Analysis
- max time kernel
156s - max time network
181s - platform
android_x64 - resource
android-x64-arm64-20240611.1-en - resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system - submitted
16/06/2024, 09:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b2c8adbbd2f9aaae938c26a935f0142d_JaffaCakes118.apk
Resource
android-x86-arm-20240611.1-en
8 signatures
150 seconds
General
- Target b2c8adbbd2f9aaae938c26a935f0142d_JaffaCakes118.apk
- Size 12.9MB
- Sample240616-lfbabasbkl
- SHA256 6d405874cb780257772c75e412b990ab03f102fd82c605dc47dd4d39019db899
- MD5 b2c8adbbd2f9aaae938c26a935f0142d
- SHA1 e44ee1c90b5a22577d0fe952712fd7e4e0b8a04a
- SHA512 8d4ae1cde536466b74bb356a1ebf05b03e6ffa4e976f9e0a2d6737218fedc191e684629ecf11e476e8e499ad0a06d7441da86f4d4a7ebd2e7783e0935f3e2612
- SSDEEP 196608:y+POcDKGZREruERfQ7FXrOKyQH5yP3s3oqQVV/4rqd9Z+4tmDYvdzPiKoozGPXP1:VPfDvZ6rbY7hyQH5yN4QZ+emDmNBo0Q9
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Checks if the Android device is rooted. 1 TTPs 2 IoCs
ioc Process /system/app/Superuser.apk com.hkfdt.broker /system/app/Superuser.apk com.hkfdt.broker:core - Queries information about running processes on the device 1 TTPs 2 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.hkfdt.broker Framework service call android.app.IActivityManager.getRunningAppProcesses com.hkfdt.broker:core - Queries information about active data network 1 TTPs 2 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.hkfdt.broker Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.hkfdt.broker:core - Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.hkfdt.broker Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.hkfdt.broker:core - Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.hkfdt.broker:core Framework API call javax.crypto.Cipher.doFinal com.hkfdt.broker - Checks memory information 2 TTPs 2 IoCs
description ioc Process File opened for read /proc/meminfo com.hkfdt.broker File opened for read /proc/meminfo com.hkfdt.broker:core
Processes
-
com.hkfdt.broker1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:4417
-
com.hkfdt.broker:core1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
PID:4498
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/user/0/com.hkfdt.broker/app_crashrecord/1004
- Size 240B
- SHA256 42705ff9574eb62773b6b64df3c7beee623e14b25beb23b058b8c4658ff51742
- MD5 eab18c2722b8752f9a3421d319f06497
- SHA1 581db568b1f28d9ee4e74dbfa5679595d84d03dc
- SHA512 d995703fd1006687c3d87ccf567b6d89a8828049f12f6ba6ffe6c307fdfd0049ccfad3bd94c9b6be5d77d327926f1fd6a6bae231a830753c2cb55640c4696148
- MD5 SHA1 SHA512
- Path /data/user/0/com.hkfdt.broker/app_crashrecord/1004
- Size 20KB
- SHA256 294a42a27b7d4154a03cfead02198df749f0f05db92b2ea3c2b6993a342f8b85
- MD5 4d8603d52bcdd1baf81f01feb2a4b3ef
- SHA1 a2515dc51ef85837df1ad955e586090994c01110
- SHA512 8ec181b43b2a595a11f4372103b7793c63f67a8f94ae6b2547c8a7f8fc50a12a8fd727a7d93c17a01684180a26b4e40c75227e9708d4a1121efea6bd946580c9
- SSDEEP 48:TexX85WuAriStwwuMN5meposSP/cDKCiqvKKgACCiqvKKgtQ:6m53AzwPX3yKKgZ3yKKgtQ
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/com.hkfdt.broker/app_crashrecord/1004
- Size 58B
- SHA256 988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
- MD5 0d210bfb2a0e1f1b4c082a6a0f79de07
- SHA1 bb8ed9e364db79d1d9f2fcde3f15091893222faa
- SHA512 536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1
- MD5 SHA1 SHA512
- Path /data/user/0/com.hkfdt.broker/databases/bugly_db_
- Size 124KB
- SHA256 8a351c847780ed1321ab65926060c4d7d6d02f3b9ff00cf3c1a9553368f1ad24
- MD5 3f02bdb852a4b4d0eed4984c01376495
- SHA1 eae93db63d33e20a1b08c9a3bf52ed8015e1010c
- SHA512 62ddaeebc709ed26bfdeb9ec28ecf1db8458d9a10f01473c5a5d29e753b2af7fbc4041005eae09489025ee7557326b3265e66444a2ddc227c63ad897b2a692f9
- SSDEEP 768:1uQ1jkPbFt0PJizmaWcLHqG4HEVAW3ESx7NEFJAQ/qE3bLzwckMjK1q0jkPmFt0l:1uQkW6Mu0T
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/com.hkfdt.broker/databases/bugly_db_-journal
- Size 8KB
- SHA256 d2dd2a9b841f522e574dea9b0d6c66f621364c77e5c9c0ab1e45c4f4f0cc43de
- MD5 7d429febc4687ea75b9603b3be0d5135
- SHA1 121228893e41088d85a03935363b2203e69c4ade
- SHA512 2019f7cefd37ccdb7b2d23369679d17f8683894a7652829e294736e3aa67031f2cbdac8f1b6ee1f8b1852d0db6f8bbbf3abc598358c5936650677255a7838926
- SSDEEP 24:0qLLQDXBq5JQfs6y2nriS3dVi6fXX+McEnKwm/mpLwBpGSw:0qeX85WuAriStwwuMN5meposSw
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/com.hkfdt.broker/databases/bugly_db_-journal
- Size 8KB
- SHA256 205f68808937ab9804a20df71140c93e213df73fc8cb403235896fd147239d6b
- MD5 5c52cb070c6751dd22ab9e71d090db46
- SHA1 aa6344e6b8e829a58afea64d70f8cd8a90d65bdb
- SHA512 c1a77aab3599d48a9f62a129204b72d8c9c0c33ca6ec29be5fae945953751e0ef6b5b2998628573add80b84f2bbac69e79e9ace2d132699c854ae25d3775590d
- SSDEEP 24:7+tsqL9QmSXBq5JQfs6y2nriS3dVi6fXX+McEnKwm/mpLwBpGSR:7MsqjSX85WuAriStwwuMN5meposSR
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/com.hkfdt.broker/databases/bugly_db_-journal
- Size 12KB
- SHA256 69f0b20d97063852ff8103945353d5c3ffc2d80e3ca18ce58c3cebf42bfc30c6
- MD5 1f6b0a62a3ec70164528200a16be798b
- SHA1 fc5ae6c62492eac656a3b7420b916953231b5b64
- SHA512 d541073c61ef587a5b471b25db7aeb1474f09d5e08fcd193c3f65827475c9ce795d765111a3831f7fc30fa223c50e8f57bc9b9872da166514d6ca491c9307b78
- SSDEEP 24:7+t5GqLXQXXBq5JQfs6y2nriS3dVi6fXX+McEnKwm/mpLwBpGSiW:7M5GqeX85WuAriStwwuMN5meposS
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/com.hkfdt.broker/databases/bugly_db_-journal
- Size 512B
- SHA256 e935a1efba25888b88d78461a70bfb7f7895309b96a12d02f8648aaaed392bbe
- MD5 fe5e8924c3542cc7300832bc7cc21a4a
- SHA1 b958f4e09baa25c97868be834b877e21c9d7a93d
- SHA512 b69da92ce7a485aae076371c8ea80e648e13a6ee6a386f2b8f6ec7ff2de821537b77936b62d398b1b18cf9538db0ee6b5b741d891ab704873b10cdaabe91a1f5
- MD5 SHA1 SHA512
- Path /data/user/0/com.hkfdt.broker/databases/bugly_db_-journal
- Size 8KB
- SHA256 e5addeba0bf009b6edbb93147d71fb86768ce4d8197620c2cfbfb8e116ebcdb0
- MD5 af36bb4c1fd108379c8480d527d0f3be
- SHA1 029625c3ec0261205e179cbcb76b73858863a070
- SHA512 ea4e664e82bdacf3d71759b35c8fab6cd6b2e36dde9ff66cdddfc90e084800a6a187566629db48c62190f7989251212168fb934bd46528a417f62c6097a9f3ec
- SSDEEP 6:sGNeKEhuo9F2sUnumXQPB+MHsgv/1a6Vg9bNFlEuWdN/kPlOERX4PBX4ogLugMBz:7E4aMsSutnDRqLiuWdYRmBEyPbf
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/com.hkfdt.broker/databases/bugly_db_-journal
- Size 8KB
- SHA256 a1dc2cf0464d70ed3634b62384382a93c976ebad9ab7e2162b0785c51c66e9cd
- MD5 bd9f52bcc3fbf3205adfd149f70f7fa3
- SHA1 08e7e2b9ff4abb966bf89e5bd3fe1604f70e3568
- SHA512 e77cb50ffdf680ec7baec0be8643b5b9b216e64f66437a9348d923a1a2599df1893a4530fff0e05ea1c427e7de6300d0fb68198fddde933fa5a5e0bc920b7aee
- SSDEEP 6:sGAXog9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKOM/n9:AoqLJdeWRmBEyPb6n9
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/com.hkfdt.broker/files/TDtcagent.db
- Size 32KB
- SHA256 39e889c17d538a2c678ef8a75938e22d00cd2eaab12bce7ba33656d601cfe4d8
- MD5 7a0d17d14769a8c915b4f00c6a50cc27
- SHA1 6395648e90d804e2242b18284052d728f8aa52c7
- SHA512 8268ea928585f389cf75f7a17c532ef51b89e39915e8ae9606c7ed5a6560128d8d3231404cfb504abd30320c4485b1563e2f206999c214929f4d55d2b49d83ad
- SSDEEP 96:Ntg8ql8Ud/gpWWW3TFsQoauvtuZrmz3av93/:M8q/Bedxyv
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/com.hkfdt.broker/files/TDtcagent.db-journal
- Size 512B
- SHA256 91f24c1a7ce5205e34059d604ba8fc5fde66734c23b1487f5745c9bd3623d53e
- MD5 01d27c8fc9079107f71245ed18a5f0b7
- SHA1 4c690f223145c047a222af34e4153ac134587610
- SHA512 a4d32b89e8ffdc558f2c48c48e143cee5a19e5df64f6614c1192e6ec904bc0ea9d1d6ee2a3df68aacb08884c0068c68d9fae5cee7be9122d461923a80b496209
- MD5 SHA1 SHA512
- Path /data/user/0/com.hkfdt.broker/files/TDtcagent.db-journal
- Size 8KB
- SHA256 d92a124248de3629b3246881818e93deecb06a4ce5deac46b775b4971f2aea01
- MD5 a953711becb9dd3ced4abac27ed65cb7
- SHA1 f3872595c90f7681376429f91d2cdc828a37995a
- SHA512 b322c021c93ff13d17f346d6ec4fbbd282b2c14fb6182013df8412a180ee4c1b38361d5716e8188a8168c89da14b9b43ea012eea3a5274258fa6bc0a2bf5cc27
- SSDEEP 6:7+/l9qSFn1ing9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKaK:7+tsSunqLiuWdYRmBEyPb9K
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/com.hkfdt.broker/files/TDtcagent.db-journal
- Size 4KB
- SHA256 93b2ae6649ef8cc08ba1b67807d1ea0dc04a0645145bfbf69cad1fed43a5ab6b
- MD5 2d046a03e264209831e8d650e684b694
- SHA1 02d84166a2ab431977d711ec645f71d09308dd28
- SHA512 156ddaf373c7551c8a32dba8526a322315d01e0cdb850f39b1c8ec1a017ccf84a8c1e95998750af400a7eaa71d34b5a95c94623c912f4b5593fb3cc674e31d4d
- SSDEEP 6:7+/lNyPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuK1:7+tNGqLJdeWRmBEyPbi
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/com.hkfdt.broker/files/TDtcagent.db-journal
- Size 8KB
- SHA256 936abe2a80ebfa2c23c0c7faecbb56b1f3bbb01bd1a5ca2a68b64783f560b243
- MD5 c548ec2c01ac5fb501a3d3291109198f
- SHA1 4eff138e68837650cdd9bed3f82285d42f23dd10
- SHA512 e610a1bbd270bc9aaa06b6a7728c2eee390ec841bcd00790d56ae43926a4466749df03044e05aa50fc90e74e8abf46c995a1f13c1068603bb7740e30343c5822
- SSDEEP 6:7+/l9JllmHPg9bNFlqhrb/kPlOERX4PBX4ogLugMBX4suuKClM/b:7+tfwqLmORmBEyPbVSb
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/com.hkfdt.broker/files/TDtcagent.db-journal
- Size 8KB
- SHA256 0a517a9c35961d87398f4c885e66a16c00d36e0c344bfd69bd859dd9c84aa594
- MD5 fedb5520efed81d4ac95d46393915c12
- SHA1 ffe3429b0b58a39d51f19c33d2ad81f2440e0790
- SHA512 7423024b3b737195e465ef1064a18eb779cb0b4ddc570096136a256374f11cebb74f12547cd89f9cbd4b50a3288b5aa09fc4d4d147b25dd16e330ab8518eaafd
- SSDEEP 12:7+tFanqLyT9QyNTSFby/8UxF9/gpvRmBEyPbD9:7+tcqLyT7l8Uxz/gpEGSp
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/com.hkfdt.broker/files/TDtcagent.db-journal
- Size 12KB
- SHA256 f57e8a7c83ea87e20c017b88ba23150034b853f053d45954bca3c1dcd6a9b03f
- MD5 f03b2dc63a4eb5dca3c62f4f4d11a7f4
- SHA1 3dd2990e5335cfd479f8bafd69bb5eb2783695bc
- SHA512 2a39ed8ae552be957c0124f263a467934dd5d65e3d3fd6dfaf5c690366fab81883247853d9c86531b8a7802d3d30498edc45865c29700cf2ee291e90ac82e2c8
- SSDEEP 24:7+tEqLD3nxeb0TDHYB0ECWYqlBl8Uxz/gpEGSlD:7MEqHxeYTDHY8qlBaUd/gpTSlD
- MD5 SHA1 SHA512 SSDEEP
- Path /storage/emulated/0/.tcookieid
- Size 33B
- SHA256 b1bee0c371493d27741dc2cdb813e85e7311d9d8d1e5f3a77da72ac5afc91109
- MD5 4374f14ab5f8542d1e07618b64566a8a
- SHA1 3136e51e2f61ea34ef9cbc4944b9a20a831a3e11
- SHA512 8c00f4e5b2fa3021b532435669b461e80771f72ea985f8b3897717d62bad4c6263f7416650a7a764f68a78b85a73733464ec1be986a02f648bae182c4148ed7c
- MD5 SHA1 SHA512
- Path /storage/emulated/0/Android/data/com.hkfdt.broker/files/tbslog/tbslog.txt
- Size 4KB
- SHA256 5262a2df36c74120f4fdbd131c8b1afafed6f84f74c070ca20fffcfa47a00089
- MD5 21120ff445ccd84def70602f76fe0c27
- SHA1 e52ad89b5080f0c955b41bf806c5ac8d0675c155
- SHA512 0d8f61eeda70ff72f4f0a97097c5c49facf54bff0dc8eafc3c86ae34c87e2d13e5b81c9fd11e872067747733c00a62e47e56e419ed3772d9727ebe831745e2aa
- SSDEEP 24:Neigext8ppKeJoICKeYfgSYsgKeufgQHJ:NzgAtKQIoaXgSYs/NgCJ
- MD5 SHA1 SHA512 SSDEEP
- Path /storage/emulated/0/Android/data/com.hkfdt.broker/files/tbslog/tbslog.txt (deleted)
- Size 3KB
- SHA256 91c1aa8996e39d226bbf4b03caf0cbe5d154fd1116b41dcd17223eb01f2f5d1f
- MD5 1b9e70f3c2e177b71906d6d5b22ef2d6
- SHA1 91f2e0866c222d07d09c7f431867b9116b27c4f2
- SHA512 7e23712499feb1e8ccb8fa4b131e686dfcd74ae7434cdb20e32cd3e2319f4542c60e23432cecac02cb96fc84bc4ebe129036f963a9b2a1d86512d2a5d1a670ba
- MD5 SHA1 SHA512
- Path /storage/emulated/0/FDT/im_file/FDTSecuritiesCN/log/nim_sdk.log
- Size 95B
- SHA256 e193263bb56cae5a27750dddcc32afc8f0ab5188a44b54a76d451fa866a463f6
- MD5 43804d9cc902eaec037d6305c1310a5d
- SHA1 67441e22ddfe5a5b961dad529527da54f096db16
- SHA512 93d35ee37fa95d6e877e137c4287c83d3536ee53eaa4ab419b712b762d99e2531ed60469f88a781b29c4c1c49e68acd840021571a459ec7b87f882a9e198566f
- MD5 SHA1 SHA512
- Path /storage/emulated/0/FDT/im_file/FDTSecuritiesCN/log/nim_sdk.log
- Size 220B
- SHA256 8375f91d278d44f63eb86aa5f2aeef690c856d623a3e2cd8f7e3108d4ece20c0
- MD5 0f62b240c5c61e230eaa8ca1a7bdcd6c
- SHA1 352bf1cc85b71401f8bd25f29ba659eddf169cab
- SHA512 9e1e0da199c6e3a333a4f46b81db8976ac8dbcf7f87e671ee047053c5079f0ee7958bb2afed8e6bd3083e889aca01fe025338e3a2dcdf7bb2f556fadd5eba7e1
- MD5 SHA1 SHA512
- Path /storage/emulated/0/FDT/im_file/FDTSecuritiesCN/log/nim_sdk.log
- Size 127B
- SHA256 165096bb796c8fa9ee191e243df69739f05394ffcba60d1aca99dac3a623f22c
- MD5 9a19d1547e052e64978025cfb6377211
- SHA1 16b601f4ada99ec9aa001bc36db6c5361d9202dd
- SHA512 2b2fef0c11639015ada59ac00b801b115497203a67bb2d4aef1cb1cf5f865831cb8052994be88028d4ae9017283949d7c6135e353daccb5eac15129cecf3683c
- MD5 SHA1 SHA512
- Path /storage/emulated/0/FDT/im_file/FDTSecuritiesCN/log/nim_sdk.log
- Size 78B
- SHA256 a9af751a334260b80a066329d83960b931bece7c10c889b7fa3f35508c5ef71d
- MD5 684f0da1aaaf20ce11e603cc4fd78c24
- SHA1 5da78bfa39e5e4d4134d252ff677f6a625200226
- SHA512 c3a53de79314b554ebd87ab63d4e89a90ba99a6d523a3a10d7ff1548e6d00272a578baef58eb894e1478b7fcb462fd889c5663d269eeb288103ef232cf63d520
- MD5 SHA1 SHA512
- Path /storage/emulated/0/FDT/im_file/FDTSecuritiesCN/log/nim_sdk.log
- Size 55B
- SHA256 934d3519fe91cc56b4e4347bbf4a5eddaa99f1aeac1d52e0c63b35c67bf8b551
- MD5 2fd16615fafba37970feb0f636189d75
- SHA1 a9968c7e360151934985969aa3393872981f8102
- SHA512 03184723a5c026b9d124bfb09b919f458b1963640f29ea106d4cbfed0ebdab8c7f34cd0b83699abf53a2d31e1359691c37a00ca617c8c134112d28b7d71c6d62
- MD5 SHA1 SHA512
- Path /storage/emulated/0/FDT/im_file/FDTSecuritiesCN/log/nim_sdk.log
- Size 151B
- SHA256 b23e00bf1b3b4b3bb85b3cf882a825159b7f9a165f326883e39a1fafa55ead86
- MD5 4dea08b227db002a19c2722b48f516c0
- SHA1 f5ce7d8bb7b9ba53a5c935ab6008b3e8603182fc
- SHA512 dc2aec17496c3f3a2112d5976f49f0bdfc9c8e9fd3421c2f06725003459383b7e564d6c221b309075177202ff998edcb8378dd92364eedb81b652837f6f4c1dc
- MD5 SHA1 SHA512
- Path /storage/emulated/0/FDT/im_file/FDTSecuritiesCN/log/nim_sdk.log
- Size 8KB
- SHA256 9aee8529611b61afce59a83d2587c3652aaf47a38b7bf13a1bcf167aef13a43b
- MD5 f69aab44af38a1a3e9c073b60da7cc6d
- SHA1 32ee0336ae78ab216427dc0f03af12c75874ea94
- SHA512 dfdfe18ff80d6ab844907cda1657f36d4842c8055511431569010b4d9a8b326f40eeb00472121aba295754591afa1984cfb4c9d34a299c96314c57cb75f9b10d
- SSDEEP 24:7+t5JlqLHUXBq5JQfs6y2nriS3dVi6fXX+McEnKwm/mpLwBpGSI:7M5JlqQX85WuAriStwwuMN5meposSI
- MD5 SHA1 SHA512 SSDEEP
- Path /storage/emulated/0/FDT/im_file/FDTSecuritiesCN/log/nim_sdk.log
- Size 8KB
- SHA256 311a21c8d4d53c57cf961f55f7b0429e21f293edc0afd8724de1849c3b0e3601
- MD5 7c88f32dcebcaa55c7a51403b23c7477
- SHA1 1cda5bc6300b8f77e35a9f45e3f7e6a470e658d1
- SHA512 7f598919b5642c860afa519a28de2963e559292c4728965782febcb44bca9d6186d851c041e222efe15dfc2acae6ac1efc22fa4072f2fb032d0429c1f072aa87
- SSDEEP 24:7+twAzVnqL6t9XBq5JQfs6y2nriS3dVi6fXX+McEnKwm/mpLwBpGSH:7MwcVnq27X85WuAriStwwuMN5meposSH
- MD5 SHA1 SHA512 SSDEEP