Analysis

  • max time kernel
    156s
  • max time network
    181s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240611.1-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
  • submitted
    16/06/2024, 09:28

General

  • Target
    b2c8adbbd2f9aaae938c26a935f0142d_JaffaCakes118.apk
  • Size 12.9MB
  • Sample240616-lfbabasbkl
  • SHA256 6d405874cb780257772c75e412b990ab03f102fd82c605dc47dd4d39019db899
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 2 IoCs
  • Queries information about running processes on the device 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about active data network 1 TTPs 2 IoCs
  • Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs
  • Checks memory information 2 TTPs 2 IoCs

Processes

  • com.hkfdt.broker
    1⤵
    • Checks if the Android device is rooted.
    • Queries information about running processes on the device
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks memory information
    PID:4417
  • com.hkfdt.broker:core
    1⤵
    • Checks if the Android device is rooted.
    • Queries information about running processes on the device
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks memory information
    PID:4498

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        1004

        • Path /data/user/0/com.hkfdt.broker/app_crashrecord/1004
        • Size 240B
        • SHA256 42705ff9574eb62773b6b64df3c7beee623e14b25beb23b058b8c4658ff51742
        • MD5 SHA1 SHA512

        1004

        • Path /data/user/0/com.hkfdt.broker/app_crashrecord/1004
        • Size 20KB
        • SHA256 294a42a27b7d4154a03cfead02198df749f0f05db92b2ea3c2b6993a342f8b85
        • MD5 SHA1 SHA512 SSDEEP

        1004

        • Path /data/user/0/com.hkfdt.broker/app_crashrecord/1004
        • Size 58B
        • SHA256 988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
        • MD5 SHA1 SHA512

        bugly_db_

        • Path /data/user/0/com.hkfdt.broker/databases/bugly_db_
        • Size 124KB
        • SHA256 8a351c847780ed1321ab65926060c4d7d6d02f3b9ff00cf3c1a9553368f1ad24
        • MD5 SHA1 SHA512 SSDEEP

        bugly_db_-journal

        • Path /data/user/0/com.hkfdt.broker/databases/bugly_db_-journal
        • Size 8KB
        • SHA256 d2dd2a9b841f522e574dea9b0d6c66f621364c77e5c9c0ab1e45c4f4f0cc43de
        • MD5 SHA1 SHA512 SSDEEP

        bugly_db_-journal

        • Path /data/user/0/com.hkfdt.broker/databases/bugly_db_-journal
        • Size 8KB
        • SHA256 205f68808937ab9804a20df71140c93e213df73fc8cb403235896fd147239d6b
        • MD5 SHA1 SHA512 SSDEEP

        bugly_db_-journal

        • Path /data/user/0/com.hkfdt.broker/databases/bugly_db_-journal
        • Size 12KB
        • SHA256 69f0b20d97063852ff8103945353d5c3ffc2d80e3ca18ce58c3cebf42bfc30c6
        • MD5 SHA1 SHA512 SSDEEP

        bugly_db_-journal

        • Path /data/user/0/com.hkfdt.broker/databases/bugly_db_-journal
        • Size 512B
        • SHA256 e935a1efba25888b88d78461a70bfb7f7895309b96a12d02f8648aaaed392bbe
        • MD5 SHA1 SHA512

        bugly_db_-journal

        • Path /data/user/0/com.hkfdt.broker/databases/bugly_db_-journal
        • Size 8KB
        • SHA256 e5addeba0bf009b6edbb93147d71fb86768ce4d8197620c2cfbfb8e116ebcdb0
        • MD5 SHA1 SHA512 SSDEEP

        bugly_db_-journal

        • Path /data/user/0/com.hkfdt.broker/databases/bugly_db_-journal
        • Size 8KB
        • SHA256 a1dc2cf0464d70ed3634b62384382a93c976ebad9ab7e2162b0785c51c66e9cd
        • MD5 SHA1 SHA512 SSDEEP

        TDtcagent.db

        • Path /data/user/0/com.hkfdt.broker/files/TDtcagent.db
        • Size 32KB
        • SHA256 39e889c17d538a2c678ef8a75938e22d00cd2eaab12bce7ba33656d601cfe4d8
        • MD5 SHA1 SHA512 SSDEEP

        TDtcagent.db-journal

        • Path /data/user/0/com.hkfdt.broker/files/TDtcagent.db-journal
        • Size 512B
        • SHA256 91f24c1a7ce5205e34059d604ba8fc5fde66734c23b1487f5745c9bd3623d53e
        • MD5 SHA1 SHA512

        TDtcagent.db-journal

        • Path /data/user/0/com.hkfdt.broker/files/TDtcagent.db-journal
        • Size 8KB
        • SHA256 d92a124248de3629b3246881818e93deecb06a4ce5deac46b775b4971f2aea01
        • MD5 SHA1 SHA512 SSDEEP

        TDtcagent.db-journal

        • Path /data/user/0/com.hkfdt.broker/files/TDtcagent.db-journal
        • Size 4KB
        • SHA256 93b2ae6649ef8cc08ba1b67807d1ea0dc04a0645145bfbf69cad1fed43a5ab6b
        • MD5 SHA1 SHA512 SSDEEP

        TDtcagent.db-journal

        • Path /data/user/0/com.hkfdt.broker/files/TDtcagent.db-journal
        • Size 8KB
        • SHA256 936abe2a80ebfa2c23c0c7faecbb56b1f3bbb01bd1a5ca2a68b64783f560b243
        • MD5 SHA1 SHA512 SSDEEP

        TDtcagent.db-journal

        • Path /data/user/0/com.hkfdt.broker/files/TDtcagent.db-journal
        • Size 8KB
        • SHA256 0a517a9c35961d87398f4c885e66a16c00d36e0c344bfd69bd859dd9c84aa594
        • MD5 SHA1 SHA512 SSDEEP

        TDtcagent.db-journal

        • Path /data/user/0/com.hkfdt.broker/files/TDtcagent.db-journal
        • Size 12KB
        • SHA256 f57e8a7c83ea87e20c017b88ba23150034b853f053d45954bca3c1dcd6a9b03f
        • MD5 SHA1 SHA512 SSDEEP

        .tcookieid

        • Path /storage/emulated/0/.tcookieid
        • Size 33B
        • SHA256 b1bee0c371493d27741dc2cdb813e85e7311d9d8d1e5f3a77da72ac5afc91109
        • MD5 SHA1 SHA512

        tbslog.txt

        • Path /storage/emulated/0/Android/data/com.hkfdt.broker/files/tbslog/tbslog.txt
        • Size 4KB
        • SHA256 5262a2df36c74120f4fdbd131c8b1afafed6f84f74c070ca20fffcfa47a00089
        • MD5 SHA1 SHA512 SSDEEP

        tbslog.txt (deleted)

        • Path /storage/emulated/0/Android/data/com.hkfdt.broker/files/tbslog/tbslog.txt (deleted)
        • Size 3KB
        • SHA256 91c1aa8996e39d226bbf4b03caf0cbe5d154fd1116b41dcd17223eb01f2f5d1f
        • MD5 SHA1 SHA512

        nim_sdk.log

        • Path /storage/emulated/0/FDT/im_file/FDTSecuritiesCN/log/nim_sdk.log
        • Size 95B
        • SHA256 e193263bb56cae5a27750dddcc32afc8f0ab5188a44b54a76d451fa866a463f6
        • MD5 SHA1 SHA512

        nim_sdk.log

        • Path /storage/emulated/0/FDT/im_file/FDTSecuritiesCN/log/nim_sdk.log
        • Size 220B
        • SHA256 8375f91d278d44f63eb86aa5f2aeef690c856d623a3e2cd8f7e3108d4ece20c0
        • MD5 SHA1 SHA512

        nim_sdk.log

        • Path /storage/emulated/0/FDT/im_file/FDTSecuritiesCN/log/nim_sdk.log
        • Size 127B
        • SHA256 165096bb796c8fa9ee191e243df69739f05394ffcba60d1aca99dac3a623f22c
        • MD5 SHA1 SHA512

        nim_sdk.log

        • Path /storage/emulated/0/FDT/im_file/FDTSecuritiesCN/log/nim_sdk.log
        • Size 78B
        • SHA256 a9af751a334260b80a066329d83960b931bece7c10c889b7fa3f35508c5ef71d
        • MD5 SHA1 SHA512

        nim_sdk.log

        • Path /storage/emulated/0/FDT/im_file/FDTSecuritiesCN/log/nim_sdk.log
        • Size 55B
        • SHA256 934d3519fe91cc56b4e4347bbf4a5eddaa99f1aeac1d52e0c63b35c67bf8b551
        • MD5 SHA1 SHA512

        nim_sdk.log

        • Path /storage/emulated/0/FDT/im_file/FDTSecuritiesCN/log/nim_sdk.log
        • Size 151B
        • SHA256 b23e00bf1b3b4b3bb85b3cf882a825159b7f9a165f326883e39a1fafa55ead86
        • MD5 SHA1 SHA512

        nim_sdk.log

        • Path /storage/emulated/0/FDT/im_file/FDTSecuritiesCN/log/nim_sdk.log
        • Size 8KB
        • SHA256 9aee8529611b61afce59a83d2587c3652aaf47a38b7bf13a1bcf167aef13a43b
        • MD5 SHA1 SHA512 SSDEEP

        nim_sdk.log

        • Path /storage/emulated/0/FDT/im_file/FDTSecuritiesCN/log/nim_sdk.log
        • Size 8KB
        • SHA256 311a21c8d4d53c57cf961f55f7b0429e21f293edc0afd8724de1849c3b0e3601
        • MD5 SHA1 SHA512 SSDEEP