ab59bada13df46154a1037dd610d9306d70fc599731b0986b6d01f146a78c3f3

General

Target
bb07d855a3fcf8c736a5fda57b7348ee_JaffaCakes118.apk
Size 9.7MB
Sample240618-grepnavckr
SHA256 ab59bada13df46154a1037dd610d9306d70fc599731b0986b6d01f146a78c3f3
MD5 bb07d855a3fcf8c736a5fda57b7348ee
SHA1 4ad6924a964333763b4751fbbc44a7a928286c9a
SHA512 95f89b86170cd5495c6698c8a35eba8e1e2d7deb999985d63ac0763dd9e8e15837ede32342423538d675eb9d8b64a66d65686ac75a2fd94b03e8e1bd7d930ac4
SSDEEP 196608:9+p7z25FAzmc3pa88wG0EDwZ1dUeRjBtIctxGQctxGHfo:OW5FAzcEBtATQTA
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection discovery impact persistence

Malware Config

Signatures

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.skyworth.skyclientcenter

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.skyworth.skyclientcenter

Reads the content of photos stored on the user's device. 1 TTPs 1 IoCs

collection

Data from Local System

T1533

description	ioc	Process
URI accessed for read	content://media/external/images/media	com.skyworth.skyclientcenter

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.skyworth.skyclientcenter

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.skyworth.skyclientcenter

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.skyworth.skyclientcenter

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.skyworth.skyclientcenter

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.skyworth.skyclientcenter

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.skyworth.skyclientcenter

com.skyworth.skyclientcenter
1⤵
- Queries information about running processes on the device
- Queries information about the current nearby Wi-Fi networks
- Reads the content of photos stored on the user's device.
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4255

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Discovery

Process Discovery

1

T1424

System Information Discovery

2

T1426

System Network Connections Discovery

3

T1421

Lateral Movement

Collection

Data from Local System

1

T1533

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

cc.db

Path /data/data/com.skyworth.skyclientcenter/databases/cc/cc.db
Size 36KB
SHA256 474c4a54534ed96beacad7cc9a805a3f53ec9c0522fc7bcc59771cf500a6a0da
MD5 5d7ea1a23af19b4340cc8d90f28297d5
SHA1 4cfe95b23a9e98378d69c4290af81b51fbe76aea
SHA512 33071f4c92da0a3df01c4a61dd165df7c7e0f4f37753cafe02d19fc876a5e7fcbb01c069c804e140ab8bfa0644a55f50fd1373646d1c439f817baa5ffbd47f7b
SSDEEP 12:TCFP2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBEyPb8FOwGQn:Tz7sL7yot3BVrHotGGSgGQQQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/com.skyworth.skyclientcenter/databases/cc/cc.db-journal
Size 512B
SHA256 79f402a3723609edb3ae9a37746fcdd32518b25cc28cbbbaaa10be43e447e3ad
MD5 124e0512aed64b8a130b537e9bfdc63d
SHA1 78d1cc1c826184e1b7bd216cbcc60b592376967b
SHA512 74402f45ff88aafeaf39d63e492532faa3050eb87d6118cc934bef555203f878522c9962f019caf41bbd99b667bb10d63495b6fc7bf871c5cba317906d189b8e
MD5 SHA1 SHA512

Submit Download

cc.db-wal

Path /data/data/com.skyworth.skyclientcenter/databases/cc/cc.db-wal
Size 48KB
SHA256 d950fec25d1e56c9013bbb3928b4a703cef6e8878e21f414ed02558e0565a187
MD5 461d6341a22c5de8dfbba65a796dbb61
SHA1 22d8ecea8e1dbbb3b13af6d3fdc24f7300092508
SHA512 1ee758810a077966594dc90f1d482c3c6c6cf963fb79e93f27eb3199b6aa25224a83ee0328561e24e24785e19250dc6f6d1c4a3c103990dd79e84ab3a0d85701
SSDEEP 24:KiuyzyGSP/F3UwJz7sL7yot3BVrHotGGSP/AN93:nuyzNSP/dshBWfSP/i9
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.im.db

Path /data/data/com.skyworth.skyclientcenter/databases/com.im.db
Size 20KB
SHA256 4240342b0052edd3fe45948dc511246295dc7b3291848d2dcfc7952d8ffa9eb3
MD5 7f5f65fac24b5af49ea53b4016f4b35d
SHA1 73b3dad6abcea6585bbcd50e038a33e16f95fd32
SHA512 e5de3d2ef8d446c4087bd36dbe4d0007303bf20d5a37c0951addf456d22cbf4f6c9b0014a0212dbd85c18597e693ed2cc734cd4b9fa7fed7d5a86ba395ccc500
SSDEEP 12:TD4yNTSFbyfAdCE9WAcLIi6+M+k/6VODfRmBEyPbAVOwG:TBF8WAcDeJ0GSEG
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.im.db-journal

Path /data/data/com.skyworth.skyclientcenter/databases/com.im.db-journal
Size 512B
SHA256 fdf68de4eac69c9ddd7da612d7c1db806b778ee04c9ea11f14e4c8c5c58b7b42
MD5 ca2c9d84f673dd38add8bc6d746ea45d
SHA1 ce7ec3147c8b75e9ad53a76146ce658e0332549f
SHA512 2bd3b021b39c7b7e1e8ab317056e06391464fc6410b97a7b5a5f3a63068ae43e6ac1bedda825394381e9d3ae57a05b55aa6b3f9b986819d3f37f12edbce12193
MD5 SHA1 SHA512

Submit Download

com.im.db-shm

Path /data/data/com.skyworth.skyclientcenter/databases/com.im.db-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.im.db-wal

Path /data/data/com.skyworth.skyclientcenter/databases/com.im.db-wal
Size 36KB
SHA256 75e2ac24550b8cb17670577f776c0a9740c8e78e83b45df93d69258c34beaa53
MD5 215dee0db61647ca1a30da1c7e9ec611
SHA1 8bffdb3fe1606e3c9dfe1d84d71cc38aec714193
SHA512 81c53c7ffe84cdc14fccc1eb5b5a1132143e6b6935b1cb7b1a7a55ececd74f4af9f2b2500b7b5a0dfbbc59be6e25c16e2c897d68b50c07e1c199545c7c4d6618
SSDEEP 24:KkAzyGSP/k/yGpPGp1EkGpAzDGSP/G2BF8WAcDeJ0GSP/RBi:RAzNSP/9+P+Ok+Az6SP/jBKW3DaSP/
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.im.db-wal

Path /data/data/com.skyworth.skyclientcenter/databases/com.im.db-wal
Size 28KB
SHA256 1156a36b33c004d89d3a1ad6c34bd9f5c17e08855c25d0c82ec14df1d9af6ee5
MD5 6512e6bed5a3d1255ac0ca9a25636750
SHA1 d778f4c4fc4f51a4626cab6c86c895dea7feed89
SHA512 400487c5350d71d38ab0d763e5eb454ed6d854851ddc7f8d0811c81cb92199c1ee7f3be5c585c3bbe56cc54ba18542c415e451b2b57bcc2cf377acf48d7cf250
SSDEEP 48:tjNzIaVAk7HKW3DaSP/OJjAk7e8zIaVAk7HKW3DaSP/2:P7L3DfPgl7L3DfP+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads