Analysis
-
max time kernel
46s -
max time network
132s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system -
submitted
28/07/2024, 00:57
Static task
static1
Behavioral task
behavioral1
Sample
0443d7669e5a19f6b5a4b599bd1c339c_JaffaCakes118.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
0443d7669e5a19f6b5a4b599bd1c339c_JaffaCakes118.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral3
Sample
0443d7669e5a19f6b5a4b599bd1c339c_JaffaCakes118.apk
Resource
android-x64-arm64-20240624-en
General
-
Target
0443d7669e5a19f6b5a4b599bd1c339c_JaffaCakes118.apk
-
Size
15.7MB
-
MD5
0443d7669e5a19f6b5a4b599bd1c339c
-
SHA1
859ab8bdf796ef1e6c5bfc56a79590f49e09f3a4
-
SHA256
552ecf57926e1d122394cdf5ee9b919c2177b9249abd768f54d3a3090bdb194b
-
SHA512
2bf77123414dc9268bcc1673aa5c8dbb4e416c52ec27299c2c6bdb3fac889100c008ae409a581ad28b511e7a7a97f124727c0d0a42a37c8a114c90b791c30d66
-
SSDEEP
393216:TmULAJP0yt1xZlTrbKxemNuL1HfRihnHXs3b:Tm6m7tnrWxeaOF4hnHXsr
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 2 IoCs
ioc Process /system/app/Superuser.apk august.mendeleev.pro /system/xbin/su august.mendeleev.pro -
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses august.mendeleev.pro -
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock august.mendeleev.pro -
Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo august.mendeleev.pro -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone august.mendeleev.pro -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver august.mendeleev.pro -
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
description ioc Process Framework service call android.app.job.IJobScheduler.schedule august.mendeleev.pro -
Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo august.mendeleev.pro
Processes
-
august.mendeleev.pro1⤵
- Checks if the Android device is rooted.
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks memory information
PID:4266
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512B
MD5e27aec34e1910643255d7bf650af3664
SHA1398e8dd4f4c93c4b0842b0a51de21eb4a34a5622
SHA2563335262e83d8245a609399f42d6eb967e358ce081bab7eebd0aa9939709f3cb0
SHA51246906fd3c18986270c7ec9e547de1cbcc0dfcc4b4e22841b8f15a2d967e1181e0d5f91a461680ed59fb050d66fb8118f097e2d19d8dbc610a5ec4be173bb6322
-
Filesize
60KB
MD5df681784bfc1565682910e2e18db0b0e
SHA104979738e6be117fd4cdd6971489ca8f63736c78
SHA256e9da424f380aee7227c257239e31446c0a45809d76acf8904cd3518d0bc57590
SHA512dd0a04f9962d4d6e81e72947a970b5acdd71294fd03dd4eb13b357bb226d066b1d94119940000a20b311a84e7ff42f118e72726087daf1e5b874a18a4f7a59c9
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD520cbb4459b7ae5d878b65401e63dbe9d
SHA1e2c4fc784719e2f382cdcc466981d3a16ea507ab
SHA2566df182770576fa6644c4e7afea678c2ac8b5b79cf4ea7116373b804a0720bac6
SHA512912b22cad3e4ef19837af327da8deecb17ce6f3dd2620b2649db54905dbf9101fff741132d86a1d1462a70873fbda68b6b7eabc68710d029362ae06225d9da20
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
156KB
MD5766847c71dab3c148c6c1d04698b4114
SHA15a88b7192b1a19787fe825cb511ebfe81965c89f
SHA25692930dfb6dce38ea3a86eb700fca1119053d2feec0bab3f42e2bd4471f1d062b
SHA512c8486f6a363b7508d68e3a76fa05771f24a6b17f3bec769b0af862be2dfa54930a1bd4ddd27d450eac8e16b7850f49afd4431a794225295d30f7e3899ccc6c7a
-
Filesize
108KB
MD5eecf636434dafdd8c4660a5749e4291a
SHA1d5c37f8ee67e0201d712245100ec36773142f45f
SHA256aa45a238e154a9d028490873ff264b4f46e5e44279fbad43c4def7c944f48445
SHA5125d34ef7ecf8a97e673491a5ee9c8155e625713a80bc611b2772871581600ef4884981b8bada9403136c6166adbed943d0cc2fa4a1dc7944fbb07b82a1a362a24
-
Filesize
512B
MD5297cb82f04ab8c1971c9c9507357aca0
SHA1a3ccd79cbe6702b416ea663036ad05929b3b073f
SHA256a8b2eb525b87e240c130c3a0777e25ab7162b1e5579eb7a4aa0deeb4ea01fb4b
SHA512a33562a0c7f87b2fb8c3c42a92ea2e81ac610a9746edd61f3b755fb5e1fdadeb8d4bf496932f0e694c9be7b0ca86d96b0ae307c51aac2fff23f0e6684aab996f
-
Filesize
414KB
MD508cb5e217e5712b9f435c844d970bf06
SHA17bf8643786d36cae1c6c79c87f83c4ec67cb0f93
SHA25657076d16104296ff380ee46667491b04be6a746a5be087955a2bce28faf639a2
SHA512d37ecdff00440177db0351feea504f2a8e653202ec13040ac1ebc1fc1d30acbed979a99e5a5f87e2f66fc62c1a516c16cfe661c4291b4c963f1018aa8f6ac9d9
-
Filesize
16KB
MD5f154925ebd7b637b5a06c91706047f0b
SHA1adf897b79c882cabb1173e62ac0caf43ea0f8554
SHA2564ed1091bcabd9840476beb60c40ab7190906a12e1465866484d338dad77e7871
SHA5124ceb9d8216b0d7b26a1b5ab79da961cc97736161529fa6bb96c57297483653c87a204d1177c165c06f4c42bafdcaa1ed7a0c4ab8b2d6de39e5b033e8643c0075
-
Filesize
16KB
MD56b63b92f6d4ec960961ab1deba76d015
SHA1bf6ffccf76f70b897c1a6cb46d129418190f509d
SHA256a16377ad9b4b59218937f24a93699b9a7cc2409814ad71504ffb45c59fc699c9
SHA51243e6e2290c76065c77021b625e5f31d41df9f98b2efec0db7e363c7b34bbbeccff92699465c899a34400ddd1195d67f580e4f0eb92479defdaebe4ea24fd9e21
-
Filesize
16KB
MD5068e235595ff7584e5de7f542b9e1b11
SHA1a1811328067d7c29c2109e4b806713ae3521ab77
SHA256e15279c01b6a836a9751a067361a021c83598365c25b1389bf001b913bbcf93b
SHA512a74d7d9bfe747333e52fa6d47a49d1acbbccfafea634c1f8c5b54a63929a3ce13316c2701119911482cfe73c3a9c45065d1e5c76a192c6f2080ce61c8595f8ef
-
Filesize
16KB
MD5b216bd4d2143fe282c2874eb2d95a52a
SHA1292b55190460ed76201f87b661f72f587f4b42d2
SHA256e382f226a3f5564468a3834666cc5ab32491b51e872ccc1ebb09c60804df7d45
SHA51239db57ed3b746cfe8f108dd448f288cc91ac29e564d9bf3aee5cfecc81065579c1a926083ff0373ac5ead8e3c20c3515d3f728d0fabdb6810c6eead353879bed
-
Filesize
16KB
MD5546ff8bd70c913ca9e14613667fc6602
SHA1689e747ef5e7b1223cfd2f622961b0eba6e4a8c6
SHA256f6f03172a557ec54a64955da327a38e6cfc4904ea22d954607624e035046526f
SHA51296f18a3d309f4e407d007ee86a506f6548fcfef5b2a5c424c2f46e114ee517bf51142e388df64bfb1ed80e56959dfd6ed207227ec407d0a59501291963e2a3d0
-
Filesize
512B
MD5710cf5dad08dbcc6e8025b4df95feb39
SHA1e21a8ec8fc1fad8a98cfe83ba46365e5aadc4964
SHA2568b25993f5af76e8698a7366715ef65d4ce31a3423753b1d5a9363b1ca35a456b
SHA512739084a67e7959002a15b87716bf77caf11b56b2670b05426ed44d23b724269b639fe5cc0252403d7ae4100552e3b5816105989773c7cae04f190acd907a9e9b
-
Filesize
36KB
MD59efbdf877788f6d2cc4f75984c55c29a
SHA13828db673f1aa2bc4f10b211a572ad8f02839aa3
SHA2569939379e2b6a885295015e72c4413533888b03cdbaae414211fb9052f0b2e7f5
SHA512d92c54c6e611c545b38491a28a9ebe96384974bab372e6bc32f1120b8e5c90eaace997f2cb226639e2d8342d242158a0f6ca1a7c72cab1e62991bf07709fe9d5
-
Filesize
4KB
MD5c7e67c2b3c28735e4eb3ee7582c8666c
SHA13db409139ea19ac4ba741f4e60b02f9da1e6de99
SHA256da43c3e6f0ae407063358cc428ab4012ac6725053033ad5828b1040abf56d4da
SHA51286905190d6acacaeeb1a4a64cc610a5dd14aa3dc26e781240ebff800a9926e4e9c16611e332c2fc9ac23a58371ff1b4f10e4b980b97c40fa7bec05b0265b86bc
-
Filesize
4KB
MD5462915d3f99ebc8bdae57cf0b79cfcce
SHA18d5294139eff0b61d8169f41ce6ce1ffa5c7ac5d
SHA256e74b2876e0f13ff016ecec8775fb3bb2c71f7da9ec1dac4fdd0227482d42bc69
SHA512ccc425ca27d707ff9791c1b6ae28e10fb85fa00010bb0293c72e1a4ec0b9c92e0b8d9cc575596d4aa7e464317861a83c57ecd28f12c2cd3323f7fdb06c99f125
-
Filesize
4KB
MD5ae9a75dd543717a0b4a40918752ee0f0
SHA1f9b2527cb2a8dd068d4473e31e534616d1b3684c
SHA256638817b0c37f5b0536c4755a2789d325fbfe8c86a50d644d50820d6cbc2b2fbb
SHA5121bca7e4a93528ca2599e07c9ef2f6c1b39759e0a0bb1009166c6aee913cf807c5708dc48e10707085b34eca79ca33f111d0e3fbe6890d99f6f6248fd9344793c
-
Filesize
4KB
MD5a3bf76be0230c200163e8e3b33e1a7ca
SHA1fd8ccda984c707340ff6a3698b2a480cc4c53ad1
SHA256fd15450d2d2e1ca62a77862d355bb8d4dee6cb227df1610c18b9374c72a7d6ea
SHA512f5d2d651d7bc80bb92d7e68a8eb1e9d0a45da3f74c40ed9aa10654a0154c7e5cb49ba9bee3413b56a4fb9582a5be30217eb27bc4b799068f33322a0df69a46a5
-
/data/data/august.mendeleev.pro/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/66A5979C005C-0001-10AA-4B36AD13AD77BeginSession.cls_temp
Filesize77B
MD5d4179182995d0e2d9a48104c3b859684
SHA1aa3d9c6c62c88ee5dc8baf713e52155dba30c96a
SHA2569f19c83a1414369ae856d70bcbb962632307177bfb86f608a9b5505d4d41be12
SHA5120078b08a8b8d1ef5159d8254554b7a56450d10e9c843dd0ab14e1b6d8bbbfbe3f7846aa4b6f28b3b1ac7c2294bdf6fece4dc961e6469a36b6fa0c7823b52ea30
-
/data/data/august.mendeleev.pro/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/66A5979C005C-0001-10AA-4B36AD13AD77BeginSession.json
Filesize132B
MD58144d666a95f47ad0d4040145e30c8da
SHA1bc60b4e3d20242c1da699434faf8fd27242ef3dd
SHA256c968906f573590800e651915470f45bfcd4a0d38c0e735ec5d5b001f7f79d3f9
SHA5126f6b83700e310c0de3e4c21f5085b73810e1ee4a623c332d62f6ef045607ff65741b8f32eb01a2101799a1bfb4733b6f86ea2b3c3eaafb01bda58facfe683149
-
/data/data/august.mendeleev.pro/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/66A5979C005C-0001-10AA-4B36AD13AD77SessionApp.cls_temp
Filesize117B
MD5889a51fc579b6eba7bab40d0665a22fa
SHA1728c9dd76d06ad1ee32c9e743fff48c87acfebea
SHA256c0b53756b55457123780f4bc17a9a2889eb967dc6bb1d98eaa20b483b4832af9
SHA51268a155fcff67a47e22b84084b15fc82df44d06f6ca760ea7ab5c71ad14cedd027585ee1c9e6fc49547adb3905b0b379c940d88de805d6967ff7daf79a4676e83
-
/data/data/august.mendeleev.pro/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/66A5979C005C-0001-10AA-4B36AD13AD77SessionApp.json
Filesize231B
MD549aee470cfdf9a9dda7af0cdfe540ab1
SHA1a8cf8997d90c4b903f8410b5e1d6d3d20e75e255
SHA25603eddcf2f77686a265e95261fe64e2fc73c8d7eb47085f36e85e0bf79edd0425
SHA51246398b51c98424b9927f22783218e74c18cbed7867f943f0deee04a8b78e6ebe7f5f3b062cda3e988b8e1593968549667b431a01e88e09ba3ea66149895fc468
-
/data/data/august.mendeleev.pro/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/66A5979C005C-0001-10AA-4B36AD13AD77SessionDevice.cls_temp
Filesize48B
MD5cf9cb0612d588a1f71b63084cea67316
SHA13d035bb92fd3f8997160cf8025c40239af74d3ca
SHA2560d37c5a64baf86735501f9044eeb926b3d46548cdcf67c2cd1f773df36624ac9
SHA51270f000233e181e3b7c6fcf07aa04fdb570f970335837f8d1c4680a9f78af9f9e17c73a0a5646770f7a8787e338899edc4a5197b023865a4da894b1aca12bf600
-
/data/data/august.mendeleev.pro/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/66A5979C005C-0001-10AA-4B36AD13AD77SessionDevice.json
Filesize202B
MD575db92d50c80a89e068550028c62acec
SHA1d78ea55f5dc682e4da456d26383249f608fe894f
SHA2561dfc488309883b61beb3462567a9befeaf36bb475a07a7ecef2be60bedb4b5a2
SHA512dbb81daa5fab357f087dc295e7861444f945eb4c3883a09926b47312ce526bc069266a8a24b2a5b4921fb13e797696c5824195f0a79317e279ccf7855ca2ee13
-
/data/data/august.mendeleev.pro/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/66A5979C005C-0001-10AA-4B36AD13AD77SessionOS.cls_temp
Filesize14B
MD59b3d4522944ce6396563812bfdb92fa9
SHA16d2a6133c8f01938a48ccc77ef86ad8ca335c020
SHA256d32805d685a3f50caa7f1c0bd7c8804c4d937a866513289f60e3184f7a591ed9
SHA512091d87643712530bf9006135db42a5a50742bb5ca3026bcc5f2c1c17bf4fd984a8938d29263b0abde3d15cac196d2230902534e200b0b79485e3a1bd97d95727
-
/data/data/august.mendeleev.pro/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/66A5979C005C-0001-10AA-4B36AD13AD77SessionOS.json
Filesize54B
MD593023624eb8dff5c20050da136aaae0a
SHA1acfd1ffed752c28fb135ba83c0c6345ddf2f6995
SHA256968bcd7c4f1abed89a09cc0e6dadd238a81e8655e64196b39a86be49ceecd39c
SHA512bb25dfa144d3f0e17203936c503c5fedec5f9ca710e177f99e273010ba4a682199d4bda5684151d65f3cb1549f4611b3a645ce39646d3db9a1b2c17d6b160579
-
/data/data/august.mendeleev.pro/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap
Filesize883B
MD52d3dd74a43f9bb7ff39e0e4041227e4d
SHA1e1e8e44fdd7785b06d8660b1d5b1664fc7376d9b
SHA2567b1b1a9a7dc3fa2018c47e21e224d80ca6bf50f14dc42da2cd16652cdb01b32b
SHA512a3863170fe11101015da04070afcb18c08e99dc52829984231decd134cbb5b2b6c4114138459624dfe26ca27a125265f5873f4d437f7bc43bc207fa4b659ee07
-
/data/data/august.mendeleev.pro/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap
Filesize434B
MD55d2ae06ff7985f1667aa7271e993fded
SHA13dc43a2832c49fa532dba18ae29fa347a1d1037c
SHA25649659f857aea9b348cf5edc42946d7da69362bf40500a01ce3ba4761cac9f246
SHA512d00a0afd98df0cdd79dcd254d9522a2247b0d05b09c0835f26578c99fdc9f7e582977835fb4e8b036bd643826bdf9707ebc160d0289c7e5c90a2175f0213a536
-
/data/data/august.mendeleev.pro/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap.tmp
Filesize16B
MD5c33583fae4e0b61cde1c5b9227963237
SHA1fe2ebe4d27469af1460f7e852031a04208ef629b
SHA25635c6d6e5b93657e4a741a1cec71c21813fe05aab219909ebbb0f62fb0ae648dc
SHA512fa09047004bec791b23f0dade0b64f8ab9bbd67555505e0d0818f6e89dfe56f474df80db0786d081d36adf23a5bacea40275ba043444a3a85d3d9612575bdd1e
-
/data/data/august.mendeleev.pro/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_1dbab37d-84a0-48d4-8063-4f9d0743562e_1722128284935.tap
Filesize348B
MD5305ef2a497563c506510bc3a68f7fe95
SHA101fff7b5db3ad52c3c5f45927d0c6684559192da
SHA256e63acdd615633d599524a7fae5466f06b80d233543006724634dec7c9f389a47
SHA51216b4aecccdb5772a0a3a9e2127dfc84a5b6966fbf7a5218274cecc0b06d953005058de7df440f3e28efed7cc0cd27b558ec193929130eb28858661228a19d871
-
Filesize
2KB
MD5ad7b987938434a422baf0743c9e9403b
SHA1e308a689e9f4682eed3ef7e63a8a1450a9ee192e
SHA25690b9e9d9688a5034a14af3aadaa40b1ee52e6e6ad6eb51d6a3a29a8cfa040099
SHA51258833e4f63d9c06a312a498b8913a151d1b257d9354786446e371e2115d0e666d8272eacd59100b36b80a13c0575cfa3301869f29a0ab7a59113a12e7bf9505e