Analysis
-
max time kernel
20s -
max time network
132s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
-
submitted
12/08/2024, 11:03
General
-
Target
8e7e17a43a1287bea0e338cc1537d007_JaffaCakes118.apk
-
Size
402KB
-
MD5
8e7e17a43a1287bea0e338cc1537d007
-
SHA1
c306a28179b895facd2ad41c26e316db80237a0f
-
SHA256
b11fecbbba9f4d9184435ac6166c498fe218ebd6e831ed8153eb744e241bf84f
-
SHA512
74d6d976706679493cd28c3f5419c93d59e1ab7cebf7fd11f2932634377d9fb596a16839e212be4ea4060c2be41e7906c7ae4cf97be43162ee3ea62850c0f180
-
SSDEEP
6144:PhZbvJDVildsL4mzEZubIeP3hHkKT690FdGqFicj98PIzuWxWGqYE/yu7JlmCB1u:PPvi6VAZe3Jth+WQGq3bs2Tlu9
Score
7/10
Malware Config
Signatures
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Acquires the wake lock 1 IoCs
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
me.rimgpv.jhglkr.ktpr1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information