Analysis

  • max time kernel
    46s
  • max time network
    132s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    28/07/2024, 00:57

General

  • Target

    0443d7669e5a19f6b5a4b599bd1c339c_JaffaCakes118.apk

  • Size

    15.7MB

  • MD5

    0443d7669e5a19f6b5a4b599bd1c339c

  • SHA1

    859ab8bdf796ef1e6c5bfc56a79590f49e09f3a4

  • SHA256

    552ecf57926e1d122394cdf5ee9b919c2177b9249abd768f54d3a3090bdb194b

  • SHA512

    2bf77123414dc9268bcc1673aa5c8dbb4e416c52ec27299c2c6bdb3fac889100c008ae409a581ad28b511e7a7a97f124727c0d0a42a37c8a114c90b791c30d66

  • SSDEEP

    393216:TmULAJP0yt1xZlTrbKxemNuL1HfRihnHXs3b:Tm6m7tnrWxeaOF4hnHXsr

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 2 IoCs
  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Checks memory information 2 TTPs 1 IoCs

Processes

  • august.mendeleev.pro
    1⤵
    • Checks if the Android device is rooted.
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Checks memory information
    PID:4266

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/august.mendeleev.pro/databases/crash_reports-journal

    Filesize

    512B

    MD5

    e27aec34e1910643255d7bf650af3664

    SHA1

    398e8dd4f4c93c4b0842b0a51de21eb4a34a5622

    SHA256

    3335262e83d8245a609399f42d6eb967e358ce081bab7eebd0aa9939709f3cb0

    SHA512

    46906fd3c18986270c7ec9e547de1cbcc0dfcc4b4e22841b8f15a2d967e1181e0d5f91a461680ed59fb050d66fb8118f097e2d19d8dbc610a5ec4be173bb6322

  • /data/data/august.mendeleev.pro/databases/crash_reports-wal

    Filesize

    60KB

    MD5

    df681784bfc1565682910e2e18db0b0e

    SHA1

    04979738e6be117fd4cdd6971489ca8f63736c78

    SHA256

    e9da424f380aee7227c257239e31446c0a45809d76acf8904cd3518d0bc57590

    SHA512

    dd0a04f9962d4d6e81e72947a970b5acdd71294fd03dd4eb13b357bb226d066b1d94119940000a20b311a84e7ff42f118e72726087daf1e5b874a18a4f7a59c9

  • /data/data/august.mendeleev.pro/databases/db_el

    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

  • /data/data/august.mendeleev.pro/databases/db_el-journal

    Filesize

    512B

    MD5

    20cbb4459b7ae5d878b65401e63dbe9d

    SHA1

    e2c4fc784719e2f382cdcc466981d3a16ea507ab

    SHA256

    6df182770576fa6644c4e7afea678c2ac8b5b79cf4ea7116373b804a0720bac6

    SHA512

    912b22cad3e4ef19837af327da8deecb17ce6f3dd2620b2649db54905dbf9101fff741132d86a1d1462a70873fbda68b6b7eabc68710d029362ae06225d9da20

  • /data/data/august.mendeleev.pro/databases/db_el-shm

    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/august.mendeleev.pro/databases/db_el-wal

    Filesize

    156KB

    MD5

    766847c71dab3c148c6c1d04698b4114

    SHA1

    5a88b7192b1a19787fe825cb511ebfe81965c89f

    SHA256

    92930dfb6dce38ea3a86eb700fca1119053d2feec0bab3f42e2bd4471f1d062b

    SHA512

    c8486f6a363b7508d68e3a76fa05771f24a6b17f3bec769b0af862be2dfa54930a1bd4ddd27d450eac8e16b7850f49afd4431a794225295d30f7e3899ccc6c7a

  • /data/data/august.mendeleev.pro/databases/google_app_measurement.db

    Filesize

    108KB

    MD5

    eecf636434dafdd8c4660a5749e4291a

    SHA1

    d5c37f8ee67e0201d712245100ec36773142f45f

    SHA256

    aa45a238e154a9d028490873ff264b4f46e5e44279fbad43c4def7c944f48445

    SHA512

    5d34ef7ecf8a97e673491a5ee9c8155e625713a80bc611b2772871581600ef4884981b8bada9403136c6166adbed943d0cc2fa4a1dc7944fbb07b82a1a362a24

  • /data/data/august.mendeleev.pro/databases/google_app_measurement.db-journal

    Filesize

    512B

    MD5

    297cb82f04ab8c1971c9c9507357aca0

    SHA1

    a3ccd79cbe6702b416ea663036ad05929b3b073f

    SHA256

    a8b2eb525b87e240c130c3a0777e25ab7162b1e5579eb7a4aa0deeb4ea01fb4b

    SHA512

    a33562a0c7f87b2fb8c3c42a92ea2e81ac610a9746edd61f3b755fb5e1fdadeb8d4bf496932f0e694c9be7b0ca86d96b0ae307c51aac2fff23f0e6684aab996f

  • /data/data/august.mendeleev.pro/databases/google_app_measurement.db-wal

    Filesize

    414KB

    MD5

    08cb5e217e5712b9f435c844d970bf06

    SHA1

    7bf8643786d36cae1c6c79c87f83c4ec67cb0f93

    SHA256

    57076d16104296ff380ee46667491b04be6a746a5be087955a2bce28faf639a2

    SHA512

    d37ecdff00440177db0351feea504f2a8e653202ec13040ac1ebc1fc1d30acbed979a99e5a5f87e2f66fc62c1a516c16cfe661c4291b4c963f1018aa8f6ac9d9

  • /data/data/august.mendeleev.pro/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    f154925ebd7b637b5a06c91706047f0b

    SHA1

    adf897b79c882cabb1173e62ac0caf43ea0f8554

    SHA256

    4ed1091bcabd9840476beb60c40ab7190906a12e1465866484d338dad77e7871

    SHA512

    4ceb9d8216b0d7b26a1b5ab79da961cc97736161529fa6bb96c57297483653c87a204d1177c165c06f4c42bafdcaa1ed7a0c4ab8b2d6de39e5b033e8643c0075

  • /data/data/august.mendeleev.pro/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    6b63b92f6d4ec960961ab1deba76d015

    SHA1

    bf6ffccf76f70b897c1a6cb46d129418190f509d

    SHA256

    a16377ad9b4b59218937f24a93699b9a7cc2409814ad71504ffb45c59fc699c9

    SHA512

    43e6e2290c76065c77021b625e5f31d41df9f98b2efec0db7e363c7b34bbbeccff92699465c899a34400ddd1195d67f580e4f0eb92479defdaebe4ea24fd9e21

  • /data/data/august.mendeleev.pro/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    068e235595ff7584e5de7f542b9e1b11

    SHA1

    a1811328067d7c29c2109e4b806713ae3521ab77

    SHA256

    e15279c01b6a836a9751a067361a021c83598365c25b1389bf001b913bbcf93b

    SHA512

    a74d7d9bfe747333e52fa6d47a49d1acbbccfafea634c1f8c5b54a63929a3ce13316c2701119911482cfe73c3a9c45065d1e5c76a192c6f2080ce61c8595f8ef

  • /data/data/august.mendeleev.pro/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    b216bd4d2143fe282c2874eb2d95a52a

    SHA1

    292b55190460ed76201f87b661f72f587f4b42d2

    SHA256

    e382f226a3f5564468a3834666cc5ab32491b51e872ccc1ebb09c60804df7d45

    SHA512

    39db57ed3b746cfe8f108dd448f288cc91ac29e564d9bf3aee5cfecc81065579c1a926083ff0373ac5ead8e3c20c3515d3f728d0fabdb6810c6eead353879bed

  • /data/data/august.mendeleev.pro/databases/google_app_measurement_local.db

    Filesize

    16KB

    MD5

    546ff8bd70c913ca9e14613667fc6602

    SHA1

    689e747ef5e7b1223cfd2f622961b0eba6e4a8c6

    SHA256

    f6f03172a557ec54a64955da327a38e6cfc4904ea22d954607624e035046526f

    SHA512

    96f18a3d309f4e407d007ee86a506f6548fcfef5b2a5c424c2f46e114ee517bf51142e388df64bfb1ed80e56959dfd6ed207227ec407d0a59501291963e2a3d0

  • /data/data/august.mendeleev.pro/databases/google_app_measurement_local.db-journal

    Filesize

    512B

    MD5

    710cf5dad08dbcc6e8025b4df95feb39

    SHA1

    e21a8ec8fc1fad8a98cfe83ba46365e5aadc4964

    SHA256

    8b25993f5af76e8698a7366715ef65d4ce31a3423753b1d5a9363b1ca35a456b

    SHA512

    739084a67e7959002a15b87716bf77caf11b56b2670b05426ed44d23b724269b639fe5cc0252403d7ae4100552e3b5816105989773c7cae04f190acd907a9e9b

  • /data/data/august.mendeleev.pro/databases/google_app_measurement_local.db-wal

    Filesize

    36KB

    MD5

    9efbdf877788f6d2cc4f75984c55c29a

    SHA1

    3828db673f1aa2bc4f10b211a572ad8f02839aa3

    SHA256

    9939379e2b6a885295015e72c4413533888b03cdbaae414211fb9052f0b2e7f5

    SHA512

    d92c54c6e611c545b38491a28a9ebe96384974bab372e6bc32f1120b8e5c90eaace997f2cb226639e2d8342d242158a0f6ca1a7c72cab1e62991bf07709fe9d5

  • /data/data/august.mendeleev.pro/databases/google_app_measurement_local.db-wal

    Filesize

    4KB

    MD5

    c7e67c2b3c28735e4eb3ee7582c8666c

    SHA1

    3db409139ea19ac4ba741f4e60b02f9da1e6de99

    SHA256

    da43c3e6f0ae407063358cc428ab4012ac6725053033ad5828b1040abf56d4da

    SHA512

    86905190d6acacaeeb1a4a64cc610a5dd14aa3dc26e781240ebff800a9926e4e9c16611e332c2fc9ac23a58371ff1b4f10e4b980b97c40fa7bec05b0265b86bc

  • /data/data/august.mendeleev.pro/databases/google_app_measurement_local.db-wal

    Filesize

    4KB

    MD5

    462915d3f99ebc8bdae57cf0b79cfcce

    SHA1

    8d5294139eff0b61d8169f41ce6ce1ffa5c7ac5d

    SHA256

    e74b2876e0f13ff016ecec8775fb3bb2c71f7da9ec1dac4fdd0227482d42bc69

    SHA512

    ccc425ca27d707ff9791c1b6ae28e10fb85fa00010bb0293c72e1a4ec0b9c92e0b8d9cc575596d4aa7e464317861a83c57ecd28f12c2cd3323f7fdb06c99f125

  • /data/data/august.mendeleev.pro/databases/google_app_measurement_local.db-wal

    Filesize

    4KB

    MD5

    ae9a75dd543717a0b4a40918752ee0f0

    SHA1

    f9b2527cb2a8dd068d4473e31e534616d1b3684c

    SHA256

    638817b0c37f5b0536c4755a2789d325fbfe8c86a50d644d50820d6cbc2b2fbb

    SHA512

    1bca7e4a93528ca2599e07c9ef2f6c1b39759e0a0bb1009166c6aee913cf807c5708dc48e10707085b34eca79ca33f111d0e3fbe6890d99f6f6248fd9344793c

  • /data/data/august.mendeleev.pro/databases/google_app_measurement_local.db-wal

    Filesize

    4KB

    MD5

    a3bf76be0230c200163e8e3b33e1a7ca

    SHA1

    fd8ccda984c707340ff6a3698b2a480cc4c53ad1

    SHA256

    fd15450d2d2e1ca62a77862d355bb8d4dee6cb227df1610c18b9374c72a7d6ea

    SHA512

    f5d2d651d7bc80bb92d7e68a8eb1e9d0a45da3f74c40ed9aa10654a0154c7e5cb49ba9bee3413b56a4fb9582a5be30217eb27bc4b799068f33322a0df69a46a5

  • /data/data/august.mendeleev.pro/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/66A5979C005C-0001-10AA-4B36AD13AD77BeginSession.cls_temp

    Filesize

    77B

    MD5

    d4179182995d0e2d9a48104c3b859684

    SHA1

    aa3d9c6c62c88ee5dc8baf713e52155dba30c96a

    SHA256

    9f19c83a1414369ae856d70bcbb962632307177bfb86f608a9b5505d4d41be12

    SHA512

    0078b08a8b8d1ef5159d8254554b7a56450d10e9c843dd0ab14e1b6d8bbbfbe3f7846aa4b6f28b3b1ac7c2294bdf6fece4dc961e6469a36b6fa0c7823b52ea30

  • /data/data/august.mendeleev.pro/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/66A5979C005C-0001-10AA-4B36AD13AD77BeginSession.json

    Filesize

    132B

    MD5

    8144d666a95f47ad0d4040145e30c8da

    SHA1

    bc60b4e3d20242c1da699434faf8fd27242ef3dd

    SHA256

    c968906f573590800e651915470f45bfcd4a0d38c0e735ec5d5b001f7f79d3f9

    SHA512

    6f6b83700e310c0de3e4c21f5085b73810e1ee4a623c332d62f6ef045607ff65741b8f32eb01a2101799a1bfb4733b6f86ea2b3c3eaafb01bda58facfe683149

  • /data/data/august.mendeleev.pro/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/66A5979C005C-0001-10AA-4B36AD13AD77SessionApp.cls_temp

    Filesize

    117B

    MD5

    889a51fc579b6eba7bab40d0665a22fa

    SHA1

    728c9dd76d06ad1ee32c9e743fff48c87acfebea

    SHA256

    c0b53756b55457123780f4bc17a9a2889eb967dc6bb1d98eaa20b483b4832af9

    SHA512

    68a155fcff67a47e22b84084b15fc82df44d06f6ca760ea7ab5c71ad14cedd027585ee1c9e6fc49547adb3905b0b379c940d88de805d6967ff7daf79a4676e83

  • /data/data/august.mendeleev.pro/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/66A5979C005C-0001-10AA-4B36AD13AD77SessionApp.json

    Filesize

    231B

    MD5

    49aee470cfdf9a9dda7af0cdfe540ab1

    SHA1

    a8cf8997d90c4b903f8410b5e1d6d3d20e75e255

    SHA256

    03eddcf2f77686a265e95261fe64e2fc73c8d7eb47085f36e85e0bf79edd0425

    SHA512

    46398b51c98424b9927f22783218e74c18cbed7867f943f0deee04a8b78e6ebe7f5f3b062cda3e988b8e1593968549667b431a01e88e09ba3ea66149895fc468

  • /data/data/august.mendeleev.pro/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/66A5979C005C-0001-10AA-4B36AD13AD77SessionDevice.cls_temp

    Filesize

    48B

    MD5

    cf9cb0612d588a1f71b63084cea67316

    SHA1

    3d035bb92fd3f8997160cf8025c40239af74d3ca

    SHA256

    0d37c5a64baf86735501f9044eeb926b3d46548cdcf67c2cd1f773df36624ac9

    SHA512

    70f000233e181e3b7c6fcf07aa04fdb570f970335837f8d1c4680a9f78af9f9e17c73a0a5646770f7a8787e338899edc4a5197b023865a4da894b1aca12bf600

  • /data/data/august.mendeleev.pro/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/66A5979C005C-0001-10AA-4B36AD13AD77SessionDevice.json

    Filesize

    202B

    MD5

    75db92d50c80a89e068550028c62acec

    SHA1

    d78ea55f5dc682e4da456d26383249f608fe894f

    SHA256

    1dfc488309883b61beb3462567a9befeaf36bb475a07a7ecef2be60bedb4b5a2

    SHA512

    dbb81daa5fab357f087dc295e7861444f945eb4c3883a09926b47312ce526bc069266a8a24b2a5b4921fb13e797696c5824195f0a79317e279ccf7855ca2ee13

  • /data/data/august.mendeleev.pro/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/66A5979C005C-0001-10AA-4B36AD13AD77SessionOS.cls_temp

    Filesize

    14B

    MD5

    9b3d4522944ce6396563812bfdb92fa9

    SHA1

    6d2a6133c8f01938a48ccc77ef86ad8ca335c020

    SHA256

    d32805d685a3f50caa7f1c0bd7c8804c4d937a866513289f60e3184f7a591ed9

    SHA512

    091d87643712530bf9006135db42a5a50742bb5ca3026bcc5f2c1c17bf4fd984a8938d29263b0abde3d15cac196d2230902534e200b0b79485e3a1bd97d95727

  • /data/data/august.mendeleev.pro/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/66A5979C005C-0001-10AA-4B36AD13AD77SessionOS.json

    Filesize

    54B

    MD5

    93023624eb8dff5c20050da136aaae0a

    SHA1

    acfd1ffed752c28fb135ba83c0c6345ddf2f6995

    SHA256

    968bcd7c4f1abed89a09cc0e6dadd238a81e8655e64196b39a86be49ceecd39c

    SHA512

    bb25dfa144d3f0e17203936c503c5fedec5f9ca710e177f99e273010ba4a682199d4bda5684151d65f3cb1549f4611b3a645ce39646d3db9a1b2c17d6b160579

  • /data/data/august.mendeleev.pro/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap

    Filesize

    883B

    MD5

    2d3dd74a43f9bb7ff39e0e4041227e4d

    SHA1

    e1e8e44fdd7785b06d8660b1d5b1664fc7376d9b

    SHA256

    7b1b1a9a7dc3fa2018c47e21e224d80ca6bf50f14dc42da2cd16652cdb01b32b

    SHA512

    a3863170fe11101015da04070afcb18c08e99dc52829984231decd134cbb5b2b6c4114138459624dfe26ca27a125265f5873f4d437f7bc43bc207fa4b659ee07

  • /data/data/august.mendeleev.pro/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap

    Filesize

    434B

    MD5

    5d2ae06ff7985f1667aa7271e993fded

    SHA1

    3dc43a2832c49fa532dba18ae29fa347a1d1037c

    SHA256

    49659f857aea9b348cf5edc42946d7da69362bf40500a01ce3ba4761cac9f246

    SHA512

    d00a0afd98df0cdd79dcd254d9522a2247b0d05b09c0835f26578c99fdc9f7e582977835fb4e8b036bd643826bdf9707ebc160d0289c7e5c90a2175f0213a536

  • /data/data/august.mendeleev.pro/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap.tmp

    Filesize

    16B

    MD5

    c33583fae4e0b61cde1c5b9227963237

    SHA1

    fe2ebe4d27469af1460f7e852031a04208ef629b

    SHA256

    35c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc

    SHA512

    fa09047004bec791b23f0dade0b64f8ab9bbd67555505e0d0818f6e89dfe56f474df80db0786d081d36adf23a5bacea40275ba043444a3a85d3d9612575bdd1e

  • /data/data/august.mendeleev.pro/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_1dbab37d-84a0-48d4-8063-4f9d0743562e_1722128284935.tap

    Filesize

    348B

    MD5

    305ef2a497563c506510bc3a68f7fe95

    SHA1

    01fff7b5db3ad52c3c5f45927d0c6684559192da

    SHA256

    e63acdd615633d599524a7fae5466f06b80d233543006724634dec7c9f389a47

    SHA512

    16b4aecccdb5772a0a3a9e2127dfc84a5b6966fbf7a5218274cecc0b06d953005058de7df440f3e28efed7cc0cd27b558ec193929130eb28858661228a19d871

  • /data/data/august.mendeleev.pro/no_backup/com.google.InstanceId.properties

    Filesize

    2KB

    MD5

    ad7b987938434a422baf0743c9e9403b

    SHA1

    e308a689e9f4682eed3ef7e63a8a1450a9ee192e

    SHA256

    90b9e9d9688a5034a14af3aadaa40b1ee52e6e6ad6eb51d6a3a29a8cfa040099

    SHA512

    58833e4f63d9c06a312a498b8913a151d1b257d9354786446e371e2115d0e666d8272eacd59100b36b80a13c0575cfa3301869f29a0ab7a59113a12e7bf9505e