2df24ee773b90ee124ff06b469ea43a68f0ee2eada6a6048d80ff9a075a28d27

Analysis

max time kernel
21s
max time network
148s
platform
android_x64
resource
android-x64-20240611.1-en
resource tags

androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system
submitted
16/06/2024, 20:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b50e8e6a22d0cd84801d2343cffd982d_JaffaCakes118.apk
Size

5.4MB
MD5

b50e8e6a22d0cd84801d2343cffd982d
SHA1

b49e21a4ce89038451511c5951cd094422caf824
SHA256

2df24ee773b90ee124ff06b469ea43a68f0ee2eada6a6048d80ff9a075a28d27
SHA512

29a8bd3e36d784431328e1abc65ed3ddf43578a1a6b497c92aacbcc34933798058687ac7ae4251d16816e564aa755a6423230b47858cb59daa6de41c5e9290bb
SSDEEP

98304:R7qWv11FgfAWQ/oga0BsTBImG8r7WUmMqDODZ0Tn6VlEZD5M1GQfDzX:Rnv1Gm/og8NrqUrq6DHlKDfaDzX

Score

7^/10

collection credential_access discovery impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.yxxinglin.xzid46682

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.yxxinglin.xzid46682

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.yxxinglin.xzid46682

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.yxxinglin.xzid46682

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.yxxinglin.xzid46682

com.yxxinglin.xzid46682
1⤵
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks memory information
PID:5213

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.yxxinglin.xzid46682/databases/query.db

Filesize
16KB

MD5
21c082252139650f5bf604351fbc100f

SHA1
ac891965b034a9db9c5a87a53c42a08a3236d180

SHA256
41db1892a0515c3f7487858ebb88edaaed523ed4eb1af75cd44cda6f222ca1d8

SHA512
146130b7cc776afffcba47b6562845b2f9417d7fe06acfc61dbbf780919119f573b10c22668c7d4132ac4db9afac5c9bc7764728c7375d17477839ebf7412dae

Download Submit
/data/data/com.yxxinglin.xzid46682/databases/query.db-journal

Filesize
512B

MD5
0c73a390684fe5f0719bd42f06aec803

SHA1
aa774090fa97963e9d48658155f4022ed20811a0

SHA256
d542b5f83f84581c64eed9593892757605ade8104d5aa26f29fa018e043ab2b2

SHA512
137361073a32d0a2b03145d33bb1e2aeb33188d003d0bf9b738397e09bc17f3edb3ede52afd72448add823354ffe3e711ffc79a354f6cd644349dff0fd0e7d31

Download Submit
/data/data/com.yxxinglin.xzid46682/databases/query.db-journal

Filesize
8KB

MD5
d520c039d807819326ca7ddc6cadd16e

SHA1
d5dff79bbf2fae75e5bd47599b4d2999e45d4e89

SHA256
976b635bb9574815c1a3b7cc40dcca020093689b90823d019ce0e4c5b6ddcd66

SHA512
bcee3c5735833c80a81a763ed03e69e83554b77e33e162834d282e1f5e2274d20cc6826bbc6ee44669984acbd628814a5b2cc9b246d4ed76325ec4f396bdb56d

Download Submit
/data/data/com.yxxinglin.xzid46682/databases/query.db-journal

Filesize
8KB

MD5
3b8e1ef2b3f27f9d352247ac1aba7fca

SHA1
d9d6d551aac6d63e958c72e20674b317f6423aa8

SHA256
f61132cb38e7e0c752a052d119ee8eaec6ce3c976df4eaa9b00203307eb56c87

SHA512
446c7a7ce23c6f874226f3d7a19fd2b817e8d534b3ec89b5bb16e2f36431952f31adf2cfc043d202946a77a6c3ca0ef085e3f8dc561b07ef5cce56c3aa7db230

Download Submit
/storage/emulated/0/zzyy/cache/journal.tmp

Filesize
36B

MD5
37e8e716e0e2f4a0b05cd9571d95b84d

SHA1
f8d068f6931707bddb8cd69f706f2224ad1fea3c

SHA256
7080cb592d5149c858b206d3fd0d5e3e7d601f120af00b2616bee928ee1291ca

SHA512
e62b850901835fdb73fa6224618422f721dd765861d42f6bc2dd013413e96bd910ac5313afd9b4f63da74beb12a15fac81b5157456c9caa3031862dab84423f6

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads