Analysis

  • max time kernel
    177s
  • max time network
    171s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240624-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
  • submitted
    29/07/2024, 22:23

General

  • Target
    642b3b062d5a71332e5a08c468a2457a_JaffaCakes118.apk
  • Size 3.8MB
  • Sample240729-2axt5axhrb
  • SHA256 5c95001612ce83a25a7efd51db4f3aab4d17cacbc6392b088535787412a83370
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 5 IoCs
  • Queries information about running processes on the device 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Acquires the wake lock 2 IoCs
  • Queries information about active data network 1 TTPs 2 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Schedules tasks to execute at a specified time 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.jalkipalki.vika
    1⤵
    • Checks if the Android device is rooted.
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Queries information about active data network
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks memory information
    PID:4497
  • com.jalkipalki.vika:Metrica
    1⤵
    • Checks if the Android device is rooted.
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Queries information about active data network
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4545

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        OneSignal.db

        • Path /data/user/0/com.jalkipalki.vika/databases/OneSignal.db
        • Size 52KB
        • SHA256 802cb04095337d676e9516d13b9653adf3764637006c37162ac8df6f06f22417
        • MD5 SHA1 SHA512 SSDEEP

        OneSignal.db-journal

        • Path /data/user/0/com.jalkipalki.vika/databases/OneSignal.db-journal
        • Size 8KB
        • SHA256 441192a2cc054d08c747340d689e43ff481a90b6c60e5ae286c73a65607dba5c
        • MD5 SHA1 SHA512 SSDEEP

        OneSignal.db-journal

        • Path /data/user/0/com.jalkipalki.vika/databases/OneSignal.db-journal
        • Size 8KB
        • SHA256 0bca8e13f9a23dd4600a87029551658adc5287ac783fe97dfe479463544fe0ae
        • MD5 SHA1 SHA512 SSDEEP

        OneSignal.db-journal

        • Path /data/user/0/com.jalkipalki.vika/databases/OneSignal.db-journal
        • Size 512B
        • SHA256 1f3a57f9170c5f895f7d3430bb2f11d3483546ffae07089d252d4e60f303ce2a
        • MD5 SHA1 SHA512

        Mint-lastsavedfile

        • Path /data/user/0/com.jalkipalki.vika/files/Mint-lastsavedfile
        • Size 512B
        • SHA256 c19641da0f31a181800ad48e1a544f249ae355040d697ddb79a174a0a0075a39
        • MD5 SHA1 SHA512

        MintSavedData-1-1722293869626.json

        • Path /data/user/0/com.jalkipalki.vika/files/MintSavedData-1-1722293869626.json
        • Size 12KB
        • SHA256 dc96ad49bfd80c6b94802597956796d2ae6c40b69ccf040687a94655507e0790
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb

        • Path /data/user/0/com.jalkipalki.vika/no_backup/androidx.work.workdb
        • Size 12KB
        • SHA256 4c65e59b684b9d7a55b86fa4aa75ba40c7d73bab4ad7cd6dc7cbd161957697f5
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-journal

        • Path /data/user/0/com.jalkipalki.vika/no_backup/androidx.work.workdb-journal
        • Size 116KB
        • SHA256 005f38b62cb912901c5eff7e3d493a3e83f8bbcaa92f07d82280ed3793d56fe9
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-shm

        • Path /data/user/0/com.jalkipalki.vika/no_backup/androidx.work.workdb-shm
        • Size 36KB
        • SHA256 ae0c7f73454d94f1f9ca30f39b89c479fe705c2744864aeff5bbae6be06a41c2
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/user/0/com.jalkipalki.vika/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 0bc428f8f09794503300ce552fd8e5f0ca9402ef21642de611e865a109a093ea
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/user/0/com.jalkipalki.vika/no_backup/androidx.work.workdb-wal
        • Size 108KB
        • SHA256 ba5d6f270b627cf666514c21b4a02f777d67b8df293531502dbcb94f6da1f7ee
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/user/0/com.jalkipalki.vika/no_backup/androidx.work.workdb-wal
        • Size 277KB
        • SHA256 66e4daeb85bc9efea159029185f743b5e2db509afb46e12bd964ec89685d1de2
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/user/0/com.jalkipalki.vika/no_backup/androidx.work.workdb-wal
        • Size 253KB
        • SHA256 12fe5ce346e145575b67f2dd43c540ab3921faa30d56fa49569ddf5bc49778c2
        • MD5 SHA1 SHA512 SSDEEP

        com.google.InstanceId.properties

        • Path /data/user/0/com.jalkipalki.vika/no_backup/com.google.InstanceId.properties
        • Size 12KB
        • SHA256 1841be0e95315975cd2e4085b646466482f2f2747503d84bca86e16084719b8d
        • MD5 SHA1 SHA512 SSDEEP

        credentials.dat

        • Path /data/user/0/com.jalkipalki.vika/no_backup/credentials.dat
        • Size 226B
        • SHA256 f3b0f293e43745c5bba4dfb35245c80fc7d4c30101965a1988653076c61369fd
        • MD5 SHA1 SHA512

        db_metrica_com.jalkipalki.vika-journal

        • Path /data/user/0/com.jalkipalki.vika/no_backup/db_metrica_com.jalkipalki.vika-journal
        • Size 8KB
        • SHA256 175683c0951c95b8b062484295ac851cb5e5c2cea3bb82d84c258429e3c009ca
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.jalkipalki.vika-journal

        • Path /data/user/0/com.jalkipalki.vika/no_backup/db_metrica_com.jalkipalki.vika-journal
        • Size 8KB
        • SHA256 f91e047f51f2c7f92b01e5ef3b9ed4d0794fedce28b586bff266ae719c0bc2b5
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.jalkipalki.vika-journal

        • Path /data/user/0/com.jalkipalki.vika/no_backup/db_metrica_com.jalkipalki.vika-journal
        • Size 12KB
        • SHA256 9f48e1ee982862e14ebdfac850b7670e30eceefd58a0701724d46e6af7c87ca9
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.jalkipalki.vika_20799a27-fa80-4b36-b2db-0f8141f24180

        • Path /data/user/0/com.jalkipalki.vika/no_backup/db_metrica_com.jalkipalki.vika_20799a27-fa80-4b36-b2db-0f8141f24180
        • Size 36KB
        • SHA256 2e6ad1ba837494a77a5c536b7a7c65320f8c6fb68d8aa469d7f8e576a9a6872e
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.jalkipalki.vika_20799a27-fa80-4b36-b2db-0f8141f24180-journal

        • Path /data/user/0/com.jalkipalki.vika/no_backup/db_metrica_com.jalkipalki.vika_20799a27-fa80-4b36-b2db-0f8141f24180-journal
        • Size 12KB
        • SHA256 e128ac4cd4eafa8b230ed8abc1ab59896e33a8ea5b7877b4dd89227644165677
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.jalkipalki.vika_20799a27-fa80-4b36-b2db-0f8141f24180-journal

        • Path /data/user/0/com.jalkipalki.vika/no_backup/db_metrica_com.jalkipalki.vika_20799a27-fa80-4b36-b2db-0f8141f24180-journal
        • Size 20KB
        • SHA256 34eeb88b2183ca5eab7b3c7ac39afed57063bbff0ec98a54d4d8d411846988dd
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.jalkipalki.vika_20799a27-fa80-4b36-b2db-0f8141f24180-journal

        • Path /data/user/0/com.jalkipalki.vika/no_backup/db_metrica_com.jalkipalki.vika_20799a27-fa80-4b36-b2db-0f8141f24180-journal
        • Size 12KB
        • SHA256 7376810616e0c8caa277c8f749456601e7030424e99ff12774db5b646717f675
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.jalkipalki.vika_20799a27-fa80-4b36-b2db-0f8141f24180-journal

        • Path /data/user/0/com.jalkipalki.vika/no_backup/db_metrica_com.jalkipalki.vika_20799a27-fa80-4b36-b2db-0f8141f24180-journal
        • Size 12KB
        • SHA256 fcf41e7e5699f8257355288b5a4aa603fdb39183e882598eaedb34b02c7986f0
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db

        • Path /data/user/0/com.jalkipalki.vika/no_backup/metrica_client_data.db
        • Size 20KB
        • SHA256 08ccd9f47cd9146d7391eacf96d0c49ffde764bb685e2f69b2797b42d7fcd753
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db

        • Path /data/user/0/com.jalkipalki.vika/no_backup/metrica_client_data.db
        • Size 20KB
        • SHA256 d6d65421dac425ed42a96af8b94a1d708f6e23b556f0bc80011eb4970304b7f9
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db

        • Path /data/user/0/com.jalkipalki.vika/no_backup/metrica_client_data.db
        • Size 20KB
        • SHA256 9aa1c0eaf38d5dc9d215341497e35faf02e676638e10e335666259b3f4815afb
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db

        • Path /data/user/0/com.jalkipalki.vika/no_backup/metrica_client_data.db
        • Size 44KB
        • SHA256 3e4d7584b312d5c355589113e86d43b89b923abc49b6a522555b12e4f30b13b9
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db-journal

        • Path /data/user/0/com.jalkipalki.vika/no_backup/metrica_client_data.db-journal
        • Size 12KB
        • SHA256 d9d3d82ef09574275f75a4ed58ebe56ad73075ad7bfa1efb60dc719d0b524b7c
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db-journal

        • Path /data/user/0/com.jalkipalki.vika/no_backup/metrica_client_data.db-journal
        • Size 512B
        • SHA256 f578353dabf3d14d853ded345743c2bd18da8a2c2097b25cdccb008003380591
        • MD5 SHA1 SHA512

        metrica_client_data.db-journal

        • Path /data/user/0/com.jalkipalki.vika/no_backup/metrica_client_data.db-journal
        • Size 12KB
        • SHA256 20ce234efb4254b93aebe6667e288f9374a9fa019b3de2469f9bb26161484aa2
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db-journal

        • Path /data/user/0/com.jalkipalki.vika/no_backup/metrica_client_data.db-journal
        • Size 12KB
        • SHA256 4c4515043b39bd930588a9c4727d87167a4edf2d9df5249f0320faca3b446e61
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db-journal

        • Path /data/user/0/com.jalkipalki.vika/no_backup/metrica_client_data.db-journal
        • Size 20KB
        • SHA256 09d1ae2f03b87c57bc06a35292978da25aa18752ff8407cd3f194973ccca3d2a
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db-journal

        • Path /data/user/0/com.jalkipalki.vika/no_backup/metrica_client_data.db-journal
        • Size 12KB
        • SHA256 538f328c92df9a5b07dda675b1564c3c214fe8456a43af51469b5fc441a2322d
        • MD5 SHA1 SHA512 SSDEEP