Analysis

  • max time kernel
    137s
  • max time network
    168s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    29/07/2024, 22:23

General

  • Target
    642b3b062d5a71332e5a08c468a2457a_JaffaCakes118.apk
  • Size 3.8MB
  • Sample240729-2axt5axhrb
  • SHA256 5c95001612ce83a25a7efd51db4f3aab4d17cacbc6392b088535787412a83370
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 3 IoCs
  • Queries information about running processes on the device 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Acquires the wake lock 2 IoCs
  • Queries information about active data network 1 TTPs 2 IoCs
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.jalkipalki.vika
    1⤵
    • Checks if the Android device is rooted.
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Queries information about active data network
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks memory information
    PID:4969
  • com.jalkipalki.vika:Metrica
    1⤵
    • Checks if the Android device is rooted.
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5050

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        OneSignal.db

        • Path /data/data/com.jalkipalki.vika/databases/OneSignal.db
        • Size 52KB
        • SHA256 c17b0ff6f351266dfc375282c9ee02b8263348390207cec71835d7e0956419e3
        • MD5 SHA1 SHA512 SSDEEP

        OneSignal.db-journal

        • Path /data/data/com.jalkipalki.vika/databases/OneSignal.db-journal
        • Size 8KB
        • SHA256 396cf9144fa4b990ac6770047d3feb6c6a2612159484dfb6d5dea46b5b13d4cf
        • MD5 SHA1 SHA512 SSDEEP

        OneSignal.db-journal

        • Path /data/data/com.jalkipalki.vika/databases/OneSignal.db-journal
        • Size 512B
        • SHA256 91b96d14921bb316a6feddbea770658ecf56a6cb773b0a3146e02911981435cf
        • MD5 SHA1 SHA512

        OneSignal.db-journal

        • Path /data/data/com.jalkipalki.vika/databases/OneSignal.db-journal
        • Size 8KB
        • SHA256 129bf7064459adebfe9985ab4a8ea49bf4b6df45ccc120c8eb68ade5850694f8
        • MD5 SHA1 SHA512 SSDEEP

        crashCounter

        • Path /data/data/com.jalkipalki.vika/files/crashCounter
        • Size 512B
        • SHA256 31de055a452d268d23e8412c88fcd8e40a384e05da292d9e8d4dbebfbf1cff15
        • MD5 SHA1 SHA512

        credentials.dat

        • Path /data/data/com.jalkipalki.vika/files/credentials.dat
        • Size 226B
        • SHA256 7467f36b768285a2765b06f5a57640b72bcef5dc8b5c8f3c51f04400dd8dbc3d
        • MD5 SHA1 SHA512

        lastCrashID

        • Path /data/data/com.jalkipalki.vika/files/lastCrashID
        • Size 281KB
        • SHA256 da5f2d0a3f39d7d3a35664a10e353d676fea5052087c4fea26a570e7ba149caf
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb

        • Path /data/data/com.jalkipalki.vika/no_backup/androidx.work.workdb
        • Size 12KB
        • SHA256 ae7f9f82073dd52da6dc83ccf51bb1f3211cfc60ccb88c9ba078a3911763dd85
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-journal

        • Path /data/data/com.jalkipalki.vika/no_backup/androidx.work.workdb-journal
        • Size 12KB
        • SHA256 9884f05ccc2ff5f02326c7cf1a8762b1d837c6ecb06ef1f827a57ca63e5afb84
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-shm

        • Path /data/data/com.jalkipalki.vika/no_backup/androidx.work.workdb-shm
        • Size 76KB
        • SHA256 618a6f9b39783e37d41d8d65856c660757f9add92a3ad5e57969c2e69b262a7a
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.jalkipalki.vika/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 34291d560669297843db1dc45e9d5b1c904b853a9f7c64f5f5c2fb9f4fb2ba17
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.jalkipalki.vika/no_backup/androidx.work.workdb-wal
        • Size 116KB
        • SHA256 fe9934bcbcd2c071ca5a106e41c8dec8e1847db413b2f1eb57d4b738fcc0c98e
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.jalkipalki.vika/no_backup/androidx.work.workdb-wal
        • Size 108KB
        • SHA256 a71de9815136eb2297a142e03bad2fce29d1858582a0682f1e15eaec3118d852
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.jalkipalki.vika/no_backup/androidx.work.workdb-wal
        • Size 193KB
        • SHA256 6414d2ec4f3a87dfd3943c6a39077b5260df776f969beb7e2d01c69643686850
        • MD5 SHA1 SHA512 SSDEEP

        com.google.InstanceId.properties

        • Path /data/data/com.jalkipalki.vika/no_backup/com.google.InstanceId.properties
        • Size 12KB
        • SHA256 c648e95d3f9ac420ff988f567007f22bceaeb2f67c72bc3194fad862d6232ada
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.jalkipalki.vika-journal

        • Path /data/data/com.jalkipalki.vika/no_backup/db_metrica_com.jalkipalki.vika-journal
        • Size 8KB
        • SHA256 fb0934fbde2bf14ac81bb62327159d153610e5e0ef369356c848bb380350679b
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.jalkipalki.vika-journal

        • Path /data/data/com.jalkipalki.vika/no_backup/db_metrica_com.jalkipalki.vika-journal
        • Size 12KB
        • SHA256 881dd5374b45d6e4e25bcd5e3adf671fa40eccc358a239d884985a5ce53c6e81
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.jalkipalki.vika-journal

        • Path /data/data/com.jalkipalki.vika/no_backup/db_metrica_com.jalkipalki.vika-journal
        • Size 44KB
        • SHA256 30e996341e32286df6a74074d7e447b7a735a7ef4759c03b8966d6f0c217d09f
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.jalkipalki.vika_20799a27-fa80-4b36-b2db-0f8141f24180

        • Path /data/data/com.jalkipalki.vika/no_backup/db_metrica_com.jalkipalki.vika_20799a27-fa80-4b36-b2db-0f8141f24180
        • Size 36KB
        • SHA256 d77874aac0df210e2c294f000583f0676ecbe69ca4342ed46e78bde4802463fb
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.jalkipalki.vika_20799a27-fa80-4b36-b2db-0f8141f24180-journal

        • Path /data/data/com.jalkipalki.vika/no_backup/db_metrica_com.jalkipalki.vika_20799a27-fa80-4b36-b2db-0f8141f24180-journal
        • Size 8KB
        • SHA256 c7b7ecff32e64be3f7276e20eb5f195bc35fcb693de084f8e687c3f85e7330df
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.jalkipalki.vika_20799a27-fa80-4b36-b2db-0f8141f24180-journal

        • Path /data/data/com.jalkipalki.vika/no_backup/db_metrica_com.jalkipalki.vika_20799a27-fa80-4b36-b2db-0f8141f24180-journal
        • Size 8KB
        • SHA256 7507d33da86fa7e755df3983e122d70b83ddf3e3a2a2d6ccdc0079d9c29f0c6b
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.jalkipalki.vika_20799a27-fa80-4b36-b2db-0f8141f24180-journal

        • Path /data/data/com.jalkipalki.vika/no_backup/db_metrica_com.jalkipalki.vika_20799a27-fa80-4b36-b2db-0f8141f24180-journal
        • Size 12KB
        • SHA256 d374623ebf2df671f917bf8608d25d32526e71a12ecce15dbd39852ff691344f
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.jalkipalki.vika_20799a27-fa80-4b36-b2db-0f8141f24180-journal

        • Path /data/data/com.jalkipalki.vika/no_backup/db_metrica_com.jalkipalki.vika_20799a27-fa80-4b36-b2db-0f8141f24180-journal
        • Size 12KB
        • SHA256 ae573906b281df53622ce91d69999a95ece533a6ce55156f416d059aa0ed756a
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.jalkipalki.vika_20799a27-fa80-4b36-b2db-0f8141f24180-journal

        • Path /data/data/com.jalkipalki.vika/no_backup/db_metrica_com.jalkipalki.vika_20799a27-fa80-4b36-b2db-0f8141f24180-journal
        • Size 12KB
        • SHA256 d0c4ace79998a8c48cf7365d1f5aedc661afe4c3162a4ebaf092a0c1942952b8
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db

        • Path /data/data/com.jalkipalki.vika/no_backup/metrica_client_data.db
        • Size 20KB
        • SHA256 15bec7d1bc7915c8bbb19598ee41513f683617b0e9bc9093538ddec336aabefa
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db

        • Path /data/data/com.jalkipalki.vika/no_backup/metrica_client_data.db
        • Size 20KB
        • SHA256 743773046589f4b141b1798ae1dc8da7ee29f5dffbe364eeca56439f578ee243
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db

        • Path /data/data/com.jalkipalki.vika/no_backup/metrica_client_data.db
        • Size 20KB
        • SHA256 4564ec31a51694e8349f462d5ada137b3f37b7c42515a7fe34ea8ef33b5063c5
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db

        • Path /data/data/com.jalkipalki.vika/no_backup/metrica_client_data.db
        • Size 20KB
        • SHA256 444b756adff2a36b6317106459b25472522071ea11c96d621b89c344d650bca5
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db

        • Path /data/data/com.jalkipalki.vika/no_backup/metrica_client_data.db
        • Size 20KB
        • SHA256 0163a61adcd43072de2eaa3480548f942e420afe02e23e9b8e8edd5739d2e911
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db-journal

        • Path /data/data/com.jalkipalki.vika/no_backup/metrica_client_data.db-journal
        • Size 12KB
        • SHA256 08070857276bc5c1d1b0cdc3594a0155768c4681c90a2cdfbf9310f9a01ee0c9
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db-journal

        • Path /data/data/com.jalkipalki.vika/no_backup/metrica_client_data.db-journal
        • Size 12KB
        • SHA256 7e086f3ce1eafc9241bf804a9da420e78114351c9b14dc643862b2244fda0a52
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db-journal

        • Path /data/data/com.jalkipalki.vika/no_backup/metrica_client_data.db-journal
        • Size 12KB
        • SHA256 bce0656b7810689dc8e939c65ebc5591fb3404b2845e6ff81d481c601864ce21
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db-journal

        • Path /data/data/com.jalkipalki.vika/no_backup/metrica_client_data.db-journal
        • Size 12KB
        • SHA256 473b566d57af0760478eff4f477f9974bf8ad181fdc3df76e525f4262faab110
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db-journal

        • Path /data/data/com.jalkipalki.vika/no_backup/metrica_client_data.db-journal
        • Size 8KB
        • SHA256 85c28d172817781c46b6265a6dd34ec29e8b783c7f5fa1b91a72a31fd0d76094
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db-journal

        • Path /data/data/com.jalkipalki.vika/no_backup/metrica_client_data.db-journal
        • Size 20KB
        • SHA256 bc827a25047e676aea32007c420dfb4b0b537a1d720df2c7b54a891d46a3e065
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db-journal

        • Path /data/data/com.jalkipalki.vika/no_backup/metrica_client_data.db-journal
        • Size 44KB
        • SHA256 63fcbbd904002bd92f6620a5c7e5c368ad2b9edeea1ea02526cb651c1b132d73
        • MD5 SHA1 SHA512 SSDEEP