8f068abeca240f468beb60087726945213a83bbc4d2a0f4271f8c4208d4b760c | Triage

Analysis

max time kernel
144s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
19-09-2024 06:21

Sharing

Report Analysis Logs

General

Target

eabfc7206b87f2232acc29e83c795eb3_JaffaCakes118.apk
Size

18.4MB
MD5

eabfc7206b87f2232acc29e83c795eb3
SHA1

6c58d0163976ae33b4622df1d184e121e328f74c
SHA256

8f068abeca240f468beb60087726945213a83bbc4d2a0f4271f8c4208d4b760c
SHA512

3219bce0d7e72a148d9e1c75146a97c56e0124fdeee6a7cbf6d2b8f12c889252852c3c6e9b20e0de2b072e3efcad22d96c946e71643bc80faa002e3512a16104
SSDEEP

393216:gGgQKkUDEl9acTXywZ3hjH917XQ69K59+VFc82UBCt+R5rmhD8rOaxHt:P3KkUDElmG3hjd1DK5MVFQaFf

Score

7^/10

discovery evasion impact persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

Download New Code at Runtime

ioc	pid	Process
/data/user/0/com.lichisoft.ttppt/files/p_compat.apk	4253	com.lichisoft.ttppt

Queries information about active data network 1 TTPs 1 IoCs

System Network Connections Discovery

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.lichisoft.ttppt

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

Broadcast Receivers

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.lichisoft.ttppt

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Data Encrypted for Impact

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.lichisoft.ttppt

com.lichisoft.ttppt
1⤵
- Loads dropped Dex/Jar
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4253

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

Broadcast Receivers

Privilege Escalation

Defense Evasion

Download New Code at Runtime

Credential Access

Discovery

System Network Connections Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.lichisoft.ttppt/databases/skynetV2

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.lichisoft.ttppt/databases/skynetV2-journal

Filesize
512B

MD5
b4f7ddd861401c4c089e5fe3fae7a51a

SHA1
3778b69b9d6d8e68c8b1a64019ab1ad9e58b4e40

SHA256
5ffce26d10607036a466f579651b725d68910c04f6b450e225834323f4a1ac34

SHA512
b156b89e7f15115e60e189b761b7628f38567281b626ea8a9103142210a68e375db20021940c788397ddda3ac1970bb9c3b2b84a2728ce9252a45440d0ae59d5

Download Submit
/data/data/com.lichisoft.ttppt/databases/skynetV2-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.lichisoft.ttppt/databases/skynetV2-wal

Filesize
68KB

MD5
2201db8002830176a8ff961f714add26

SHA1
e6ce2916bf079b205233678296bb7d26e531adc9

SHA256
e2141ed950573dd586e46c9d7817b4e90ccca99aa75769f202220bdb50054eaf

SHA512
452461178c4808f31992d7298ee76f3811b19d8b3144b5499d9337a6891cc60db66d9846457f83674c224ccb004563c5a05db83ad7823ea02e47b8a7f363f601

Download Submit
/data/data/com.lichisoft.ttppt/files/p_compat.apk

Filesize
7KB

MD5
4ed5c2c20fd5008a63047d04f59354ed

SHA1
12ff5158d1079ce38da3171dec51649a5d1e370a

SHA256
735704c28f74f34ac1f780cad7dc9e6d1266bdc54cf642a2b508cd4fb9cacace

SHA512
21c03d22dbbf0260347145b9aa9b09563865b292924a9080c0cc437c5b6664b12c840e52ee7e8a87b5276470cec759c8cda17fe236619e3e936fdf038d88e21e

Download Submit
/data/user/0/com.lichisoft.ttppt/files/p_compat.apk

Filesize
9KB

MD5
365b8fb52ba9575a67e8ecdebaf3a43a

SHA1
a220d42cb36a655d93ac48345a6ca246bea9080c

SHA256
f65b51d180da521813001a1ebfcdfeb8554319b355038c8237d8e35d21531bf5

SHA512
f6d2765ed3e07117b37266d411621e9b119cde859aca577ffe9bb4449793a86d1d61cd37a45b52e8f94743f6c710342522b96d21d85720900a97fb185114a1cc

Download Submit
/storage/emulated/0/.skynet/securenew.bat

Filesize
33B

MD5
aa1fc934d498d7fdad3532190a98f063

SHA1
ef8ae9dc96d061cff78212ceda1c792ccffbd32d

SHA256
79d293d0672664c6cada7f16d4709ab9de5a1de096b7fa8565dc0350d412d10b

SHA512
8b622fd607903f6bc7282a3ed2e5068cf65eb350dfe54f5cca6ac042f57d9724593bf8b49c9632b59a12db5575074794665ab3809a71cb401f19a1db48402706

Download Submit
/storage/emulated/0/InAppBillingLibrary/log

Filesize
170B

MD5
394dfa3a9f4c80af134aedb4f6bd153a

SHA1
1580125f122a803a9c81d8e20c504a3ce054ed4c

SHA256
59c908885435d8b5fb7bc9015467781e395a1f4b95caba6ea409e71a5779a63b

SHA512
16cc51a89d576410808f2ad0e3a073c3b6439ee5ad91f53ee76c5ad79431c242d1aa551bf9480e620cc09d6b0f8448be07f091fbed8dc435372fc3a7a792789d

Download Submit