Analysis
-
max time kernel
133s -
max time network
154s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system -
submitted
08-09-2024 15:29
Behavioral task
behavioral1
Sample
d4aca9745b1df836541488f9ba87381e_JaffaCakes118.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral2
Sample
d4aca9745b1df836541488f9ba87381e_JaffaCakes118.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral3
Sample
d4aca9745b1df836541488f9ba87381e_JaffaCakes118.apk
Resource
android-x64-arm64-20240624-en
General
-
Target
d4aca9745b1df836541488f9ba87381e_JaffaCakes118.apk
-
Size
17.7MB
-
MD5
d4aca9745b1df836541488f9ba87381e
-
SHA1
9d2430f0cba9aa83b00c4607e2bc2cd91c9a2158
-
SHA256
5bc8e6f99911ef55bd375a08f2023d62c2a3a29d10aeb7938fb843d9074b691b
-
SHA512
2b5b9864472c5c672b39b9c73c59e90c66bc06a97187ebd682deb830d9d8f21bcf440e1c3d1fe3ffe8202e796ecbb1f564ad7967055a1bbeaeb0ce0ad071e620
-
SSDEEP
393216:lRkM6oA9/wSg90/JJlGKI3QV8D3r13bxsrXIJoJl/AqaIv+EC3I0JAus0L+BQDQg:lt6/ng9OHlGKI3QV8jr1rxWYyboqHq3F
Malware Config
Signatures
-
Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
Processes:
ir.ghazae.mahale.gelan.ddescription ioc Process Framework service call com.android.internal.telephony.ITelephony.getCellLocation ir.ghazae.mahale.gelan.d -
Acquires the wake lock 1 IoCs
Processes:
ir.ghazae.mahale.gelan.ddescription ioc Process Framework service call android.os.IPowerManager.acquireWakeLock ir.ghazae.mahale.gelan.d -
Queries information about active data network 1 TTPs 1 IoCs
Processes:
ir.ghazae.mahale.gelan.ddescription ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo ir.ghazae.mahale.gelan.d -
Reads information about phone network operator. 1 TTPs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes:
ir.ghazae.mahale.gelan.ddescription ioc Process Framework service call android.app.job.IJobScheduler.schedule ir.ghazae.mahale.gelan.d -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes:
ir.ghazae.mahale.gelan.ddescription ioc Process Framework API call javax.crypto.Cipher.doFinal ir.ghazae.mahale.gelan.d
Processes
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/user/0/ir.ghazae.mahale.gelan.d/app_com_birbit_jobqueue_jobs/files_jobs_default_job_manager/4f006e56-9d7d-458e-9328-db5602dd623b.jobs
Filesize179B
MD5ac58f99a1b179d71e8621412ad31c6a1
SHA1b51fdad95876f5615735c2ab411031ff67d5e946
SHA2569537553772c29c4303e606e458fd9598c14f1eee3cadfb446e241638bee3ccdb
SHA512faf45d5eb4b890216e6ad33825ffc02cbc57914628e625164f9cbdacd5962ce8ca8f473ded2f56eb4d4006fc7cafa9cff8c9f76655f17f83f38d3e89b8d7e67b
-
/data/user/0/ir.ghazae.mahale.gelan.d/app_com_birbit_jobqueue_jobs/files_jobs_default_job_manager/52b8f59c-490d-4e38-a867-5097310ec9f3.jobs
Filesize176B
MD5f56f328eea1d5c96a1b96dbbf59488df
SHA1440c784cacff61932e2f61580b7cfdc3a4943c95
SHA25690949c83a3d90fc0128f0d5df662aef3699971ce9e63ab067382f970cbab8918
SHA51236e370cf16dac8b173fa182960789974d4087a7b607042000118ce518db8f1eaf93cf4f3be42c1c26ab53e87ff54da33b4c57a3a15e5cd47f2c2b66efe8b3edb
-
/data/user/0/ir.ghazae.mahale.gelan.d/app_com_birbit_jobqueue_jobs/files_jobs_default_job_manager/8f515b2b-0379-4c80-8419-efeff062c9e5.jobs
Filesize278B
MD58469a3db4cbb9fe59499b3603c2e2fc3
SHA1abf76c372dc8bd82901410a2e145144b472ad589
SHA256fa8305845276dd29f5950095ce3c0792de39e9b007a8356c5ba1ae0c012f7663
SHA51229786ea5b1fdc71049d7f9096bdcf8fbc02a7e4a41b9e3775e850593be7c1b33341399f4b8e3cebf8d0112ffb728c65d9e40aad6dfab14c35dd25ba802174beb
-
/data/user/0/ir.ghazae.mahale.gelan.d/app_com_birbit_jobqueue_jobs/files_jobs_default_job_manager/a1a2fac1-a11a-42fc-b733-5e5dac894c81.jobs
Filesize991B
MD5054f5421b6952119823c4ffaa57a08a5
SHA1ef44b0bcd256cd49fa7c5358eb448511a91fb7e9
SHA256059a2517d211196d76c416449f1f5db5ca6d6ff36928db2d4fc264050b16156e
SHA51228ece87ca1a28ddd4fee5f7af9a3a2cefbb17c03e2c3d3f6edf9a278876cf1b50c109cf0c8011fd3afc1762d0e95cb8b5a3e8ed8b8d7f6bb104a75d90026a8e2
-
/data/user/0/ir.ghazae.mahale.gelan.d/app_com_birbit_jobqueue_jobs/files_jobs_default_job_manager/feb532c8-527d-49e7-89ac-40d4332264cb.jobs
Filesize811B
MD5808f1a8cb653e106d84ad2f5d5af9727
SHA1ef7e10e05c02dc961b39734f07c909028a1ec620
SHA256385d35ddee66ae7d1a2f834c704d1c3fb0f7fb56fc35506acef37331c3191da2
SHA512aabfd07fe8d5fb7a66715ab6c10976cdd2c10edb823b12a8ff304b36a9135d117636ed4f974aeef891cbbe710c6b08b718293017072c82ffdaf8c291f425934b
-
Filesize
24KB
MD53b0d29c697a919bb116ad8a49b4279d7
SHA175e8f306ee918b83d6bea5ec5c557315a58abaaa
SHA256924a12e5d9128398b6565e6fd691b41584419378f4516af01b5de58d0fe07b91
SHA5124cf8ff3637f9310c52b44c6145b6dc8b96140f6745ea4f9398959d2dcf3745b59394d235668d767e97c35f7cae33f0155eee24535cdfd8ebfb1b8c8bff7d8040
-
Filesize
512B
MD563116a366d771cb675fb400594480e69
SHA1aafc233d7101264cfdd3d7a8a96f9d0f14c0b495
SHA256d1d84753ad67c51b3bbeb68049740d1402ebc4b4b031a363d385df15bfffd1bb
SHA5120d5ef1f77b0a7c5d62877a22a6a95ca8d079fba58edb760010325069cb48b1108ca37b3203c360aae767d31482dcac4762261616a6791062e986491f68b11408
-
Filesize
8KB
MD5b77b41d8d3feef3e8787bccf4fd803ed
SHA1990dc164fc47239336b99c007524e366f6dc29f9
SHA2565f0d345fc057d4b384269aced93ede97f3aa966c16fe797d34fc53f69473e24a
SHA51227754ba887f3d3db7d9b8b69d17c71045deb71d4801bf7d84821e50491d9cf3659b7d996a2768fdafb7cf304f042825ea8e19403db5b8e94f0e25171d6d90d56
-
Filesize
8KB
MD5f5cf4a8d861399715d86dbeee7635367
SHA1e05f866986aa0b8a164185a5bf4ccf1f0e2837f2
SHA256569e2a6455b49b4597b397d662ed72b039320a83ab79240534a05b9d54e92e6f
SHA512901143c58219182922296d356771b1827d13dc95b59cd296f563bc083e277b50c6d424e7ed7a2a5380d9dafc21377d62c53839ea2c52c0d6cb595aa491f9babd
-
Filesize
8KB
MD58be50afe56903f85375b05858cc46960
SHA12de32fbbab72dd054a7b5adcf2c8abe37fbabf03
SHA2566d248895027ab455cf2acff6444cd9029a98e1c58e2f842e7ed8e6e635318612
SHA512bdc55095447ed4b8c5f5d16166b43cd8655a56bd237520cf818738570eb702ac1cd0b349654dfe4f6bab293054615a52e79ec7d3c5b43ae90a7dc118557f945d
-
Filesize
8KB
MD5c945a1e3fc7a3f9b6ee7cf8458f0219a
SHA11cb4adf046f04cb241c84e4d9681ffbb3b4d97a7
SHA25606f0f9cf56f875dccac43ee19c9a8d330366e27f76b01abb0d9301766f920f6f
SHA51241043b5b1ee2866925161c5619ab9b9de738a7e897b374afefb9965a95f51c27e9a337fe886d9c622aabea77b0e98fa8c328a0fcab8ee3f1ae7ec11f58e81b84
-
Filesize
8KB
MD5cbbba011cab5b3007306b12432c76d12
SHA1a1bea787df572e77964345444eaee7b25348f152
SHA256a0020529fe937042da82bf6afa67fad598583bfd7880c7a3b6ebd494fb7ff56a
SHA512a9db4755aa1a16eb21ccebec11215f256e741a57346af8efed5dec4dd20031b22a42bd5552cd5d930d3c76baac2618061b4574afd2d5590cdb47185d8b47e4f5
-
Filesize
20KB
MD5ffa107b0095a5be84f53b33526909359
SHA11147a9d11bed307f89c53564a80aa03cdd92a3f5
SHA256f38c04dba7ed680b47d13e556f044246867849b8795f1f9a1269d39792b5a436
SHA5128cd5a9c51823e234f9b6cfec8d1b5366f24f6f4d1f331147c51b2ba8d29b7f46918f5b82cca272adbe2581baf5c77c8b5319c66409c7211fef828385cd411d61
-
Filesize
20KB
MD51daadef78466f418c19ca9e4b1afcde2
SHA15a625f6e59bb226f4a6360b96375077022ff66af
SHA256a9abdcd71c2a096ffc74d28eeb087b88abe05f383a92de48297850d18c79bc15
SHA5122fd1f7ee922ed186b3be686feb0bc5f2de15919f86989b8ad6c161660741b501311b1c9fb4b6485e190fc5405f241089f6ad5b85ee786362a392d5e038c905f2
-
Filesize
24KB
MD50660d3ef5f0245096a9fa0f61d6a8666
SHA1282222362a5a05e3153b7f6b49ef35c667b19542
SHA2561091580378b83e0ab3222d05659ab9aef1d2c65d766d5e04735b628d7a760ba2
SHA51218bbe88051278314b76611bd68156ce60a9c3af3818d39991fa58d28bd9bcb8476eb00ef52ad8ae7d16c1d7ffcd9f2e8a858e2fd806ae59b5d85a8c3a9ca12a7
-
Filesize
512B
MD50d8f114e3dc3168d1cef060967f4b3e0
SHA1cc66d51e010c0649c96389f16e3a8a24020d879a
SHA2568b17601172dda91ea1c8ad9cb96ca0b09937bd7d1b17a731cf4ccefde34e068d
SHA512364447968c6c504552e00a823e89612b9c381066d2c886c6888edc19a738e90d554f752d162f74e6af6e9595a41aa1264b1040ad5589a7869ceb20cd44ce9dcd
-
Filesize
8KB
MD5dad99d8c89013bf1014e863421108b86
SHA1da7f6117a659305975793c9a00dffb6c5c585b4e
SHA256a4e995969073012273f34ff4a0ee099095c03e86031237066d278ba32d95f278
SHA512a3f7401046290dc3021ee4094a1bce61a2e025e3ab1bc7772e4c96fdd5547739e5e147a498ba0bf44a6ae9f4c1fe9db7d4fb81762538f1ad187681811e1b4d2d
-
Filesize
8KB
MD5965fcd810ba143a1f0019a67bf97c081
SHA1e996ce88fae07cecfc813b4beeea5ef43c5c4f05
SHA2566e1e40792a668898c06762303f92366a5167829383bb411d05a0cbe3c538b728
SHA512b0ecc643f00e6e3c5351f612726be34ed011d1b173a7d73fcf11b29ea9aad5a422626bc11bb79a2b6a0853f37939e48ff5206bfd28ef04b78ccc126370fefcba
-
Filesize
8KB
MD5879a56a9e7c1ec0868deeeaa998e6ad8
SHA16d768682f217651924c4052715eb232e43da2907
SHA256f13d82eeb19619326badb2933d6f7e66226d4c36fb98661549ed070ab82bd072
SHA512135f04116cb350752246c81e9db7016f9369e3606210450413dfffa6ac142f8d0756e3ad17f59e2918f4071ee63e2f024eecdc31e412a194f9c61b7ed9e8c683
-
Filesize
12KB
MD5264b90d7bd0e3816b744e4edb4982423
SHA151f423df02d0fd24e9f3399688995b7185d7b260
SHA256e30bb97297725e2d217ca29f8ce115de384ec0c7a166f8bd550be699cb39378e
SHA51299d61254ee4acfa18b693ce955ad35e7e4de8252e398b02fa4371d7675d8019f449a4900e1be2891ae9b5af6a8676bc52a1f3fdfd485579b0fe25aa7aad25eda
-
Filesize
12KB
MD5550d614c6b7f8de10f153ea1ad00f9b0
SHA11aca9139b7eca50c04db2eda09ab965ce7b6b1f4
SHA25697aa7ea865cbcd80a99cb176d7057821f70ab285b3fe9cc7e6432afb8ea9a7f6
SHA512ea92d4ec7f19bdb1b2fde0fe859190e7ab81bc383b1135ab56341fce16052af621d5b0b81b484ce96b4d3685360212e2ecff5c2a9337e98779616818a47b477c
-
Filesize
28KB
MD50694ef5f6d1c8b6f68adde8ee5f0d577
SHA15f5e8d2c81da2b78eb4d700801eb6838ca928214
SHA25616ae6e363e4aa5a6cae4ffe7543ad5430554b4b44115586788879081b177dcc1
SHA512e5b12c8d900b615ac546add7530b172de20316a27f7e43fbbb57989a7f7b58229bfea07bc8d2eeb0e898d50df4ed2f367e49a3777b9a92d254eb825831a9a66b
-
Filesize
20KB
MD5ea02b2d6f77ebb3ee7f642c56fdfd4fb
SHA12678c3497347d6bf3d8bef000a20d0eb4a9b21a1
SHA2566c45f36997ad53d00a076b1d25285fc624b66f4f80f83b3077404005584dc462
SHA512f2fbb0f4fc622d2848bb0213359ab15b9bd4a078a9823e51f3d4cebd6b607dd65a3b93d626e9fb51136b79a85e5c7a879a109d0e838edeefacd9323db7a34bec
-
Filesize
512B
MD5b051489af742af959666f9fb7d738ab1
SHA1bffc8842b0d61827f9c4545360833fe566f3983b
SHA2560c6fffe03bd835b5a2459923b4d86dd65b5a29f8cc2c42cbb1a85624d9b0362e
SHA51280e0dde3d0440496bccc39a4497784b32f4e06ff19448c0097d1e912eab94b989cc70b922dbec53f0fa56147da5c5fedca8720a82d941f16f5e7b7bcb3029ffc
-
Filesize
8KB
MD536a21e6a374ca1b759f681d4c20b9ea7
SHA17518d15c25ead98d8245aba8bbd48b8d2de11572
SHA2562e7caff5d195292f13232981801ab4cb3fd6378018d269a7933c72c98bbcac17
SHA5124385a6b4cf7099edadf9953d11b96c8a5a8f5b6c4ec2ae703f00bbe1c031a0f80004cc32cf33f949c9c665b6b239da3de0525461557d91673a65e92fd1c69d39
-
Filesize
8KB
MD57e4f63a35d8bf7b9d9bbc7930d6a4096
SHA1262eec24c3377a201d9eec3405a0c9d53d4a798e
SHA256880bd1c6755cca2440ee9c72b609b99874d7fc94b3d572961a884aba9e4c9825
SHA5125859c57e5109bbc2a2ebf6f57c1657d9e01125eef2666814328544668d87aeb6871faa1891c0dba681f343f2d7e33400ada85a7e5fd191a8956edd350a391245
-
Filesize
12KB
MD5d9afdd29ef6231e8215f9bb851bfc6d4
SHA1a6edf836488589be1b15249ce81ef11a14ed237e
SHA25642db293c537694a5a6cf4faf4a9dbf3ab7636e03649f2e81d8972b24892cc869
SHA512d4c477a09b30ae1a69d6674507c5b0dbce33e3eecae61217b07ae998be326b50b2adfc9ec63bea74eb69ea9db043aee89653e2f02f3db650747a5da055f41f81
-
Filesize
20KB
MD5891e28fcf656a0e490870ee57165f57c
SHA1722cf97e84c8ac3df386c8d35659900e324ccf14
SHA256ec308d98a97cb1db9ba2a0f23a91e9d75adfa59b45c46c2437939be71e4c2235
SHA512cd898fb311bf9f4bdc97070e2d061f82e484dbd742b7c3d29e18746cc37a5a649721ed4e851ad4cd4f7815a67dc59debd56d53153191f7d77c3bbf71e3f5e03a
-
Filesize
16KB
MD558b10b8dc69c05e0158eb8705c5f5e1e
SHA1101af970ad3c7cbe1b3210ec6e19a5d01e6b9e67
SHA2561cd16da0dba8bced9f5422d09f46f1222429bd9c02b9ed94db7e06342c8eafd9
SHA512f7844c2d023ffbb1a38d0ef0955a8977e18d10de31ac7fb73d63155b432046ec96fd88cee16f58fcfc154f7339552b7f1259beb4fef180c819c2b5bcee69a6fe
-
Filesize
512B
MD56f503f716926b385455ea92630e1a83a
SHA1dba14c333d3739a6566fd1d1b2abab8d1bd9701b
SHA256532cfd30d886bf229f3adc482034ced5a1b6102cd8f91d6f3da21447f5e4f89a
SHA512c8d6442b5fe576bfede9ebdd20e8c7557a82807ba0dfb8a1c56824e222c0aa9620084bdb11e0437f67bef8e8fa8919199e420395df77358a1fa04852b92fde45
-
Filesize
8KB
MD500a0b7b530b21c22c24e824b246497db
SHA1b0378a06d1dc8578784ece464a36aced9e9577b9
SHA2568c56f4ea90738d5def044520756c3e63d23dd52fd04e865e636defb86b0efb26
SHA512248aaade102c47fa433a269ae29a108209c075da8dac4a62870f1bd387873a52c10972c1b7ea2ec31e3d84f4bbbf71aae284699581fe6e5b712fc1d3b3b21e6c
-
Filesize
8KB
MD5422fe5131beebaec6ed1d5807d8240f7
SHA162cb3f9caf95663544fad995c7cb90a93aa512f7
SHA2565c0349e71bd977eaed71bf975e71a2c7875818df1ae034dfd291a7eb11213538
SHA512ab5b4a9d1a16d51a638b3c1859fe90fab440bf2dfdc59203a348144f9c4e2707b269ceb0d295520d4fca7a46fc89db57222965612a20d857705fb0071475e134
-
Filesize
8KB
MD5cc7de49a25ece8f4a8e1f982d1c0b0bf
SHA159381f798d7ffd1539fb756c79b5d2d8472f060c
SHA256f8e6de992636b08313cfe9b2743db8fa4aacd2648cfb2201b9b849b01fe80fb0
SHA512a693efde8149cfe5e63b66f3beb48780f3e05e1d7af94c7e455cc3e851451946197b3c025eef41e4f3f95262b79ca94ea07e19a50da3292514af38fa9dfe390a
-
Filesize
8KB
MD5cb22863bc68fc4dbf5769deefe3ef79e
SHA180f0b228c4e9cceaa912575f7682f0619e0df27c
SHA256ce8f1e0b911f8925bd02065eae2b8d9247ec299bbd00be7cb62c9f5ad9a35040
SHA51239882aa1bb8936c039c81fcc5389539784a4df409c12f755be89284415143a981b36a3e4aab8fcf5f84a72f3dbd587f025298741d391148250d7dad11939bb95
-
Filesize
8KB
MD54132959e74c4e706164a0844689f2b87
SHA1f621d7d70947a3794a5ee4aa561edce3addc50f7
SHA25661213fa90ecb68eacc70325f92a36c38bce5f5b107d06b4d654bcf966e7ff818
SHA5124a6fe21f67cc1539929f14520d10834b627bd5fbaeebc6e17f4986a70c0f1209170b6399f2a4fc858525ec4681e1ead1ed56c9f9842ee6dbd1ec5c6c4cdb7b19
-
Filesize
2KB
MD564bc2bc418faba2cc5c21a713066248c
SHA1b331f38424d7fda046ed5a43be5a8156a63fae34
SHA25642f506c049e2c0a3155a603021c6625cf71586b3cd90a896dd0424566f43b6b7
SHA5127625f7236d7dd2726eea50e77d9d1343a9c4ef157d9285b6c9e783e85b771ae59b5787820e80087614553e4e3d1ea0243c11b04db3daeb2b5b365e7ce9559899