Analysis

  • max time kernel
    63s
  • max time network
    157s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    23-08-2024 06:10

General

  • Target

    baa718af6b97104cd5ad4bb7c7be0050_JaffaCakes118.apk

  • Size

    2.6MB

  • MD5

    baa718af6b97104cd5ad4bb7c7be0050

  • SHA1

    79deedf8e3cac36e82e500c1a919418f331938e2

  • SHA256

    d826e0cbcf4ed1b6f6da7356867f3d27ab2248bdd09209a3d47ba75cd71c25d8

  • SHA512

    bf2777b81d679c67df6ecdffb529c9437eea1681f17f9ea8fa23b862ba0b36ea3a2af8ade1dedb908eb39be867bcaaaec5865fde42aea7f60ecfcc495a5272ef

  • SSDEEP

    49152:y3Ei2Lnu2S9xphxvrymYb4o2VvCj9hFIzcUdPqqaqABSC45cvTFehU3A2jNwod:y38u2SkmY32dzcUwTqABSC45RUw2td

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 1 IoCs
  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

  • Queries information about active data network 1 TTPs 1 IoCs
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.yxxinglin.xzid73004
    1⤵
    • Checks if the Android device is rooted.
    • Obtains sensitive information copied to the device clipboard
    • Queries information about running processes on the device
    • Queries information about the current nearby Wi-Fi networks
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks CPU information
    • Checks memory information
    PID:4929

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.yxxinglin.xzid73004/files/stateless/dW1weF9pbnRlcm5hbA== /dW1weF9pbnRlcm5hbF8xNzI0MzkzNDIwNjI1

    Filesize

    1KB

    MD5

    872c42e4b26b31705b33c1c501ff0c48

    SHA1

    227601a061ffce8e80b114bb2e9a81ae3746cb49

    SHA256

    379d2b81cb0e8f3469e4fb156f18b49017fde083019355944d31d3b7a42f4d3d

    SHA512

    007411915d7caa83cbe9cd18393a9f41204e83f7d3417cf9adce9ba85594f58263cfd3b967911d3899e32c67efe53f063ee540ffd50879c40282b47de854f521

  • /data/data/com.yxxinglin.xzid73004/files/stateless/dW1weF9pbnRlcm5hbA== /dW1weF9pbnRlcm5hbF8xNzI0MzkzNDUxMDIw

    Filesize

    1KB

    MD5

    c6150cd4391c8bfe66ae3e10552f5372

    SHA1

    81bb8d7bd46fc8ea3690c8d67b8c639dd9a4ee6b

    SHA256

    4c42a5c470a995d22130c46d9df802ec8f95faa934f62386170c1d42ea4abf68

    SHA512

    343888c17266cf2249c741edaa9002e8f1c501a0333b2d9a03753b34d8ed38b206a569e26d6aa6e1813f6c7d873b79c836b06eb1d7d5adfa6b592ff3f5c9cd60

  • /data/data/com.yxxinglin.xzid73004/files/umeng_it.cache

    Filesize

    352B

    MD5

    6b16b87b4502bee8316acc9d793ff788

    SHA1

    2d53c4d67724ca15a9eb8af1c4f283f822e7a0cc

    SHA256

    614d936c6802612bb1e0cb6a9dc8c17dfd3b5818c5c0dbfbf7a8f2caec42133e

    SHA512

    838c6cc774a91bf5c07ae66f243b17a645a5c9a829984505d816fe22ea5a92fb91e6fac7202350155267a2e7ba0b78fc3565de2e23bc82dcb9ee3dd8e4f236ae