157f4cddb53b48365c9afc8e49229c6ff6a5760b521d398a34f4656f2d398160

Analysis

max time kernel
144s
max time network
154s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
13/09/2024, 15:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de725c0bb51650f6d02e9fc9b4201a91_JaffaCakes118.apk
Size

14.2MB
MD5

de725c0bb51650f6d02e9fc9b4201a91
SHA1

8019b78e6fae7de4538fba207c403e24ca8fa35c
SHA256

157f4cddb53b48365c9afc8e49229c6ff6a5760b521d398a34f4656f2d398160
SHA512

3fbf2c27dfe1243e7f583a1ef3178e14d14946e2a5c80b64840434374020391d0fe32a39f4e84df704be88831e0792a9d04f622464d1f3f14b2094df2c1abc49
SSDEEP

393216:H0lXCQrvrDc7pPp6uNzcH2nrPPEBUXM2mJWP:H0rfo7Zp6izpbEBUXME

Score

7^/10

discovery impact persistence

Malware Config

Signatures

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.mxz.dreamstation
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.mxz.dreamstation:pushservice

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.mxz.dreamstation:pushservice

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.mxz.dreamstation
Framework service call	android.app.IActivityManager.registerReceiver	com.mxz.dreamstation:pushservice

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.mxz.dreamstation:pushservice

com.mxz.dreamstation
1⤵
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4265

com.mxz.dreamstation:pushservice
1⤵
- Queries information about running processes on the device
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4318

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1424

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact