Analysis
- max time kernel
23s - max time network
156s - platform
android_x64 - resource
android-x64-20240624-en - resource tags
androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system - submitted
02/08/2024, 01:38
Static task
static1
Behavioral task
behavioral1
Sample
828cf6bbf51b9f5b9f96ca3e5bbef389_JaffaCakes118.apk
Resource
android-x86-arm-20240624-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
828cf6bbf51b9f5b9f96ca3e5bbef389_JaffaCakes118.apk
Resource
android-x64-20240624-en
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
828cf6bbf51b9f5b9f96ca3e5bbef389_JaffaCakes118.apk
Resource
android-x64-arm64-20240624-en
5 signatures
150 seconds
General
- Target 828cf6bbf51b9f5b9f96ca3e5bbef389_JaffaCakes118.apk
- Size 2.0MB
- Sample240802-b2cp6asfph
- SHA256 623b9b0791b7df5bd9d3dec27ac764634634e96a8dc1b91329cf85143830bcf3
- MD5 828cf6bbf51b9f5b9f96ca3e5bbef389
- SHA1 a558c46cb049d0e8b14fa4f60f652b576661dbcb
- SHA512 cb0f2c8ec3953fa075f4d449bc67d3e5091dd87c13f65dc204d56775cc8e2ab77b82a1e14cb060fb90fd704b54a9837dc88c1cfb03fcce0e768318fdd68cce23
- SSDEEP 49152:974XmxrZoLq1fuiG7rXj8ks7J7UVsaj6wE6Go0QQ73Zpg:97b6piGvXj8ksV7UqaWwE6Go1D
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
-
pid Process 5059 com.survgames.survivalislandpro.hack - Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.survgames.survivalislandpro.hack - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.survgames.survivalislandpro.hack - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.survgames.survivalislandpro.hack - Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
description ioc Process Framework service call android.app.job.IJobScheduler.schedule com.survgames.survivalislandpro.hack - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.survgames.survivalislandpro.hack - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.survgames.survivalislandpro.hack
Processes
-
com.survgames.survivalislandpro.hack1⤵
- Removes its main activity from the application launcher
- Obtains sensitive information copied to the device clipboard
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:5059
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.survgames.survivalislandpro.hack/databases/evernote_jobs.db
- Size 16KB
- SHA256 f177ffae9650eb4f407c2d9a510bb5a5abe1ece2fdfe24effc62478a1bfa5903
- MD5 12627a2ec645c4a4bc50dba5903afd59
- SHA1 504005c938517e61bcf68b65a055c2faba635c2e
- SHA512 7ff69589296e02383a217373399e75d8a82fa17146e4273f4c0eb630f096dd9f394a3324d60858b02f7e5cf177c82c6d966f5cbedb68ae6a98df7cc851b79cfd
- SSDEEP 12:TLpHpN0KkYrZASBMAB1G0d/P6dMbWAz9m9W3dOsuA3MTzeRmBEyPbBvOw:TLppOKRvTZYAZ3mGSN
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.survgames.survivalislandpro.hack/databases/evernote_jobs.db
- Size 16KB
- SHA256 9aaf40c3ab31e816cf0dad297eb889f57627f1180b771825a8a39b89b90f2fd9
- MD5 2013efa2e421b1472e68e7f300b252b2
- SHA1 56396bac333c29ae63b63ac4ccb2abb4c557d001
- SHA512 a7c377b6343e20ec95c67723d364c3a504ec51efb8155be2dde7ef5157b13faf036553325a57802eb7f9ace130049bf87133a789421b0542d5638164c7d01f5b
- SSDEEP 12:TL8SzpN0KkYrZASBMAB1G0d/P6dMbWAz9m9W3dOsuA3MTzeRmBEyPbP/U7u+:TLZzpOKRvTZYAZ3mGSP/UC+
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.survgames.survivalislandpro.hack/databases/evernote_jobs.db-journal
- Size 512B
- SHA256 ada7b30bc4b5180b1c655d0c855a4e2e29b8d9bf9030f48833b16e9da5baddd5
- MD5 61559f6cee01cf5420db9b923b9e7a0c
- SHA1 a3db9c1beeaeb4c68facbd3e63671501825a9df2
- SHA512 06a8a01723f6b7f55d086d4b1b7217feb0791409880c395bee35e758c9ff765f109ed9b3acdbea4fbdd27335c90a178b317ebecbcfc4c8ca43515454d53c54f3
- MD5 SHA1 SHA512
- Path /data/data/com.survgames.survivalislandpro.hack/databases/evernote_jobs.db-journal
- Size 8KB
- SHA256 862c8bbd6703ad498f97ef99d76050b59a776089156e565f8666e5c90290d73b
- MD5 2bd8b5ebf9017b235be08b26942fe3e3
- SHA1 5da6644467223e9e82059cf9ce801ea2d09583a1
- SHA512 05c24f70390b1099d1933bdff32a6b668dad8e52c6e8b351bcd26acb35f07d4ce9a3c5252ed8b84758175ea6981ad6a4c19ac0be20b58e87bb3d2e163d3d5654
- SSDEEP 6:7+/l9un15g9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKa:7+tEqLiuWdwRmBEyPb1
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.survgames.survivalislandpro.hack/databases/evernote_jobs.db-journal
- Size 8KB
- SHA256 9ffe04bf82d3e4331f7f6ec357dc3ac5466797cd76508c848ec3b86596e4c4d8
- MD5 aadd951a02cf7ec57967b290942356cf
- SHA1 419e879e8ce513b7799c01fea80fc30d4dcbb23b
- SHA512 386d2d1b3fff32c4f3c6d6aeb5ae5061d2ab4d660a33c47e0e77b6b1a35cfb45225c5b266dcf76b24c8ec771b8ad6e3aa73432f1d44ac4d96d47fb9113e480e3
- SSDEEP 6:7+/l9IFPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKy0l//z:7+tWBqLJdTRmBEyPbDcXz
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.survgames.survivalislandpro.hack/databases/evernote_jobs.db-journal
- Size 8KB
- SHA256 5c586d57001f0c330834623cfed406a32be2f8ea526043434819e6f47a13cafa
- MD5 de6feef5ed3e6b3adff74fc27f338f4a
- SHA1 055802392f9616367c60ab3b020902fce7d3f94e
- SHA512 13987e3b549c93e845749497e86fb60fc37a7cf87d4011ddef46077d912ca0f8f09a2f3f8e5d027299a860a10dd515435d46b353d5d3cfb678f3a50051fd271e
- SSDEEP 12:7+tMfqLpHpN0KkYrZASBMAB1G0d/P6dMbWAz9m9W3dOsuA3MTzeRmBEyPbV:7+tkqLppOKRvTZYAZ3mGSV
- MD5 SHA1 SHA512 SSDEEP