8bcecc61283fbabaf4b9552b6722a732fa3ff6d0f7507b79e1796a6a89d2c1d4

Analysis

max time kernel
7s
max time network
138s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
14-09-2024 19:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e0e082fe9068ae29ca5a7e883ff54518_JaffaCakes118.apk
Size

935KB
MD5

e0e082fe9068ae29ca5a7e883ff54518
SHA1

b238c1580b337319505f3d18185dee4543aa1b35
SHA256

8bcecc61283fbabaf4b9552b6722a732fa3ff6d0f7507b79e1796a6a89d2c1d4
SHA512

99ac1c964ac95345434c35d5ef118dddb9e79d08523c01282fc72836277514c661ccda44f1e50db44b3c2438785500659bb729bc7920618ce189c61ee5058b2a
SSDEEP

24576:jaN1vM9D4dJUaFDQSQUqhwmSLe0WO3mY2z:A1vM9cT9DQS8hBm93V2z

Score

7^/10

collection discovery evasion impact

Malware Config

Signatures

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	hider.AppInstall.mash

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	hider.AppInstall.mash

Requests dangerous framework permissions 7 IoCs

description	ioc
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	hider.AppInstall.mash

hider.AppInstall.mash
1⤵
- Requests cell location
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
PID:4495

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Credential Access

Discovery

Location Tracking

T1430

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/hider.AppInstall.mash/files/newapp.apk

Filesize
906KB

MD5
5eea6d180219ab9aaa5c89e2b3a84006

SHA1
6b9f79a44716fbab5a967938b029106bdd47c639

SHA256
e64922100c6a29f503c94d9e8bb28997f1eb02aef2746c5d5e9f59c2bea7bba2

SHA512
d33525e1fd64ba2ce85e216eca7805456da8b5fc17295bcff03fbaf6c9fffa38aca3d1f77c6953ec28d91a7f2db58dc02c4cd396830abbe8fe39c63af6502b02

Download Submit
/data/user/0/hider.AppInstall.mash/files/testnew.apk

Filesize
55KB

MD5
43777c8a2424407123385b957463895f

SHA1
d6ad342804ed499216bdb29f9afe2e40926623ac

SHA256
b6ff9b61b61abe11a3eba507421a7b5467e7d277ac7801f24fee39bbe5cfaa36

SHA512
2c83a9a03441ce8f414a56078559341fdb81ca207e64130875bf285a22fd08ecbb1e42cf224da08e7b130e1a0254e8da9a7917ad99ef7d9d439b98273229767f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads