c5d456889d00e18fcc48e6c0c26f5053ed7d07b7af2d8b2a3b09ecff00b7563e

Analysis

max time kernel
165s
max time network
153s
platform
android_x64
resource
android-x64-20240611.1-en
resource tags

androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system
submitted
16/06/2024, 08:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b2917324e6385a940a50c4afa83be06c_JaffaCakes118.apk
Size 28.3MB
Sample240616-kc48jswgla
SHA256 c5d456889d00e18fcc48e6c0c26f5053ed7d07b7af2d8b2a3b09ecff00b7563e
MD5 b2917324e6385a940a50c4afa83be06c
SHA1 afcdd832a7c47469247051142495b8fbe940872f
SHA512 ddf9d123fb6734927a0d7af53fca2a8aa49fa1f567e96f8e684299d2714750ffc78f1aae5ea895ce3f8898a93beb09c5a065eb49c7ce31321127a493c34c162d
SSDEEP 786432:rtvmHUmWa924rUM6GPv92BAsxRbxLbLYPk5sqg:rUHUm72oUM6Gt2BAGbxLgJD
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection credential_access discovery evasion impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.crossfield.namsterlife

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.crossfield.namsterlife

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.crossfield.namsterlife

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.crossfield.namsterlife

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.crossfield.namsterlife

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.crossfield.namsterlife

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.crossfield.namsterlife

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.crossfield.namsterlife

com.crossfield.namsterlife
1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5085

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

User Evasion

T1628.002

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

db_hamsterlife02

Path /data/data/com.crossfield.namsterlife/databases/db_hamsterlife02
Size 28KB
SHA256 093f5fe30726e92ae9ddb7f976b7215d37500d28c01b707a787d8e438dfe24d0
MD5 0c89caa65984c2b762d5e92903ba44b4
SHA1 8a2a815f05176ce2268b824bc87b13aafd1e5e2b
SHA512 25dfbf8ce5c8e87efce575d511d08fd7027c9fd4a275d9385710be2e17b0a7b43f440af51f19ef81df007dac8feb1e0954744d43fc621c0475bf6eed61a1c264
SSDEEP 48:TlkHQtOOfW8GGWtfekItBSb0Vn+RuwSEtGkED+JWu4GNlQ:R0YT8fekItBSb0Vn+w5ECu2
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_hamsterlife02-journal

Path /data/data/com.crossfield.namsterlife/databases/db_hamsterlife02-journal
Size 512B
SHA256 eaef0caeae85126ca8fbce3c4c0ff9c79aa870f91a1a984350c5f3b449c46132
MD5 311d8b90bbca9ede45e59a2902951421
SHA1 0e5e49e79b0b21328316bba55b3e33ad06f9459a
SHA512 432632c763511843ea1c0b0d4efb9ea185f87fccc958b3b83764fd54484e7a9c72631f018549596f9673685adb7714714fe2fdac22636679ce87967a4abbf079
MD5 SHA1 SHA512

Submit Download

db_hamsterlife02-journal

Path /data/data/com.crossfield.namsterlife/databases/db_hamsterlife02-journal
Size 8KB
SHA256 2f27f3f5dc990a9f37bcb56e88c9c6de5b6269aa53e9af7e38bf2445ad6e4985
MD5 a52e78ed0131adff588f568d3c01a001
SHA1 9eae72aa5a4514bc87fb2b69c694988a974abea9
SHA512 8b72bb92e303dbd28ea653c2f2e106f00b2a528546c0bf57732df1b5020b0fe75b46f6436f17367f251cc2459db82f2a6a7460170d1a91c441a8b96eb962e2f0
SSDEEP 6:7+/l9mGn1ug9bNFlEuWdOlOERX4PBX4ogLugMBX4suuK7:7+t4dqLiuWdwRmBEyPbQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_hamsterlife02-journal

Path /data/data/com.crossfield.namsterlife/databases/db_hamsterlife02-journal
Size 8KB
SHA256 324d7ca30492df44c1fd4ecf5eafc869508f3d69e76fa465cc8b5e46310c2b10
MD5 d476a41accee45cc458cf68e35e7a1e7
SHA1 3fa79155932bf26c8491a2613aee01e343d61aa3
SHA512 669bedd5dfe70e2a4f8d0135c24bf6769d3a96df0016d325da955061c9efad4f6980cbcc5b3d611518b072eaa030117704d9f7f1a2f9ba054c99130d54b8fad4
SSDEEP 6:7+/l9KHGPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKkn/2:7+twH6qLJdTRmBEyPbh/2
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_analytics.db

Path /data/data/com.crossfield.namsterlife/databases/google_analytics.db
Size 48KB
SHA256 ea72119778f1d7ae9775fb7bf23aea4781f4f8ef30f1a3a46199b1a516175e9f
MD5 3882fa1b499e7373884509a566f54f3e
SHA1 fc8f434872ac434b2536da54766f36123a3982b1
SHA512 c6b1c1ce9ef4295033a8fd35f0120342b00f7d6dbc79b5514872eb294847a181d08b0310e9be01340b4c9c0ac2019839471cc397b99a6a44d1e50a87e357de9b
SSDEEP 48:TGw63b6b4PGbe9TZUjx+RO+UZRmKk+rECO4QwWXnIxCObSRVz:iw6sbe9TZmwlUZRmKk+ryPnIte7z
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_analytics.db

Path /data/data/com.crossfield.namsterlife/databases/google_analytics.db
Size 24KB
SHA256 8ba22360c274987cb70f9a43562a3209d480c06f20aa58caa8410a5be01b9a1d
MD5 00ca93431d82b101f1d12574d5c1ede8
SHA1 6b3dea4a5847883546091881f4a4780b7edfd60e
SHA512 b8c0c1495f739238957080ee61ebe956318a50be87a1797a89e379f06d835b0f15475e5f53ed1039a069e6bf31f53974dd93b441dde7aeda8236a0139c9d08bb
SSDEEP 48:TOY63b6b4PGbe9TZUjx+RO+UZRmKk+rECO4QwWXnIxCObSP/6:qY6sbe9TZmwlUZRmKk+ryPnItePC
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_analytics.db-journal

Path /data/data/com.crossfield.namsterlife/databases/google_analytics.db-journal
Size 512B
SHA256 0ffa4bc5c3ce4a1554b04fa2bee022209d9f9983a7f962a4d1bc74188eaac147
MD5 fda76cabbb2c95553cc31021bf9bded7
SHA1 6344b837a7c0e66fa17816164fba231301df208a
SHA512 386638724a2ebc3ccd1c4a6663386674cf459431f859e01b1f3f2e6ce2623e86129c2490b71619d47a62756cc9c8f07e86978c1ca6b517dfedccdb78d2d83419
MD5 SHA1 SHA512

Submit Download

google_analytics.db-journal

Path /data/data/com.crossfield.namsterlife/databases/google_analytics.db-journal
Size 8KB
SHA256 cf244c55354c212174ba400b141ebe3e5118aebf64f2d5938490448306ca726d
MD5 ae24869afb13095e451c40f59fed11ef
SHA1 a103bc21e02494c0ba47f04307b95ecbf8ad5d9f
SHA512 16168b9f09ee5e3f3c69b998df061c719a0314a96900db803f99c31e9c8d1d535cf9cb29b40b4b69f1bff60297000422410413c1bdf16f7b4174a8b193887b91
SSDEEP 6:7+/l9Upn1cig9bNFlEuWdOlOERX4PBX4ogLugMBX4suuK4:7+tZiqLiuWdwRmBEyPbT
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_analytics.db-journal

Path /data/data/com.crossfield.namsterlife/databases/google_analytics.db-journal
Size 8KB
SHA256 95506cb5140dbd62f7b35cbfeab30e9150b37f4513703e963675d8a9ccf25b15
MD5 d2704b70ee273d3c1e19ce1769783b0f
SHA1 f904184b342649abefc3f81ebb54ec98044af918
SHA512 2959ab274861eb584ec37db0fa62557324f89e76f093aeaff6376a29de939b89bdc68b25893589ea78b1b750f518fd19a31c0784769ece4e589abda611b72837
SSDEEP 6:7+/l9JZPg9bNFlLdrlOERX4PBX4ogLugMBX4suuK6tP/cn:7+tBqLJdTRmBEyPbnncn
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_analytics.db-journal

Path /data/data/com.crossfield.namsterlife/databases/google_analytics.db-journal
Size 8KB
SHA256 5abfeec1132f466482c6f74341cb5163ec59d38a5faf7a4b5c78b585529c76d9
MD5 4b0e153d08a5aa60240731a2f2ad42bb
SHA1 bf7a3a70cda9161be75f42e427d69c766a67d572
SHA512 9247e9aa004705f071d4ec34c4c5885a200e3d815457b8d48719f0a73b319d888c2b2d037b264aad6133a747559457db5d9b5ecf552270d37f2d92883cee51ef
SSDEEP 48:7MqvqGw63b6b4PGbe9TZUjx+RO+UZRmKk+rECO4QwWXnIxCObSG:7vNw6sbe9TZmwlUZRmKk+ryPnIteG
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_analytics.db-journal

Path /data/data/com.crossfield.namsterlife/databases/google_analytics.db-journal
Size 8KB
SHA256 be44d8ba10d7e45fa7afe5e2d3c999d6b0f20f1d1db768c5e0ef08ea065f3d10
MD5 fe9c7756c58569eec26f3b16c187c3fd
SHA1 ae79f9432bca9d33a18d5df4f03fe4383209ad65
SHA512 2b54529d3a19e0e76160b5265be292f87fb840bb35670ad07a49479002fa546d26bfad16655be48261364d3f8f13f0515ba893a79fe744db81013a1ca4af8590
SSDEEP 48:7MdDFnqR2I63b6b4PGbe9TZUjx+RO+UZRmKk+rECO4QwWXnIxCObSTK:7662I6sbe9TZmwlUZRmKk+ryPnIteTK
MD5 SHA1 SHA512 SSDEEP

Submit Download

google_analytics.db-journal

Path /data/data/com.crossfield.namsterlife/databases/google_analytics.db-journal
Size 12KB
SHA256 d57390b70d62995c996889e8588a726c174a8c8d46c8c1a9bd9152d0d5ff15a2
MD5 16b13d753c132056aba762b3419b4b6d
SHA1 bc51f8435ade256fd9923384cb985f0e8c6e1315
SHA512 edf3dd1d672b2ed1ab749d4bff6c3a937b130c2c31c867a6e6ccb925abe1c86aa5df9a3bdbc739dd3dbc0b19a3a091668fbc1d015fd7607600a5bd2849f228a5
SSDEEP 96:7vUkW6sbe9TZmwlUZRmKk+ryPnIten2J6sbe9TZmwlUZRmKk+ryPnIteA:7vHh9NmwlUzmKfunh9NmwlUzmKfb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads