Analysis

  • max time kernel
    34s
  • max time network
    132s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240624-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
  • submitted
    25-08-2024 04:52

General

  • Target

    bffbb349be6aef333d3855e6f5efc46e_JaffaCakes118.apk

  • Size

    368KB

  • MD5

    bffbb349be6aef333d3855e6f5efc46e

  • SHA1

    38e233193d933c3494a849e419e0d6fef14c3716

  • SHA256

    cd6ffabd092e5839d15be53aaf8d749c01beaae5cf3044aac1fab6f80c8106cd

  • SHA512

    28101d7e0eec2d6fd2dd7030e0a72c0b00de0aa6915b7df8bff82a7a5b49cecc9ca189bd40c1b772d4d2943ef0daecfa8891f4fd028c33466bd14aba954b6004

  • SSDEEP

    6144:PAIpkpwKSqAMpL+37w8kUeV2zaCSqTMKGF5EnjeDBAnWdLrkIUl94f3p/YeRPEaG:PAIpkChqNL+3Etb1WTBGFjqnW3Ul923C

Malware Config

Signatures

  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 1 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests enabling of the accessibility settings. 1 IoCs
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

Processes

  • anubis.bot.myapplication
    1⤵
    • Removes its main activity from the application launcher
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Requests accessing notifications (often used to intercept notifications before users become aware).
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests enabling of the accessibility settings.
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Schedules tasks to execute at a specified time
    PID:4650

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads