Analysis

  • max time kernel
    130s
  • max time network
    191s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    15/08/2024, 14:33

General

  • Target
    9a6a0065d390836ece27df30ba14db7f_JaffaCakes118.apk
  • Size 5.0MB
  • Sample240815-rxayrs1dlm
  • SHA256 4da1a07d52db4243c001d32265f0a1951091bfde058c4919ef2e973a24c2a8ca
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Signatures

  • SMSFactory

    SMSFactory is an Android SMS trojan malware first seen in Jun 2022.

  • Checks if the Android device is rooted. 1 TTPs 3 IoCs
  • Acquires the wake lock 2 IoCs
  • Queries information about active data network 1 TTPs 2 IoCs
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.cmplay.dancingline.hack
    1⤵
    • Checks if the Android device is rooted.
    • Acquires the wake lock
    • Queries information about active data network
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks memory information
    PID:4936
  • com.cmplay.dancingline.hack:Metrica
    1⤵
    • Checks if the Android device is rooted.
    • Acquires the wake lock
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4981

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        OneSignal.db

        • Path /data/data/com.cmplay.dancingline.hack/databases/OneSignal.db
        • Size 52KB
        • SHA256 c17b0ff6f351266dfc375282c9ee02b8263348390207cec71835d7e0956419e3
        • MD5 SHA1 SHA512 SSDEEP

        OneSignal.db-journal

        • Path /data/data/com.cmplay.dancingline.hack/databases/OneSignal.db-journal
        • Size 8KB
        • SHA256 03b3d862a38650ea854e7910ee7f928a10aabeea15c6e61a1b8061abc951c0c8
        • MD5 SHA1 SHA512 SSDEEP

        OneSignal.db-journal

        • Path /data/data/com.cmplay.dancingline.hack/databases/OneSignal.db-journal
        • Size 44KB
        • SHA256 b86dfa3255b502a3e7acd187b76eae6c82ee5bf55458c5e28ed17b220a71b150
        • MD5 SHA1 SHA512 SSDEEP

        OneSignal.db-journal

        • Path /data/data/com.cmplay.dancingline.hack/databases/OneSignal.db-journal
        • Size 8KB
        • SHA256 0461e44eed13dedbcd5453c07afbe2973d4b83ac9f7f49ecdc10ba63053c6213
        • MD5 SHA1 SHA512 SSDEEP

        Mint-lastsavedfile

        • Path /data/data/com.cmplay.dancingline.hack/files/Mint-lastsavedfile
        • Size 36KB
        • SHA256 0be0eaf014a209f2cb92b0b76b0af683d4248bca91220a5704c8c358d3bea11b
        • MD5 SHA1 SHA512 SSDEEP

        Mint-lastsavedfile

        • Path /data/data/com.cmplay.dancingline.hack/files/Mint-lastsavedfile
        • Size 226B
        • SHA256 fdbfffff3804a6c3dced57928ce0e3455025cc1319f1d8f95350a39e38326d08
        • MD5 SHA1 SHA512

        MintSavedData-1-1723732448840.json

        • Path /data/data/com.cmplay.dancingline.hack/files/MintSavedData-1-1723732448840.json
        • Size 116KB
        • SHA256 46a5918ee47b128bb77006b4c5a293b1dc2c1a635caf0ec569e4ae939f407147
        • MD5 SHA1 SHA512 SSDEEP

        MintSavedData-1-1723732448840.json

        • Path /data/data/com.cmplay.dancingline.hack/files/MintSavedData-1-1723732448840.json
        • Size 3KB
        • SHA256 5875b6dde2fbdd07a55b9488e8487498400f022d88f8a02993815241a228cc57
        • MD5 SHA1 SHA512

        crashCounter

        • Path /data/data/com.cmplay.dancingline.hack/files/crashCounter
        • Size 12KB
        • SHA256 19b5abe31c8139eda4d2a99648384b678de322cf034e02a8ae3912352644e7c8
        • MD5 SHA1 SHA512 SSDEEP

        lastCrashID

        • Path /data/data/com.cmplay.dancingline.hack/files/lastCrashID
        • Size 8KB
        • SHA256 653add95e9d9b4a510cb39aef397dd6e392c1beeb3ae3145bf575916aaec2d15
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb

        • Path /data/data/com.cmplay.dancingline.hack/no_backup/androidx.work.workdb
        • Size 4KB
        • SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
        • MD5 SHA1 SHA512

        androidx.work.workdb-journal

        • Path /data/data/com.cmplay.dancingline.hack/no_backup/androidx.work.workdb-journal
        • Size 12KB
        • SHA256 6f046d737a51f92c39c99c639debb949b6c56c0d958c25f04cf60e37b034f243
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-shm

        • Path /data/data/com.cmplay.dancingline.hack/no_backup/androidx.work.workdb-shm
        • Size 84KB
        • SHA256 3de563d1e7973bfcdac984dc3379d21ab491f2e5ee264b6a934d1d3bfd74f55d
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.cmplay.dancingline.hack/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 2053b068d456130c37d187e4a4a7782f93a27b6e4f3dabb019bc6fc2bbd70d98
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.cmplay.dancingline.hack/no_backup/androidx.work.workdb-wal
        • Size 108KB
        • SHA256 e1dca56152138f851b3ece9661b0683aeb5d833d4e2e2c118a58696e2de99821
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.cmplay.dancingline.hack/no_backup/androidx.work.workdb-wal
        • Size 213KB
        • SHA256 0fc814f4d5d10c1857f93504997b528b22599785234d44aeb168285afb032504
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.cmplay.dancingline.hack/no_backup/androidx.work.workdb-wal
        • Size 317KB
        • SHA256 fc04d8f5047a9e1f595bae52def8f63174d4537c1b919a2c48a3a7d01e77ee76
        • MD5 SHA1 SHA512 SSDEEP

        com.google.InstanceId.properties

        • Path /data/data/com.cmplay.dancingline.hack/no_backup/com.google.InstanceId.properties
        • Size 8KB
        • SHA256 aca1b08444d959ec251d7ea0b94762e5c3a36c163d59582dae407341cceacfb9
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.cmplay.dancingline.hack-journal

        • Path /data/data/com.cmplay.dancingline.hack/no_backup/db_metrica_com.cmplay.dancingline.hack-journal
        • Size 512B
        • SHA256 f8b68984e846e0efb9a1db056d147941cdf99742cc960db0930b1c4418a5e36e
        • MD5 SHA1 SHA512

        db_metrica_com.cmplay.dancingline.hack-journal

        • Path /data/data/com.cmplay.dancingline.hack/no_backup/db_metrica_com.cmplay.dancingline.hack-journal
        • Size 8KB
        • SHA256 972f4fc55bd287bf4a7a2c9b4c5a41ab0e7a4f8b128b01d333c6b702d7649a69
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.cmplay.dancingline.hack-journal

        • Path /data/data/com.cmplay.dancingline.hack/no_backup/db_metrica_com.cmplay.dancingline.hack-journal
        • Size 12KB
        • SHA256 db047fd22dde2f9cfcd1aa6cbcbfe06407b7dbd9f0b3c1e42457c44622d80f9a
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.cmplay.dancingline.hack-journal

        • Path /data/data/com.cmplay.dancingline.hack/no_backup/db_metrica_com.cmplay.dancingline.hack-journal
        • Size 56KB
        • SHA256 98775ee89a805a505891af05afb37c4b34d3983cdc7d3e85d81b3fc612114929
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.cmplay.dancingline.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal

        • Path /data/data/com.cmplay.dancingline.hack/no_backup/db_metrica_com.cmplay.dancingline.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal
        • Size 512B
        • SHA256 581e99c4a5b5037ab99ab818a13a0637d28db0022af8a63ccf7d0747ec435c4b
        • MD5 SHA1 SHA512

        db_metrica_com.cmplay.dancingline.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal

        • Path /data/data/com.cmplay.dancingline.hack/no_backup/db_metrica_com.cmplay.dancingline.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal
        • Size 8KB
        • SHA256 799903d7d9cd60768d7e5cb5ea00225bfbaf636a162ae36df1a38c39d9438a44
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.cmplay.dancingline.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal

        • Path /data/data/com.cmplay.dancingline.hack/no_backup/db_metrica_com.cmplay.dancingline.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal
        • Size 12KB
        • SHA256 ca2ece209feb13d40129f75d3821d3c20040862ae670f56c46f88c80e61fa95e
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db

        • Path /data/data/com.cmplay.dancingline.hack/no_backup/metrica_client_data.db
        • Size 20KB
        • SHA256 5ccb0bff334571ff97a088fb6bea5022efdd7071ffc274011a8b684f5e41cdcd
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db

        • Path /data/data/com.cmplay.dancingline.hack/no_backup/metrica_client_data.db
        • Size 20KB
        • SHA256 11ea0c7608d6c8f1a36c6174ed394c8ff7760210797b7ab81e354d5819d41bd9
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db

        • Path /data/data/com.cmplay.dancingline.hack/no_backup/metrica_client_data.db
        • Size 20KB
        • SHA256 4564ec31a51694e8349f462d5ada137b3f37b7c42515a7fe34ea8ef33b5063c5
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db

        • Path /data/data/com.cmplay.dancingline.hack/no_backup/metrica_client_data.db
        • Size 20KB
        • SHA256 3d6c1b93d693606fa486c0a62db82b1a1ce12837d74f5f550d5c8b722ed39568
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db

        • Path /data/data/com.cmplay.dancingline.hack/no_backup/metrica_client_data.db
        • Size 20KB
        • SHA256 1e1ff29ff7d282e89e2de097cb0f1dcce61c38aa7e9979b4c94371c89da33892
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db-journal

        • Path /data/data/com.cmplay.dancingline.hack/no_backup/metrica_client_data.db-journal
        • Size 12KB
        • SHA256 3b685f037e00f663d70c211a6ae0041ddc164865c417d9c9593d7e0d0bbc7e7b
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db-journal

        • Path /data/data/com.cmplay.dancingline.hack/no_backup/metrica_client_data.db-journal
        • Size 512B
        • SHA256 85d4528ba1708e6552219c093e3dd587e0211317c464778414836a7f96803f0a
        • MD5 SHA1 SHA512

        metrica_client_data.db-journal

        • Path /data/data/com.cmplay.dancingline.hack/no_backup/metrica_client_data.db-journal
        • Size 12KB
        • SHA256 ae516038272a51c1683a4576fbc238972bdc40fb42d9724523d28970dc939383
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db-journal

        • Path /data/data/com.cmplay.dancingline.hack/no_backup/metrica_client_data.db-journal
        • Size 12KB
        • SHA256 af3ef904c1ef2a8c5d4420572312b4b1fbf8a461fc3719ff830b379083ad3333
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db-journal

        • Path /data/data/com.cmplay.dancingline.hack/no_backup/metrica_client_data.db-journal
        • Size 12KB
        • SHA256 c43d982c560aa67eb4ed1d126001ede625f988d05bac3c16de4f2194f1bd15c6
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db-journal

        • Path /data/data/com.cmplay.dancingline.hack/no_backup/metrica_client_data.db-journal
        • Size 20KB
        • SHA256 72836c3c381bdee4f4a5587329a1541ab2eabfbfcc342146a6e9582305602980
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db-journal

        • Path /data/data/com.cmplay.dancingline.hack/no_backup/metrica_client_data.db-journal
        • Size 12KB
        • SHA256 66e3a7daab0642be1bd73a82bc5950a61f718363f99fed9511d29c07cd7e72ae
        • MD5 SHA1 SHA512 SSDEEP