Analysis
-
max time kernel
38s -
max time network
131s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system -
submitted
25-07-2024 12:33
Behavioral task
behavioral1
Sample
6f97af07bb256b736313e842aad4db36_JaffaCakes118.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
6f97af07bb256b736313e842aad4db36_JaffaCakes118.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral3
Sample
6f97af07bb256b736313e842aad4db36_JaffaCakes118.apk
Resource
android-x64-arm64-20240624-en
General
-
Target
6f97af07bb256b736313e842aad4db36_JaffaCakes118.apk
-
Size
5.2MB
-
MD5
6f97af07bb256b736313e842aad4db36
-
SHA1
ca462c6d18fe44dccf269824ac04a76dcf12eb9a
-
SHA256
58f161cdf468811e0d061f12136a1f7981427adf2651351597e995473987f45d
-
SHA512
8f5eeec6e84bd162af6808165e26b771cf6b3132bbf35df9179ed14c29d580d1cd98333b65bf1acb1cd07de800651b34b3a409caad2563b15db5ad6fe0f9c14b
-
SSDEEP
98304:o0tXvi8Vf9IFre/jled3eidKKnjy1MEHD8ddHFwITf3vcwSnFRTmTMCu:oOXvigSrgjkeP1M7d4Mf3BAIICu
Malware Config
Signatures
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
Processes:
ir.mizansoft.parvareshkaktusdescription ioc process Framework service call android.net.wifi.IWifiManager.getScanResults ir.mizansoft.parvareshkaktus -
Requests cell location 1 TTPs 2 IoCs
Uses Android APIs to to get current cell information.
Processes:
ir.mizansoft.parvareshkaktusdescription ioc process Framework service call com.android.internal.telephony.ITelephony.getAllCellInfo ir.mizansoft.parvareshkaktus Framework service call com.android.internal.telephony.ITelephony.getCellLocation ir.mizansoft.parvareshkaktus -
Acquires the wake lock 1 IoCs
Processes:
ir.mizansoft.parvareshkaktusdescription ioc process Framework service call android.os.IPowerManager.acquireWakeLock ir.mizansoft.parvareshkaktus -
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
ir.mizansoft.parvareshkaktusdescription ioc process Framework service call android.app.IActivityManager.registerReceiver ir.mizansoft.parvareshkaktus -
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes:
ir.mizansoft.parvareshkaktusdescription ioc process Framework service call android.app.job.IJobScheduler.schedule ir.mizansoft.parvareshkaktus
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/ir.mizansoft.parvareshkaktus/databases/__pushe_base_lib_dbFilesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
/data/data/ir.mizansoft.parvareshkaktus/databases/__pushe_base_lib_db-journalFilesize
512B
MD5538110330202604b1a37fb16130a21fa
SHA12cf140f9bf3a43814d0706f6eb7de84bd9ef217a
SHA256a8737048ca9513af30008c541a961cc8e2820cfdbea9909f74342f7375bd719b
SHA5126ccb1f8044b30b118f04d9ff1bed42a976a5952b557ef86f6fc75fa379ea59791bc6da80623108b1681ce5cab617cf7e5c441d3de144c96db50d7657ce7ac684
-
/data/data/ir.mizansoft.parvareshkaktus/databases/__pushe_base_lib_db-walFilesize
156KB
MD518dbb8a467ee1f3550306068b70bb053
SHA15ad3d401c1c5a94d5c3bec0a3eb55037b4766e75
SHA2561ee2a6ea127202ea90b7029bf88fd17117bb62b9bffca69d5e0977e493d7bbdb
SHA51290dcb2490f08e34bd7d99a6cf557c2cf76f3969901794357d94fcf393b33276c5926fcbe7e7d46f5e5fc4311886efe34efad2e802c6487a1fe11acd3e8336bef
-
/data/data/ir.mizansoft.parvareshkaktus/databases/evernote_jobs.dbFilesize
16KB
MD569601f8e3b1e064b967562ca31f20736
SHA1d738558363ff3fae116da770fc84c95005b09e07
SHA2568bd0ed016ff8a3d801b6a89e9be3424eb5b719a578e5ff05e9c473d8b7095717
SHA5128cd01833bc87bce1c5aeef70632760b896792135528a833944e1b8d77faf4300f5ae6dd93b9a1c066a73286a0694340bd26aff9352d861ef41c77e69514e51f1
-
/data/data/ir.mizansoft.parvareshkaktus/databases/evernote_jobs.dbFilesize
16KB
MD5d30d3a36a77fbf93e9096744810b3c4c
SHA1660ac94f3334e5f847a7173c63c21cdab083b5a1
SHA256160d99748f6802a722dea8b1660bcf48c63156f331273d776788edc700fac0fa
SHA512cebf4cded1aff9c07a073bc2bbae2b4d59e3d26a63aa7b1619288afaa3f270dd0e23b5df7bfc58d930154897846ed9d6ea588c06aadae07991e269a4c8235376
-
/data/data/ir.mizansoft.parvareshkaktus/databases/evernote_jobs.dbFilesize
16KB
MD5978fdf85b8448e3a7c9015e51477eb49
SHA1793bb88398dc9457935a4416638d5ed3974baf19
SHA2568f72919eebbe45ed6d33b7b763d7e45d76a880128aee9aa5c29d28ab79689a92
SHA512852b2d3e2607c96625e9bcd454c702ccec6a0f07aba3410976d6400ecd2d48ccc92d93c8ce7fcc87a622d04357bd6805a996f11d339ca7fc3eab99c0e991fe38
-
/data/data/ir.mizansoft.parvareshkaktus/databases/evernote_jobs.dbFilesize
16KB
MD59b2caa51b9327dcc3b6463b0e3a76c85
SHA1a7d9abf90664640ddd03210b754c4c02ff57263f
SHA2560a0d5de82d7fabbc5d5bf2c9d8dc5920760614be91d15b6e04ced507faef02b6
SHA51229546108e74402a615d37e4b1ba51bbb1ddd21e74b18a10f3500b4c1b3197f321ed1799cfd8e3b069a00ea4b2d397ef0e457fd764e2938f92599c7d9ec414bdb
-
/data/data/ir.mizansoft.parvareshkaktus/databases/evernote_jobs.dbFilesize
16KB
MD5aa1dfbc04d0f9541a9b2cba2d679d6bf
SHA14bc0f4707af156087c330f2fd98230b3eed38a78
SHA256df553d785b5802d3ed67f068236b5a0abcbd60fb5668e7cc82df304cd7bfb5c0
SHA5124127b4e9d8ce8011a58bc759249cab63032d9bf1420ca46e921f7b482605d19e49fc0ac1df9a0c7c98d4b39d7527185cf25bda35bd2bd1e1282e972c066822dc
-
/data/data/ir.mizansoft.parvareshkaktus/databases/evernote_jobs.dbFilesize
16KB
MD581c5364af84cb258f4c2bfc5821603e7
SHA11b55f7b245a799638a39dc30752fce04f1cfecc8
SHA256cf97a8e060e5bccd2157f0db0a493b14c58388a0953896d545ba6acd2b70b82d
SHA512874d621d75451d6948727b4af164c91afd36da4240cc4cec7a99ed94f95f38839b13bc0c9df62f7f13d07d06b102ca124194ec1cc6985027d12259a7dd4fb39b
-
/data/data/ir.mizansoft.parvareshkaktus/databases/evernote_jobs.db-journalFilesize
512B
MD5153f4697cc8255ea831d2ce158dd9a4d
SHA14e53f9d187dda20437d59cc827d620b790d9926c
SHA2569de20d93a4534e4c9a6d5a6250fffba2e384e9e462535446156c497ee160fc16
SHA5122b7c09a4f60ece25522574b8c90f41135f929cb0ddbabaa95e0cdb773e81bbf13865cf8bc22b89f632f1237fb22a307c945ec01531d6143396a7a82b85e7fad5
-
/data/data/ir.mizansoft.parvareshkaktus/databases/evernote_jobs.db-shmFilesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
/data/data/ir.mizansoft.parvareshkaktus/databases/evernote_jobs.db-walFilesize
4KB
MD543e0b2c2d26139ac065e4823be49fc8b
SHA17df33a1cc80b42eaafa6533fa645aa39c62b1cab
SHA256fba31f842ca288507d7fc525ff09cd48ff166301b9e066e22b7fc0f7b949b612
SHA5125ac282ccf99a31884fa7fd0e29b86d344ad2acb7b86e8b150df27d3882497eb39f6aa4cd43bdf478b812f53a1101bc00c3683884b47c2e4a341139919de52527
-
/data/data/ir.mizansoft.parvareshkaktus/databases/evernote_jobs.db-walFilesize
4KB
MD5da23bcd39c3cc8d13d19248e0a09f179
SHA1678963473276afb207e1c3e0127f794773d33f87
SHA2566ac0eb6f409021b15f2ccec57cf6394b1001ced4f0291517ef9767194f7557a4
SHA512942b1888f195828ed461396f22f105f6cdd863e5499224c33e32e9f08e423fcf680d8cca332e701e6862ad8b297f04a6812837bd43f737ff8928d37261fdf4b0
-
/data/data/ir.mizansoft.parvareshkaktus/databases/evernote_jobs.db-walFilesize
4KB
MD5d81029f4cc39ffb95e0afadf6c24be6b
SHA18c4170d93b97a70523603fce66ff3a1ea2b53da3
SHA256d5d16dfbd4fbee7cc2c7a059efae4a14e55f20f0123546502d01ca029beafc3b
SHA512c2894307abdb21a27ecf00e6712e013c1bb3e23c727d4ccba18b5eea7d6fac155767280bc1c79f40cd9baca5c7a1b726d906df4908137fcc77cc6655b3949bae
-
/data/data/ir.mizansoft.parvareshkaktus/databases/evernote_jobs.db-walFilesize
4KB
MD51119cc410e0a8a38b0aa7db34ba2572c
SHA12849b51d799b40e9145af01f13db0509ac105ace
SHA2562277be81d16821da1e438df6a7626c46c6d63374f7c74cd6c7a796e42637c68e
SHA5121ad821e5e8fcbd15fc1eb91eb9050729667f6453a5d971391335ab97846407f367fd1cb27587950aa8d1dd17cb4e5b5b7a6b472f7266d64ce16f4e6fd2acd8b2
-
/data/data/ir.mizansoft.parvareshkaktus/databases/evernote_jobs.db-walFilesize
28KB
MD5dabd7c6d8e20137df0694eff1defa8d8
SHA1d5875b3efb46e641a9bdc949d7c18e4aedcae16f
SHA25601381e7ed89d7c4a653251cd49bdf90c97f86475b52b6bb7257059476360dfc6
SHA512c46f8c188eab32fb199a6c68a6e73dbaaf40d123dbc57c00921c341e4a81a4c1c68ad0b882ef264e3c32e7009797e2d089dece9a7a97858cddc719d03da212aa
-
/data/data/ir.mizansoft.parvareshkaktus/databases/evernote_jobs.db-walFilesize
4KB
MD5a3ecd6bc2e0c5fb908b8f15c8f042bb4
SHA17fd4201460f0e19cd0066fadf3d85130bb5789d4
SHA25650a44a415415ffe5f8ea010b60f4d219a7f3f79156343273cf4713494a96f177
SHA5123609952dd20235d8f8c89955b92ee1c33ab63b3736ffbaad3c11f594d50090b488ddcfe99b276110fc7cc833d73384d54998cf76a452e29fc50235e56046f459
-
/data/data/ir.mizansoft.parvareshkaktus/files/parvareshkaktus.dbFilesize
240KB
MD55d7be72751c19f05b932a5fa4c136354
SHA1d3e5a6ffec59bdc37dfb5a2d84fbd604fb25f34b
SHA2560bc318bf2590ad63a249dea5a9f0390b41aa6b5768a2cc3c49838a9f2b1b28fb
SHA51238afd0d0e3b87fd33fb27a9bec2cae033efef2062a535675e63bf63137e226012610207e79e401f6628b338b67d330b377b5f97ac141b6b2e53db0b2c2f4d44d
-
/data/data/ir.mizansoft.parvareshkaktus/files/parvareshkaktus.dbFilesize
4KB
MD5b25970f02db671c22b66221ff8c9e39b
SHA1c592ba793f0006288ee9fe867be171b5d3f3dd93
SHA256cd232e45e78d6ad700ecf11f6b6ed8e0eadec475586ef9cfae0b4bf1dc8a7ba5
SHA512e6274aece21b54027c3905cf1f8a8c660bd590444c92e2443ae258f7c6de08535d7bb4056fed29e063134b815d34a7b579cb75a6a2033ada966d9dd8f55f9fbf
-
/data/data/ir.mizansoft.parvareshkaktus/files/parvareshkaktus.db-journalFilesize
4KB
MD59c507b439004d082cd65394e95cee186
SHA1efdcf936503e79b1afd3cf40835ee33cd6293df4
SHA25658975920da190d9c1e806757431cadd8c3766fe1fa44fb04a3e21bca089a70ea
SHA512191fce96e4681c378dbbacf87e6db9e75af311179b5e499d5b592c44a94c3c2cd529c27aae1376fa658607ac5c5876b7853956676a95bc68ed3ce1283440e3e6
-
/data/data/ir.mizansoft.parvareshkaktus/files/unsent_requestsFilesize
58B
MD50d210bfb2a0e1f1b4c082a6a0f79de07
SHA1bb8ed9e364db79d1d9f2fcde3f15091893222faa
SHA256988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
SHA512536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1