3600a40dd6785ef850bcb4ec662ca675c9423721f70ac30f24fa4a09962d4e09

Analysis

max time kernel
94s
max time network
156s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
25/07/2024, 18:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
70cc64627feacd0929d4867c2eb340fb_JaffaCakes118.apk
Size 6.1MB
Sample240725-xfbfvs1dmf
SHA256 3600a40dd6785ef850bcb4ec662ca675c9423721f70ac30f24fa4a09962d4e09
MD5 70cc64627feacd0929d4867c2eb340fb
SHA1 3e336e2d0c803b009f5add955aadc50e8143ad56
SHA512 33fa7164936d855a9ebdf865dac79275387bf026a0c512db875fa70bd6ccf97c371bc249780b0e19ec37c2323ee0f4bda8446dbfdbe8161761d8516c1b111007
SSDEEP 49152:oBPybb/swRDAuvS9nm0FLvm2GdslxCI7GQPWnrG9yFZsG3+a4xbxUHqHOJxZu5Q+:4OvU8CmAL9PxurGMqULBYCJbVDBSd9
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4965	blutbad.fishing_place

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	blutbad.fishing_place

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	blutbad.fishing_place

blutbad.fishing_place
1⤵
- Removes its main activity from the application launcher
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4965

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.YFlurrySenderIndex.info.AnalyticsData_GP4KF9VBMCPFGFRK4HMD_182

Path /data/data/blutbad.fishing_place/files/.YFlurrySenderIndex.info.AnalyticsData_GP4KF9VBMCPFGFRK4HMD_182
Size 88B
SHA256 35562195761d5b6eddb0b9a27813a240fbe62d590ab013b17427f369c0740b76
MD5 e0fda64d5a95f08c2a777be0434f2787
SHA1 6e33c8ad116c78d2d52935fe46d95c4309a4e1a4
SHA512 cd421e5637c385b14e1c43b4582827dbe0d22479fba448d0ea3e85da08d4290fcca6d3b21b7f79172af9a1629daef28de751c1c7627f2ac71ecbf7624d00fcf5
MD5 SHA1 SHA512

Submit Download

.YFlurrySenderIndex.info.AnalyticsData_GP4KF9VBMCPFGFRK4HMD_182

Path /data/data/blutbad.fishing_place/files/.YFlurrySenderIndex.info.AnalyticsData_GP4KF9VBMCPFGFRK4HMD_182
Size 86B
SHA256 911f7972722c1a1e63b5372abbd6ffafee05d566d231df63eb272a2d9154ca8c
MD5 33b53e47eae2a4e62b340ad8ae5a18c7
SHA1 93f5d824354c30079816d508a695c8610afd8292
SHA512 3493eb44a6d9fe32769093557c9f04ed36eba2a28de9fece570400ec36b41584826bd2359a2cf94e8e2bc48f1cf2b53e120f67d57cdb3d88913c695de463f7e0
MD5 SHA1 SHA512

Submit Download

.YFlurrySenderIndex.info.AnalyticsMain

Path /data/data/blutbad.fishing_place/files/.YFlurrySenderIndex.info.AnalyticsMain
Size 72B
SHA256 404fcd9d2a42e5ac4037495c72ea89547d98faa962b81d07e29cd0eb3f634152
MD5 34685056092fb8e0cc08cb63041631d2
SHA1 a734e30b799da1308227e86937fea9b9ec151707
SHA512 53616663b9edee5d3faec684ee37a833cd5df277bf93c17be069a8a94884871219146d031f985b47a1da18ad94c2c312ef3dc752bb20d8a44af91633a2c2b97b
MD5 SHA1 SHA512

Submit Download

.flurryagent.210f95ee

Path /data/data/blutbad.fishing_place/files/.flurryagent.210f95ee
Size 58B
SHA256 1508619f32d4e47f48b5fad64324ec9e76cfe288795a8b91a53d930b13216fa4
MD5 a7cf1ccbcd7707f3edb29f7f14587f8f
SHA1 14065ee8830b63c97b781ef7208677bfb4066ae8
SHA512 bebb15e84205068f7ba46a96dc614b0d1a652b9a3640e9f2c335089f720cc84174cec7658fb7aa758c0b56a386f6c74394ed50a298e4008e93bf5608a4cb40a7
MD5 SHA1 SHA512

Submit Download

.flurryagent.210f95ee

Path /data/data/blutbad.fishing_place/files/.flurryagent.210f95ee
Size 818B
SHA256 287c9912110dfa251fab6eedce478d2e7a40ded06ce68b36bb21e150316f68a1
MD5 c828176264f1c892bbc0482a95e477fb
SHA1 a8716961b4ecc285f7f05eb090174c76bdc6e196
SHA512 110ec77087b0a7a11886e0a58769131c263835eb3bddeb4196881a081c074425ee49ef52c2e6790d7ddae0b2cc76a0070c84ddedb9f4412e1c00fa73ac890bc2
MD5 SHA1 SHA512

Submit Download

.yflurrydatasenderblock.a31d9400-4230-49b7-8ac2-8da3ace04e00

Path /data/data/blutbad.fishing_place/files/.yflurrydatasenderblock.a31d9400-4230-49b7-8ac2-8da3ace04e00
Size 308B
SHA256 b47b9ac6a9d3a8636a4e210583075c07e704d156b775a6b1392d86511dd28da6
MD5 13109de91019ce770f43adae379a5bac
SHA1 e015a97cffb62093d337ba6d74b86d0b94d3efd2
SHA512 42637c01692a7aa72702fd8afca14b0b3b58f6381e9f23e32322e81eaa5ba7ced22ab9132c01fff3ec54e332a1dcd3941ed6c60fe405ba8a6099e490d1d843aa
MD5 SHA1 SHA512

Submit Download

.yflurrydatasenderblock.ee66916d-9d36-4d6f-bf63-b5418d714269

Path /data/data/blutbad.fishing_place/files/.yflurrydatasenderblock.ee66916d-9d36-4d6f-bf63-b5418d714269
Size 663B
SHA256 b548db01f00dd2a51bce5f3b4cdd8a040e89b5b10756d2623daeed98070e1793
MD5 4323f9214fae24569c1af46f1d7df824
SHA1 c3ad9062217f8973570841d8bede61e07e1b0964
SHA512 5b471be44be353a8c066b89296fdf748b9f4b3b209a14c58f16f7995c8ac84ae4e0a7710fc86e02e44b8c1353256185801da2870c618d2183ae92e39e04377ec
MD5 SHA1 SHA512

Submit Download

wQYxaPvqH

Path /data/data/blutbad.fishing_place/files/wQYxaPvqH
Size 354KB
SHA256 e1230b05918d01975045b19fd63be40e56cf6836ec91ceceaa43bdc54a616c15
MD5 33c4e3c640c58340b5a46671f98954ed
SHA1 2b80da0c33a1a59ee2815a6d68d91e6f13024dc2
SHA512 d37484d42bc57c8ae2685d510966e247e147a0ad83bb79cd9bce40196ad13dd41a7a6d487ffe06a4fbd244145ac51f612f610f8a193a8170bc379f3d0b9ea78a
SSDEEP 6144:IKut4jmdTcEgQT9FUWT+OyN3WYKRnTPObNonc9HQBx+4mWzutKkHGqcmhAwHwDZT:DwhmKzwQSQ69RGF/uvBF+p/
MD5 SHA1 SHA512 SSDEEP

Submit Download

wQYxaPvqH

Path /data/data/blutbad.fishing_place/files/wQYxaPvqH
Size 631KB
SHA256 e5d7b18c0ef995b88ec6187d8dcb10008a1db263cb6bf5dfde5c29161b138fc5
MD5 3dceb1427c25c681298a04b9ea923744
SHA1 92faf758f61132c4dd9dfb6e97ab4346dc52b44b
SHA512 9cf9b11664548154176cf17a3de7997eefd283e9603eb5bd1fa110dbd779fd4f490ff192d60b7daebc04dea9d0965688d7e9cbbb9925bf7869ceedc00586a2df
SSDEEP 6144:wC1v4YmdTcEgXTWFUWpyW+N3WYKRnWPpbNonnICBx+YY1VI5ejqw5rnugdOI0VIT:ct5n4nugrTUXL0MEEsh0CD/6Zk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads