2f49ed8d318f96379c986be0d663f32877edfe26f136bcf879151766d1d4930c

Analysis

max time kernel
47s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240611.1-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240611.1-enlocale:en-usos:android-11-x64system
submitted
17/06/2024, 02:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b653b3e91e3537dab8301a2999f0910e_JaffaCakes118.apk
Size 7.6MB
Sample240617-clk72azbpd
SHA256 2f49ed8d318f96379c986be0d663f32877edfe26f136bcf879151766d1d4930c
MD5 b653b3e91e3537dab8301a2999f0910e
SHA1 1198ead2550bc0c1073d365ce3c0888a44e5ac46
SHA512 62852177907eec4aff877fe153f30835bc279a434a24342f4fb0f1b73095391d7ef18142d3ce98e7a46d4b763cfcc36a103639fde4538d64443632d3692a9197
SSDEEP 196608:6m9vL3WMyO5u8nMQ2THEDfCb1IAs8ZWlRwFopThIo7:6UvLGMDujKrqIANZW4Fw
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection credential_access discovery evasion impact

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.kk9js

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.kk9js

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.kk9js

com.kk9js
1⤵
- Obtains sensitive information copied to the device clipboard
- Listens for changes in the sensor environment (might be used to detect emulation)
- Checks memory information
PID:4587

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

User Evasion

T1628.002

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

purchase.db

Path /data/user/0/com.kk9js/databases/purchase.db
Size 28KB
SHA256 a20e2932ee064fd9bc3682a09d6fd76418c073fcce50f722a9ba166a3d397d4f
MD5 e39e4c87165cc0b578ba7d8db0499317
SHA1 37476124a4667cdf140b28af5aee47d781adf776
SHA512 93af9469710239fdc22559342bf668fcd8ebd7fd4892cf18e45c4cf80dbfcd60f897e2dfbb673dc2cf516521e1a1b87af6e75a94864b3ec24cb151c05d4dc98f
SSDEEP 12:TLZiVsVsGhNK0wOfhOhDJ6/iekdcfSHNVRmBEyPbGtOwI:TLQVEpEMOlNuGSiI
MD5 SHA1 SHA512 SSDEEP

Submit Download

purchase.db-journal

Path /data/user/0/com.kk9js/databases/purchase.db-journal
Size 512B
SHA256 440ef272e8d676db3f15cf15e3032335b77e74588ab2e9ee7e7ead7c2a62ed6f
MD5 221171316c230dffab72158813124704
SHA1 52342b2b5cfb2e108b5d76c3e118d5f4bf0635dc
SHA512 8419e9e1baf3cffbed72521df2e14215af89d0a661f5f0be2c51f4020bf923ce10dd522748355b0eb64f29e981602dd73b8b0bc54057f222cf27cfe16d4dc8dc
MD5 SHA1 SHA512

Submit Download

purchase.db-journal

Path /data/user/0/com.kk9js/databases/purchase.db-journal
Size 8KB
SHA256 f9f5a178b690db590eb2b49d4345b4bb974ffad76c5b5ff29a62472f9bbb1d4a
MD5 e080428a32c98f603577e8b7576f26e4
SHA1 bc8c55519b274ebf0630af4ff9f8f4b9b4309a4a
SHA512 fa44106de7dd14568accc2d9ca20730ba222d78603a58b8f3743576cc3de39d92027076449866fb4d5edf9044b7bbd734dc24443ec7e1cc9e332a8b18397ebde
SSDEEP 6:7+/l9Tn1Apg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKkw:7+t0qLiuWdYRmBEyPb2
MD5 SHA1 SHA512 SSDEEP

Submit Download

purchase.db-journal

Path /data/user/0/com.kk9js/databases/purchase.db-journal
Size 8KB
SHA256 a3511ef60820adedfe8750677ecba3b3ca589ad4b49467ad37552ecefe8559ed
MD5 6728c31f2933f61cb7ae0c1c65613710
SHA1 575824214c0f8926ae5d407ab7d779582f68f906
SHA512 f041480582270b4b0683aad4bf2efdf6f6268b5e3c375f2feaa57bca53e8a4d6c33223e592a664922f9c9cd4a40c9e213738437e7920ae80b3413bc06cbe24b8
SSDEEP 6:7+/l9PXHPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuK7U/HU:7+tZXvqLJdeWRmBEyPbz0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads