104749e878014ae101fdc82da4fa656456d47f31457286ded6a34563050e59d2

Analysis

max time kernel
108s
max time network
147s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
30-08-2024 10:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

caa2f0cb67fe49e221508c5ad6003aa6_JaffaCakes118.apk
Size

2.3MB
MD5

caa2f0cb67fe49e221508c5ad6003aa6
SHA1

6d0c23f658a4629144e8eb3cd017b86523ebd6bc
SHA256

104749e878014ae101fdc82da4fa656456d47f31457286ded6a34563050e59d2
SHA512

51673833d9ca5dba31cc27754471e46a8b92c3f703574fb8961b850a6c485b5bb4534d72ce38a1a9fc332b7fb05a340ae4457a420f7f03e2bed6295b87fee441
SSDEEP

49152:T4hbMiZJN2tAJB8/cZevLULF7ZYRXq/77/9c53wGdup:khbMiZJG/cZxwRkQ9ds

Score

7^/10

collection credential_access discovery execution impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
collection credential_access impact

Clipboard Data
T1414

Transmitted Data Manipulation
T1641.001

Processes:

com.asab.mmk

description ioc process

Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.asab.mmk
Acquires the wake lock 1 IoCs

Processes:

com.asab.mmk

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.asab.mmk
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

System Network Configuration Discovery
T1422

Processes:

com.asab.mmk

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.asab.mmk
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

com.asab.mmk

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.asab.mmk
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
execution persistence

Scheduled Task/Job
T1603

Processes:

com.asab.mmk

description ioc process

Framework service call android.app.job.IJobScheduler.schedule com.asab.mmk
Checks CPU information 2 TTPs 1 IoCs

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.asab.mmk

description ioc process

File opened for read /proc/cpuinfo com.asab.mmk
Checks memory information 2 TTPs 1 IoCs

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.asab.mmk

description ioc process

File opened for read /proc/meminfo com.asab.mmk

description	ioc	process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.asab.mmk

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.asab.mmk

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.asab.mmk

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.asab.mmk

description	ioc	process
Framework service call	android.app.job.IJobScheduler.schedule	com.asab.mmk

description	ioc	process
File opened for read	/proc/cpuinfo	com.asab.mmk

description	ioc	process
File opened for read	/proc/meminfo	com.asab.mmk

com.asab.mmk
1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:5001

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.asab.mmk/databases/__pushe_base_lib_db

Filesize
24KB

MD5
fd38a31ccc9f4341108eefb200be5c27

SHA1
214c8a44c0e4c4d9de154c42922d2a495345ac82

SHA256
99fcc32b6455749d87a93f72f7693a1e3c71e95a38baaac8ce624a173c057534

SHA512
c7ff032482bf21c722db05301bfc2ebe98512ef626bdd2608f14231567909d993794ec0ad66ff5bd4d2a6e9f4fc464f7f41289124a122d2e7320ed39f92b08ae

Download Submit
/data/data/com.asab.mmk/databases/__pushe_base_lib_db-journal

Filesize
8KB

MD5
60921e884cd7d08f4f5b2984dc5c9461

SHA1
5eade4eaf4ccfbfd77af96f373e7f8c53c5b1b06

SHA256
cc541885d406f2ad19f53a3de6e189c7816488bfd5bfa1c3a8c77d98cbc83ab1

SHA512
a9f04dfe5ab5a0ffc9c6256fc841b524a5f7205414893cc742dbbdbc9cdfc967e84cff9f31181c08c1467c9d821fa53c059303e990ff7aafa15a137f556aa977

Download Submit
/data/data/com.asab.mmk/databases/__pushe_base_lib_db-journal

Filesize
8KB

MD5
889b53bafffbb3fd9a3e115c0951e9c0

SHA1
81b91d6ad673fd9edbd12b8b9fa7af4bc2d18428

SHA256
e58fcaa80ba9fa3be901d6af4bbdd53808ae80b5f6c923a6122c46d72a2c99a2

SHA512
5c819cc00c07e3340fa8fa04e4f53e4008da244b5fc37149f82d6401b865ad4aab26de2eda6e86bf1b1dcfbc742f39d535f64b3b679628c9ff42ecb96b4e9d19

Download Submit
/data/data/com.asab.mmk/databases/__pushe_base_lib_db-journal

Filesize
8KB

MD5
2675a498c8107fe9bb0477957cf2393f

SHA1
b5bbf71dda62d1dd66c46459f0793cfbaf9b3610

SHA256
946114ed68352a28e28033e1a7438d1564b7246514eb60e1e94b2a0e3fa1a237

SHA512
74627084bc649d3650b9b1cbeea972a84f16e38bfc7dd3a8d326ab497e97916bc856e02a475ef16a68c0dbcc2f6a4fdafd0991358cb8fe3ee072aab71aad3720

Download Submit
/data/data/com.asab.mmk/databases/__pushe_base_lib_db-journal

Filesize
512B

MD5
06254f6fd36dae8389215b02fc708f4d

SHA1
296313f09437a215df10d8290e1dd59db38393c2

SHA256
40d9345fd55a10ad51026c370ebbf3f69602ca39af3e140f88d95ee37b4b6f8d

SHA512
fb5e5f70c554bc2671a8edd424e3639f15e9b6eb9e148567889be47e733c72f98983aea78146fb4abecbb3f4da645549db30ffbdd23d5f6c6b8f46ec62ef9610

Download Submit
/data/data/com.asab.mmk/databases/__pushe_base_lib_db-journal

Filesize
8KB

MD5
68832621ebe6bd6a2bbf588e31a8753b

SHA1
e8d758a249edf8a65f69f31a393e1e5f093dca6a

SHA256
4dae8f075e61dc7c8dd9097587acd711650c383f7bd5391295d11fcb281fd358

SHA512
3e253c7aa21a229be3de88a8ab126e1989bc3a18c6f73adfe35791bd387d3daf7ff830b41310a3768fa5165dc852030a4d9c836f52a7ad47f1d3313824a1a25c

Download Submit
/data/data/com.asab.mmk/databases/__pushe_base_lib_db-journal

Filesize
8KB

MD5
7f7c7a53cbd752ba1438157cbdfa36e1

SHA1
64fcd24b47c570477aec55f568fa81252ca0b217

SHA256
f91626dcb14aafc2872246ce6452236d1d100e757a1b98a8896603d82b5ae4a1

SHA512
4ef35e82f4dc52ba37a35e7f5431319240151461d8f9a86d60a2bc0367407795e17c5d62a3364eb76e37ec1f6ec50ac350f64553fa22b2990a41beb6e47a0475

Download Submit
/data/data/com.asab.mmk/databases/evernote_jobs.db

Filesize
16KB

MD5
ec28183fbed3a95bbe2bcd70be3f886c

SHA1
a6968b1db06273af58205c0911388f0130299796

SHA256
b4cc6e43b51d3b119550013dcaf885eb59a3048e4890a9e40ee10e4fb99de6ea

SHA512
f49424a6be4ceafc0b9fb71c72b25bf6a60e888b7bf5fb004e995a126208b6d189ba4f7bf3f9ed1461683322b1a3df0aa66e75e7b64168a93fb92355a9a135c8

Download Submit
/data/data/com.asab.mmk/databases/evernote_jobs.db-journal

Filesize
8KB

MD5
ab68850e96e11075a4027748ed21cbc6

SHA1
a0c08f10ae502ae03703a267e130460f84d02400

SHA256
78c9bc5f2759bf0afd3ac12998293e3a971f785d999e1719ef2659013605b9e2

SHA512
f36bf303412432fa990b7281576402453092a87dcb5b1a8aa6d928a6081942b987d438c0dec5ecce7b6343aab00a76e1b7e69e9189f86a2666aa5cf179feff4f

Download Submit
/data/data/com.asab.mmk/databases/evernote_jobs.db-journal

Filesize
8KB

MD5
a1bcfde326a734b2fb50adc29a9497b4

SHA1
d111eaafc93cc0d2af72ff2ac3b57b318cfdb2b8

SHA256
d5f9a5a97f7d9e879eccce2ef211e08ff1f78617f2eaed650bc012e83156d159

SHA512
c623607142b180ef46543b72faac65c4bab095d2118d84dc98ec4b6779e364940a702dae6ad5bc9b471a5c1d42bd6560e5b16c0635825a3b5d083ce54ba97452

Download Submit
/data/data/com.asab.mmk/databases/evernote_jobs.db-journal

Filesize
512B

MD5
7c245dcb1143f2a79ffd0c5cb442c343

SHA1
1ceafa0b13d3fb29c9c5c64999afadcdd3a2053a

SHA256
8f152fa13d878bb00d20940abf43598e5f1cc7a001b4a239a6ed5dd30364dcb1

SHA512
0c79d5ee57512fa9e8b18b87b9405a3ec1cc896b8544c06979930de5e00f1aba4df0020d07339d7094031007a1225956e77d48879d75d49e6d8e633fc74a0a77

Download Submit
/data/data/com.asab.mmk/databases/evernote_jobs.db-journal

Filesize
8KB

MD5
a5e1217b2d07bdf28e6c344b794c45c0

SHA1
8dc859fba382ea3431143844f5e39d74a71b8d71

SHA256
c51138e216142308312f336341d5dff54c5807a9dc28e9c9c6ff7bef2cd13b66

SHA512
868dd8e8bd56a41e3819fedb01ab64eaa4f043ce7cf7063b7cea298fcbb6dd45556c085e50029a4e25fe4577740ae1ee8cf345d36af62bcde499ff973d01cee2

Download Submit
/data/data/com.asab.mmk/databases/evernote_jobs.db-journal

Filesize
8KB

MD5
f308bd9ccdebe9750905c1f8c070c66b

SHA1
07b2e41f866cdce94a2531356054b15db544d1b8

SHA256
4b217f7b5001dbf54ec74b8470f4986a6b276e10b3a7c9a74d2225945fc46faa

SHA512
0072b99f3ea96bfde9de1159790ca03cfce0ee90c7f3b0ad2b6ca76b2777efcc3673a211c59d094daae680d351ff6e34f953265a27bc043d49a235e11a60aec9

Download Submit
/data/data/com.asab.mmk/databases/evernote_jobs.db-journal

Filesize
8KB

MD5
435d71293faf18af61b15bc4c3fe0944

SHA1
4a8d2da30cde8c9623ddb7e3f823e465e6f1c9b9

SHA256
cece351794891d09fc03c291622959bf2a1432c45483c155a630b4335d5aff30

SHA512
948d7f1c2ebcbd0a952b59cda09c4e882ba7072bd890e227a73226afa6e98525a56bdf238cd0e29c5242def9ea3a19a8cd5df45e71e10c46026e45adbd72292a

Download Submit