Analysis Overview
SHA256
9257345f42daab05d6d80988f1cc76a76f15364eabe083347cebc98d97decad0
Threat Level: Likely malicious
The file b48b5ce7ba4c2a0ccf0d83888d88874f_JaffaCakes118 was found to be: Likely malicious.
Malicious Activity Summary
Removes its main activity from the application launcher
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
Checks Android system properties for emulator presence.
Loads dropped Dex/Jar
Obtains sensitive information copied to the device clipboard
Queries the unique device ID (IMEI, MEID, IMSI)
Requests dangerous framework permissions
Queries the mobile country code (MCC)
Registers a broadcast receiver at runtime (usually for listening for system events)
Uses Crypto APIs (Might try to encrypt user data)
Checks memory information
MITRE ATT&CK Matrix
Analysis: static1
Detonation Overview
Reported
2024-06-16 18:22
Signatures
Requests dangerous framework permissions
| Description | Indicator | Process | Target |
| Allows an application to write to external storage. | android.permission.WRITE_EXTERNAL_STORAGE | N/A | N/A |
| Allows access to the list of accounts in the Accounts Service. | android.permission.GET_ACCOUNTS | N/A | N/A |
| Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. | android.permission.SYSTEM_ALERT_WINDOW | N/A | N/A |
| Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. | android.permission.READ_PHONE_STATE | N/A | N/A |
| Allows access to the list of accounts in the Accounts Service. | android.permission.GET_ACCOUNTS | N/A | N/A |
| Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. | android.permission.SYSTEM_ALERT_WINDOW | N/A | N/A |
| Allows an application to write to external storage. | android.permission.WRITE_EXTERNAL_STORAGE | N/A | N/A |
| Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. | android.permission.READ_PHONE_STATE | N/A | N/A |
| Allows access to the list of accounts in the Accounts Service. | android.permission.GET_ACCOUNTS | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-16 18:22
Reported
2024-06-16 18:25
Platform
android-x86-arm-20240611.1-en
Max time kernel
179s
Max time network
131s
Command Line
Signatures
Removes its main activity from the application launcher
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Checks Android system properties for emulator presence.
| Description | Indicator | Process | Target |
| Accessed system property | key: ro.product.model | N/A | N/A |
Loads dropped Dex/Jar
| Description | Indicator | Process | Target |
| N/A | /data/user/0/com.example.testdex/app_ttmp/t.jar | N/A | N/A |
| N/A | /data/user/0/com.example.testdex/app_ttmp/t.jar | N/A | N/A |
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
Queries the mobile country code (MCC)
| Description | Indicator | Process | Target |
| Framework service call | com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone | N/A | N/A |
Registers a broadcast receiver at runtime (usually for listening for system events)
| Description | Indicator | Process | Target |
| Framework service call | android.app.IActivityManager.registerReceiver | N/A | N/A |
Uses Crypto APIs (Might try to encrypt user data)
| Description | Indicator | Process | Target |
| Framework API call | javax.crypto.Cipher.doFinal | N/A | N/A |
Checks memory information
| Description | Indicator | Process | Target |
| File opened for read | /proc/meminfo | N/A | N/A |
Processes
com.example.testdex
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.example.testdex/app_ttmp/t.jar --output-vdex-fd=49 --oat-fd=50 --oat-location=/data/user/0/com.example.testdex/app_ttmp/oat/x86/t.odex --compiler-filter=quicken --class-loader-context=&
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| GB | 216.58.212.234:443 | tcp | |
| US | 1.1.1.1:53 | semanticlocation-pa.googleapis.com | udp |
| US | 1.1.1.1:53 | a.asense.in | udp |
| US | 208.100.26.245:80 | a.asense.in | tcp |
| GB | 142.250.187.206:443 | tcp | |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 142.250.200.46:443 | android.apis.google.com | tcp |
| GB | 216.58.212.202:443 | tcp |
Files
/data/data/com.example.testdex/100classes.dex
| MD5 | 871748595bf8912a62a16ccc88fe1d87 |
| SHA1 | 4af9633ecf9e61aa79fb3aeb3d295a9c4ebe9596 |
| SHA256 | 0d4961513ff3b8bea46b00c367f280e290003d3216fc281bd7f05861a4afc0e3 |
| SHA512 | 55976b804e6f299e656716a5ff6ca9a2d5ee5335f1edb94fbef0ae012dd616eae2c99ac6af18ba202a5861763b7b159b4c0272a75fd14927c80ffbfdac9281bc |
/data/data/com.example.testdex/app_ttmp/t.jar
| MD5 | e3447d5435bc33cb03183a57f3474f1e |
| SHA1 | 13b41650892f79bff94f3edf8689c3218ba962d0 |
| SHA256 | 8eabaa1e5b64a753f5aeeee5e02ce584ab8e65c5edfc5e3bdf38f25462024dc9 |
| SHA512 | e4e7906b57056c413942ea3f5fa91cf3bc5f508a2e9c8273524c0cf84d7189f26b770f0130f57218ecba8982ac337f46a6d11d10dd8f8dc4f5f0c0fa02447ab6 |
/data/user/0/com.example.testdex/app_ttmp/t.jar
| MD5 | 4e1e6aa783bb8974b1436f0100156de6 |
| SHA1 | 8d2d20dbf86960783c889dd9834e281bac850642 |
| SHA256 | 58665fea32655b49869f9f7e6812f36906cd75dbe4af3f1d497e9bdeaf33fc53 |
| SHA512 | 0a45ddb1269a3cd8a789ce3b9edef67e69c2968480938aac76e9e975c4cce049a42ebbcf0cf4058eef117e1041a1e7a8f15d504c5a9ca95b1b3d014ca91aadbf |
/data/user/0/com.example.testdex/app_ttmp/t.jar
| MD5 | 73b590f8bfdd3d17d710d7b4969592e8 |
| SHA1 | 8b211d7488ba8023c2982d2bc3bb71405245d01b |
| SHA256 | d6901db366b8f33db6af0d33225c19caa6723719264fafd52cda172119e38e4e |
| SHA512 | 7e1a5a6b97e7b3b927ac88749dfb0a59e87a00f27693e0c7909d6e6130696f5bc3bc1d26bf5de480ab14550a198c3a3cab8ffdc59cacb8cf9f2ce109ac67487b |
/data/data/com.example.testdex/databases/com.example.testdexb-journal
| MD5 | c26f4742cae9d782156b05a209b5d3a7 |
| SHA1 | 2b6cb802d88fea23470941b20e2637627ca1b8b7 |
| SHA256 | aaef0b02c16dd9c4d22fb51cec4b9489f3bb3df94c82175b2807f604eae0b02b |
| SHA512 | b1765b78d7cc1b43071089bc16a9bd988a24a78d91b9daaffafbd4fbdd4fc1a55735cc68a5c0aae1ccc2075803162eee728ef0c3e774ccac9ef871258d3ce088 |
/data/data/com.example.testdex/databases/com.example.testdexb
| MD5 | f2b4b0190b9f384ca885f0c8c9b14700 |
| SHA1 | 934ff2646757b5b6e7f20f6a0aa76c7f995d9361 |
| SHA256 | 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514 |
| SHA512 | ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1 |
/data/data/com.example.testdex/databases/com.example.testdexb-shm
| MD5 | bb7df04e1b0a2570657527a7e108ae23 |
| SHA1 | 5188431849b4613152fd7bdba6a3ff0a4fd6424b |
| SHA256 | c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479 |
| SHA512 | 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012 |
/data/data/com.example.testdex/databases/com.example.testdexb-wal
| MD5 | f75237fcdf7a903384134bd47924cf1c |
| SHA1 | 1b2f6349ee9b2f98ae5398aa3702d6d1c6904d5c |
| SHA256 | f9a7a941900c7c662c27178cff7747b4caa1f102ad1e884ebc0ea59094e89515 |
| SHA512 | d8f36512ca9fc3e557f773911565bdafbc4949b71d1e64d0ff6f2653011e1fb3fee8aa5c8ef370164260d319fbc3b473f20e3624fb65e0d62fdce739c43c0f82 |
/data/data/com.example.testdex/app_ttmp/oat/t.jar.cur.prof
| MD5 | c1cb31860f8837ee9732d6a58d93de11 |
| SHA1 | e9736099e0b0d8f9dff106480664ded23be1175c |
| SHA256 | 2ddd6438bcc6b8e525211949e2d8d81b3c6e0022f9ce7fe1c2a5425fa5121337 |
| SHA512 | 94ca48687c169edba281f1b477dc7470b3142e23ea30c5a533ff9426e8884dc689ace9c9d3ce6c478a045e402ac9d8487769ca0b6f979d104870d2b9c1343d08 |
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-16 18:22
Reported
2024-06-16 18:25
Platform
android-x64-20240611.1-en
Max time kernel
179s
Max time network
131s
Command Line
Signatures
Removes its main activity from the application launcher
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Loads dropped Dex/Jar
| Description | Indicator | Process | Target |
| N/A | /data/user/0/com.example.testdex/app_ttmp/t.jar | N/A | N/A |
Obtains sensitive information copied to the device clipboard
| Description | Indicator | Process | Target |
| Framework service call | android.content.IClipboard.addPrimaryClipChangedListener | N/A | N/A |
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
Queries the mobile country code (MCC)
| Description | Indicator | Process | Target |
| Framework service call | com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone | N/A | N/A |
Queries the unique device ID (IMEI, MEID, IMSI)
Registers a broadcast receiver at runtime (usually for listening for system events)
| Description | Indicator | Process | Target |
| Framework service call | android.app.IActivityManager.registerReceiver | N/A | N/A |
Uses Crypto APIs (Might try to encrypt user data)
| Description | Indicator | Process | Target |
| Framework API call | javax.crypto.Cipher.doFinal | N/A | N/A |
Checks memory information
| Description | Indicator | Process | Target |
| File opened for read | /proc/meminfo | N/A | N/A |
Processes
com.example.testdex
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| US | 1.1.1.1:53 | ssl.google-analytics.com | udp |
| GB | 142.250.179.232:443 | ssl.google-analytics.com | tcp |
| US | 1.1.1.1:53 | a.asense.in | udp |
| US | 208.100.26.245:80 | a.asense.in | tcp |
| US | 1.1.1.1:53 | android.apis.google.com | udp |
| GB | 216.58.201.110:443 | android.apis.google.com | tcp |
| GB | 142.250.178.14:443 | tcp | |
| GB | 142.250.187.226:443 | tcp | |
| GB | 142.250.179.228:443 | tcp | |
| GB | 142.250.179.228:443 | tcp | |
| GB | 216.58.204.78:443 | tcp |
Files
/data/data/com.example.testdex/100classes.dex
| MD5 | 871748595bf8912a62a16ccc88fe1d87 |
| SHA1 | 4af9633ecf9e61aa79fb3aeb3d295a9c4ebe9596 |
| SHA256 | 0d4961513ff3b8bea46b00c367f280e290003d3216fc281bd7f05861a4afc0e3 |
| SHA512 | 55976b804e6f299e656716a5ff6ca9a2d5ee5335f1edb94fbef0ae012dd616eae2c99ac6af18ba202a5861763b7b159b4c0272a75fd14927c80ffbfdac9281bc |
/data/data/com.example.testdex/app_ttmp/t.jar
| MD5 | e3447d5435bc33cb03183a57f3474f1e |
| SHA1 | 13b41650892f79bff94f3edf8689c3218ba962d0 |
| SHA256 | 8eabaa1e5b64a753f5aeeee5e02ce584ab8e65c5edfc5e3bdf38f25462024dc9 |
| SHA512 | e4e7906b57056c413942ea3f5fa91cf3bc5f508a2e9c8273524c0cf84d7189f26b770f0130f57218ecba8982ac337f46a6d11d10dd8f8dc4f5f0c0fa02447ab6 |
/data/user/0/com.example.testdex/app_ttmp/t.jar
| MD5 | 4e1e6aa783bb8974b1436f0100156de6 |
| SHA1 | 8d2d20dbf86960783c889dd9834e281bac850642 |
| SHA256 | 58665fea32655b49869f9f7e6812f36906cd75dbe4af3f1d497e9bdeaf33fc53 |
| SHA512 | 0a45ddb1269a3cd8a789ce3b9edef67e69c2968480938aac76e9e975c4cce049a42ebbcf0cf4058eef117e1041a1e7a8f15d504c5a9ca95b1b3d014ca91aadbf |
/data/data/com.example.testdex/databases/com.example.testdexb-journal
| MD5 | b04a1546eb3a691582315299a3bbbc09 |
| SHA1 | 78891d9c603db56471ae8d10fe631124b83eb93e |
| SHA256 | a99a83dbc7b9250d72627ecba9f0629ee5e3e37344a90c4d1788c5da32bc923a |
| SHA512 | 991f1410a46f6766de252259a563c2d65a2d16f5544d3a8c2ca87a190dbab84004e145f4d8d6110d09c7d7e9a5a2068decd3eb5f9191c83078f02cb28eaba6a3 |
/data/data/com.example.testdex/databases/com.example.testdexb
| MD5 | e272f5c7076521d7f27ce22d6143609c |
| SHA1 | 3e034264dd61394378ecccc8f1705ad9af773891 |
| SHA256 | 6e13cea57c6b3ad60b20e7c6ef0ab8083677be4700a97af4a1c466d52b022330 |
| SHA512 | 50dd1c3a2846a5f4263f436f7a395757364ad3a730e451fd7cd143a5d9b3a270786a430ba90ec978e8bca8bc366fe09f336b209d8948d95783c2a80d06590e51 |
/data/data/com.example.testdex/databases/com.example.testdexb-journal
| MD5 | 9bd36c4a9e5119d2b7d36d305d3255df |
| SHA1 | d145ad14a2c115354ea563f12c3e995f6b969ddd |
| SHA256 | 9e94a5dfaef34c165272f23109adaf7c9913c6ac80e049d90ead43d87379526e |
| SHA512 | 4ca85a2582943c7e44c137063241c74dbbc34161dad0ec2085fe4c88eabe95136ff2d7fe58bab3d7548f9427612edbe75e5c41dce8c46b2d5acfffe3551c5b07 |
/data/data/com.example.testdex/databases/com.example.testdexb-journal
| MD5 | cfc34d489c45c4dde782138a3ee778c6 |
| SHA1 | 6898474f7346a741f55ea3c0abde9ab93631d8b8 |
| SHA256 | c8a307370c37291a01615a197fe8b6b58a919d3b94a05e3c803390c916349c15 |
| SHA512 | ebc3dcc73c7c4f94ea24a25f6f6b5d11513959329f27f9983424a5b14691dedd25c80a9815c3aeb5969c71a220851ce025934c7c8f23c5b6f87d4a824ddb44d4 |
/data/data/com.example.testdex/databases/com.example.testdexb-journal
| MD5 | 5b28e3b8743d8d98e4109e01f594870a |
| SHA1 | c4b502496650bac4d64904546f678996835c50d8 |
| SHA256 | 5d8969d706ec4a74eaa2ba6cbe60754e01925c20522919c18b13b9d58709e49b |
| SHA512 | a7a65202b993ede7f8b21a9f9b5f7ecf0ec4dcbe88917da6cbd60e518ce7e9f2e7951d77fdb621585a6bdc163710fddd068182f2a8d852bc2620d8305aafbc8e |
/data/data/com.example.testdex/app_ttmp/oat/t.jar.cur.prof
| MD5 | 7775ef2935388586230468a1533490c0 |
| SHA1 | 9bc70917563ce87174e5b0ddc26f8b4de4cdc9f9 |
| SHA256 | 7f9ed1774c1162b0b1484f5e7bede7edae3349d9f33410a44f8a49c09e1736f3 |
| SHA512 | 487b394ecb91fa7f130cf5234392b52581b8b90b3fdde8bb2c25f9cfdb8aae79a86ee5785edd38fae52e0ca956d6ecb9b837484d04d1d49bb526df09b8807869 |
Analysis: behavioral3
Detonation Overview
Submitted
2024-06-16 18:22
Reported
2024-06-16 18:25
Platform
android-x64-arm64-20240611.1-en
Max time kernel
177s
Max time network
132s
Command Line
Signatures
Removes its main activity from the application launcher
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Loads dropped Dex/Jar
| Description | Indicator | Process | Target |
| N/A | /data/user/0/com.example.testdex/app_ttmp/t.jar | N/A | N/A |
Obtains sensitive information copied to the device clipboard
| Description | Indicator | Process | Target |
| Framework service call | android.content.IClipboard.addPrimaryClipChangedListener | N/A | N/A |
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
Uses Crypto APIs (Might try to encrypt user data)
| Description | Indicator | Process | Target |
| Framework API call | javax.crypto.Cipher.doFinal | N/A | N/A |
Checks memory information
| Description | Indicator | Process | Target |
| File opened for read | /proc/meminfo | N/A | N/A |
Processes
com.example.testdex
Network
| Country | Destination | Domain | Proto |
| GB | 142.250.187.206:443 | tcp | |
| GB | 142.250.187.206:443 | tcp | |
| N/A | 224.0.0.251:5353 | udp | |
| US | 1.1.1.1:53 | ssl.google-analytics.com | udp |
| GB | 216.58.201.104:443 | ssl.google-analytics.com | tcp |
| US | 1.1.1.1:53 | a.asense.in | udp |
| US | 208.100.26.245:80 | a.asense.in | tcp |
| GB | 142.250.179.228:443 | tcp | |
| GB | 142.250.179.228:443 | tcp |
Files
/data/data/com.example.testdex/100classes.dex
| MD5 | 871748595bf8912a62a16ccc88fe1d87 |
| SHA1 | 4af9633ecf9e61aa79fb3aeb3d295a9c4ebe9596 |
| SHA256 | 0d4961513ff3b8bea46b00c367f280e290003d3216fc281bd7f05861a4afc0e3 |
| SHA512 | 55976b804e6f299e656716a5ff6ca9a2d5ee5335f1edb94fbef0ae012dd616eae2c99ac6af18ba202a5861763b7b159b4c0272a75fd14927c80ffbfdac9281bc |
/data/user/0/com.example.testdex/app_ttmp/t.jar
| MD5 | e3447d5435bc33cb03183a57f3474f1e |
| SHA1 | 13b41650892f79bff94f3edf8689c3218ba962d0 |
| SHA256 | 8eabaa1e5b64a753f5aeeee5e02ce584ab8e65c5edfc5e3bdf38f25462024dc9 |
| SHA512 | e4e7906b57056c413942ea3f5fa91cf3bc5f508a2e9c8273524c0cf84d7189f26b770f0130f57218ecba8982ac337f46a6d11d10dd8f8dc4f5f0c0fa02447ab6 |
/data/user/0/com.example.testdex/app_ttmp/t.jar
| MD5 | 4e1e6aa783bb8974b1436f0100156de6 |
| SHA1 | 8d2d20dbf86960783c889dd9834e281bac850642 |
| SHA256 | 58665fea32655b49869f9f7e6812f36906cd75dbe4af3f1d497e9bdeaf33fc53 |
| SHA512 | 0a45ddb1269a3cd8a789ce3b9edef67e69c2968480938aac76e9e975c4cce049a42ebbcf0cf4058eef117e1041a1e7a8f15d504c5a9ca95b1b3d014ca91aadbf |
/data/user/0/com.example.testdex/databases/com.example.testdexb-journal
| MD5 | 785c0333468042d3252ec3bb7f35f341 |
| SHA1 | 83c1a6cfbea90ad904fbc373b1d657f4e79405bf |
| SHA256 | b333f857812c7f183913bb4eedf75d302e37d672f7a3915e7fd6d752c21056f2 |
| SHA512 | bb32d545958df58a76563bedd18406b0ed067c27f70bfad5974a9d6f6c1678af7e5a52db827976fd8f728e0b1fddee6115b04a2c58fdcd534842b8794cae198f |
/data/user/0/com.example.testdex/databases/com.example.testdexb
| MD5 | a40cf33b77058c4b38c7d7a3eb0fae9c |
| SHA1 | 6c0030cd9dd730e6b0a2eef2e9ccfde6356bad63 |
| SHA256 | d505a025581d4f6f6d8e9cfae130d385da05310c6cb78cb9a5fbd04af8ab51ae |
| SHA512 | e7abf381e1cb2e2ece339c828ecce9f457284cd4ff0891ec98bbcd6225ae83404bb563ef7a23fca80e9beff81de06e9476dd064afec10a71ec119d0b1dc37df5 |
/data/user/0/com.example.testdex/databases/com.example.testdexb-journal
| MD5 | 13f505a2e7bd914a649fcd4a55c7562c |
| SHA1 | 356fc3c8d58d8ddf5e77a99c7ea7f3ad1e4f2be1 |
| SHA256 | a0a6b04a33e6f003f03bd6da91c48d8bfb7cd7702966a1d59af22364028598f3 |
| SHA512 | 4a3a228f136c3251c4b93d55cd6cf1c2ea16254a86c520690d99c437e0eddc9b37866ddd38877bbbe6c0e6aaa1ae7a363f252f2c5663da591657f4a5161e3729 |
/data/user/0/com.example.testdex/databases/com.example.testdexb-journal
| MD5 | a139a7a2ad3d9300009d596d3ed58e7c |
| SHA1 | e0c86a0cd65cd1b45e80c768526f3caac6c3f499 |
| SHA256 | b70cd8cd65be9e8700feb0f22cace8f9bffdf14dea7a7a48234fd2078ced4fcf |
| SHA512 | f6f6960ca1799519ad0979a532fbc26b7d01c2c111755e2aecfd1f8e8022fd11f32aa1f9bdc80aea2a894450ad1a5c26450a93ea5de97751e4d2d13786570f1e |
/data/user/0/com.example.testdex/databases/com.example.testdexb-journal
| MD5 | 1106705e8dac2242d0c3864cae6eca94 |
| SHA1 | a2541f3545068ee15f5fda5392afdd273cd8f599 |
| SHA256 | 038e024cd525b071ab55dab054121a91f8d7cbb981b69bf0518fdc16e74559dc |
| SHA512 | 975218984c96e44525c46b8cc45ea7c3937c4be1925bb4689b17d919776cd0f19179fc83ade5a64a4dccef88a5190758a742f67070c66b1f2f7288e0743bc3d6 |