KB
MD5ca3543aadebc3fc87547de32542a7bd6
SHA1501591d05f9367ad4e54e9d3147dbfec99a2ce47
SHA256ba1e3b8da0fd842551feba7540a9517babc9f0c322a0a0fcc7835fc9a5493590
SHA51258b81a645526b26b8961bd9efc068b68f58968d21ddd686aa2ebf3e5b6b486cd9ceaf59b017a4dba8252b93e235214f31e6ba18a77a4ad86c9bca357ae87d749
-
/data/user/0/com.tw_words300mrib/databases/guest.db-journalFilesize
16KB
MD55050fb36ddf80c82d90c8d5825e48208
SHA1abbbfcc46fc08b7e3673fbd026a0d9418f520194
SHA256e14ebbcfb6a892e2d5676aafd2eb3e488d97d2ef2085eefa3a637b52a58148f3
SHA5125450024387ae093aab5e8d736571fbcb6f3ffbe7627266a0a11d752636cf4d2198861299dd769dc8c727802e062ec1d01eddf7dba83de25cf2a102314d6f4cf4
-
/data/user/0/com.tw_words300mrib/files/1718433815660b.jarFilesize
202KB
MD57b0966b78cae7137c0b71a62c774464c
SHA14f59edd544097834555f7c576f8529a67fac2e34
SHA256bb3f843f2f36340d0f98d78de1feaad6d5592963e85c712e93b127ab09b7712a
SHA5122449bbb5817e8a1c87e3f52cc18669923c7ebaec7cf39dccb6c193ac0d54202219cf4839946a836e7d534650b97ba0b84bdcbb375fdafe9269e3236e1b8c4c12
-
/data/user/0/com.tw_words300mrib/files/1718433815660b.jarFilesize
470KB
MD5dbe519e58153cf7c17d2d8ca27cb84bb
SHA13c14c5be0839a49809abdd37f265cb43f3b2ba54
SHA256595a8774153c52517d7ae99b43f48fb2a2d5299648cf2e7b73b0be5a842d41e5
SHA5122418edccb2debf1facca88ed2f2845f33e1efb0d907e37b697b61594b9039303761f3274e78c1bcb0b8bfae49333e72546c54faf68fe016283768823816988e1
-
/data/user/0/com.tw_words300mrib/files/coma.sdjfoa.sdfjaios.wcsywc.jarFilesize
43KB
MD50b9415889afc67442b2475098f2226eb
SHA127057c7f324f2b748a1721c4e964a8a516e1a73e
SHA25605ea8fae2e5a47d5795398d9957cdb8fd4b43bfef06a32acac5433d7ad3fee6f
SHA51208cedb67b73086aa372550fdb1d7a797c9cd10b2bbda203d89fde069151dfb323f7322ae07cb9d9580bdc96e268b1b576cdd30e381b296970a0a67aaa9412694
-
/data/user/0/com.tw_words300mrib/files/coma.sdjfoa.sdfjaios.wcsywc.jarFilesize
114KB
MD5eba5fb8f2d4071032981ea1dd2273500
SHA1637a909485112e2cb5346f74af9fe408f4e68879
SHA256443757fb1f99e50f0e7f575c42a43482477d8a23853ce42ed3b1e092752e6c82
SHA51275d45bd8c4892fc26287ca6294e9cd29a4576091d2040feb2ae21be99d1ebc6f72812a513642450fad581e50d7d46d80831ebc4008f3bf199a1b45fcf96632ad
-
[anon:dalvik-classes.dex extracted in memory from /data/user_de/0/com.google.android.gms/app_chimera/m/00000000/AdsDynamite.apk]Filesize
2.4MB
MD522f5f412be1e027b1b27130f2e5b150a
SHA177d3872dc8d055c0bd8513d5374f5cc5b70f57b0
SHA2567e6ef684cac56dcd6ac78ac8b297af364d050bf2513e22c9cae71ce083a8bd5e
SHA5126c82f6ecffd3cc5820bf30b71d5bb766f5d46ceb4bbfdce261e52c5480952653bd0b551627e5a434f6866f07b85b14ab3bfe4875532528433eca0b2dc56c42eb