d181ee045d000d96d90967500ac3908e252335154ae7df287542e705076a34cd

Analysis

max time kernel
30s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
24/08/2024, 09:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

be4dee863f3a5a8a0954d6f8748d789b_JaffaCakes118.apk
Size

27.0MB
MD5

be4dee863f3a5a8a0954d6f8748d789b
SHA1

a90b7997dea4ff96e644492621f03acf9755989e
SHA256

d181ee045d000d96d90967500ac3908e252335154ae7df287542e705076a34cd
SHA512

631675561730a6a78d15ad424427cb2400c246298fa69eab4d5e11d2504176ace381f7156217ab25f1533f787f6d37c48b8edc382d96b5a1b5db725cc33bcbf9
SSDEEP

786432:hfifyTvVcI+XyZB+1zd0V7qUdgjUoJN8qTOIQGgGZ1fnaiVRb:WyaPyZQ1zoOqIpTNzZHVF

Score

6^/10

evasion impact persistence

Malware Config

Signatures

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.blowfishstudios.siegecraft

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.blowfishstudios.siegecraft

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.blowfishstudios.siegecraft

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.blowfishstudios.siegecraft

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.blowfishstudios.siegecraft

com.blowfishstudios.siegecraft
1⤵
- Acquires the wake lock
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
PID:4251

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

User Evasion

T1628.002

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Command and Control

Exfiltration

Impact