Analysis
-
max time kernel
148s -
max time network
131s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system -
submitted
25/09/2024, 17:49
Static task
static1
Behavioral task
behavioral1
Sample
f68ab0e6c417e1070c25679e952e07f0_JaffaCakes118.apk
Resource
android-x86-arm-20240624-en
General
-
Target
f68ab0e6c417e1070c25679e952e07f0_JaffaCakes118.apk
-
Size
4.6MB
-
MD5
f68ab0e6c417e1070c25679e952e07f0
-
SHA1
5bcda7e90cd830155a44e578de6a571800400465
-
SHA256
9343a1edeacb51cbf022b910c030d2028e8dd59782da023525bcb7d6dfdf3483
-
SHA512
919a7c91361b0e7eb66a324b3f78ac8f19eb6e54c7ac752a0f09ba53021e1a0fddc18e08822571563533ba740d3ab2dd3c0a1d77c22ef8ada32ff596db9de27c
-
SSDEEP
98304:oHpksN4psVkD/k5YI6tUqIPIhmp7T6bAy4kh9xqoxnwLl7Kh9CJaF6sPq6:oJzcsQk2I6uqIwhQ7AxXJdh9hlPq6
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 4 IoCs
ioc Process /sbin/su com.mobile.indiapp /sbin/su com.mobile.indiapp:worker /system/bin/su com.mobile.indiapp /system/xbin/su com.mobile.indiapp -
Checks known Qemu files. 1 TTPs 1 IoCs
Checks for known Qemu files that exist on Android virtual device images.
ioc Process /sys/qemu_trace com.mobile.indiapp -
Checks known Qemu pipes. 1 TTPs 1 IoCs
Checks for known pipes used by the Android emulator to communicate with the host.
ioc Process /dev/qemu_pipe com.mobile.indiapp -
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.mobile.indiapp/app_SGLib/app_1727286583/libsgmain_1557315458000.zip 4399 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.mobile.indiapp/app_SGLib/app_1727286583/libsgmain_1557315458000.zip --output-vdex-fd=76 --oat-fd=77 --oat-location=/data/user/0/com.mobile.indiapp/app_SGLib/app_1727286583/oat/x86/libsgmain_1557315458000.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.mobile.indiapp/app_SGLib/app_1727286583/libsgmain_1557315458000.zip 4315 com.mobile.indiapp /data/user/0/com.mobile.indiapp/app_SGLib/app_1727286583/libsgmain_1557315458000.zip 4359 com.mobile.indiapp:worker -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 2 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.mobile.indiapp Framework service call android.app.IActivityManager.getRunningAppProcesses com.mobile.indiapp:worker -
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.mobile.indiapp -
Queries information about active data network 1 TTPs 2 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.mobile.indiapp Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.mobile.indiapp:worker -
Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.mobile.indiapp Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.mobile.indiapp:worker -
Queries the mobile country code (MCC) 1 TTPs 2 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.mobile.indiapp Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.mobile.indiapp:worker -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.mobile.indiapp Framework service call android.app.IActivityManager.registerReceiver com.mobile.indiapp:worker -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.mobile.indiapp Framework API call javax.crypto.Cipher.doFinal com.mobile.indiapp:worker -
Checks CPU information 2 TTPs 2 IoCs
description ioc Process File opened for read /proc/cpuinfo com.mobile.indiapp File opened for read /proc/cpuinfo com.mobile.indiapp:worker -
Checks memory information 2 TTPs 2 IoCs
description ioc Process File opened for read /proc/meminfo com.mobile.indiapp File opened for read /proc/meminfo com.mobile.indiapp:worker
Processes
-
com.mobile.indiapp1⤵
- Checks if the Android device is rooted.
- Checks known Qemu files.
- Checks known Qemu pipes.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4315 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.mobile.indiapp/app_SGLib/app_1727286583/libsgmain_1557315458000.zip --output-vdex-fd=76 --oat-fd=77 --oat-location=/data/user/0/com.mobile.indiapp/app_SGLib/app_1727286583/oat/x86/libsgmain_1557315458000.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4399
-
-
com.mobile.indiapp:worker1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4359
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Virtualization/Sandbox Evasion
4System Checks
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
407KB
MD5888d7c773e4fdd9be8b00b6db94142e7
SHA18894ee6113982921c1b7749c33323bacc5e86e2c
SHA256f35448ddfa62b57bda52ef805cd5e5a79871ae3c27a8e775133a6a69335cf7d0
SHA512c317d7e3f3bc8d88667b4f1d88f43c29fbc39d9eee5b71baa24511ae8d2932fa86164bda75f54b6554fb1240eb90a2670b99bd43e4b7cadf78e7986f3b985ddf
-
Filesize
3KB
MD547d26228610ce4ce3f3c935ce849d81d
SHA1ba74856c1eb9fb03c286f9746302b8ae3ed8d9e2
SHA256d0e9ef1c5d219befdc3688f82ba8a714a030ddcd2dc00900a2c4d596d11d21ad
SHA5126aa453449848250741dc277eaa6b5e73296011c84a823b0e810ee489194b23cc80e9002b5d4757e9e8eaf51859d5942c3c541e3dcb37a3f233547ad9d1819f47
-
Filesize
36B
MD57dfb2906b8da26ae1d1a0a22c6900f0b
SHA1fff619ba3648656040cb9c40b0ce5365a4c91977
SHA256388198f9155c826468cfccda7bc643d8965fc169eee3c3b90f6c70e8fc72b9ed
SHA5123aeb554fe753b12f13e597318374a0c0dc15b1e853017432d3bc641682cfed139fa5207910a06d07e905b8d5e52c390fb30b3256fac74af48b48a37e4e7d013a
-
Filesize
512B
MD53e8f4652b2def0d8c66b3e351cc067f8
SHA1792dd7a3c94d42aeac93c707bd29e67e6d5cfe74
SHA25639765067de814be4a6700303d4b45e1f0a8415a898212ad20a8db588e1ae63d3
SHA512be8698e790103e73d5b11257c77ca7bdc30f968ef594a66d8971919359f0448e95b644291b95c0230cab87ff5ce683e76dd02ed82a2195ec662b001963a72010
-
Filesize
36KB
MD596320ca84149900461e90808e7a9e4bf
SHA1b49efe4deaee7af3ba4dba9b5935f634fe46094e
SHA256004b490ec5c72ad952c50bbcc39e919e68a84ee396318ba44116014fcd2296e9
SHA5124e80c422c318f6e821c902e7af89a356177a27823e4ad9d4df33cae86ee11c19f3a9582bd44cff5ba1f312177c4c3db58f6976c96434e2a1f0549d350d38a757
-
Filesize
249KB
MD540f15f4d0fe071d0652fd1e4e4d03d5b
SHA16b5fd02be0e736ca160406afbe3c790abd53f198
SHA256d5f192d7f4c3b8ebd19206979d3ab50c5adc2821fd291fc58691cbfb8f344ab8
SHA5129739ac9938524038a80e572354d901816c82f6f39a2d6f1c638a2db90b2ebfd10d8d11e26f9729adfaee00607d363acb5149d031d515ef8785bde86a3eafb83c
-
Filesize
512B
MD51c1b2c8b45cb1fd0fb87e29172638cb2
SHA105e8d16ac7835903402e769c795184f4e2fa2a8b
SHA256de45a60b60f26e756965df4250df4244878b4998b418b21f140fc6080d354584
SHA512d7829c54ea35993b9250929dd48331cdc4e990eae3b4947215fbb1b4a4438556cf8ce89846673012f80bd02b43157fd6a99ccbdb68d836c124c49abed0d8d77f
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
40KB
MD597d59e3110e158bfec135d53de881e2a
SHA1408f0f6223fa486057f4fe8af01a9dc33938409a
SHA2569931e3ce44c1327757929f1bdefe1261e217257bf0a95a0ff1c6c6ee3196313f
SHA5124e7b1c8a70f1a4f2e786928ad8496d60c942e6a7c83dd5eb102a3975bb91444e49880c74f5a99f4a5d8ccc88215662a5d4bfcc293dab5281e114dbefbd08dfc4
-
Filesize
512B
MD53c4ad6acb565a5537e12656759b852a6
SHA120aa1bd85ff460ac394e88e35058af216f44303a
SHA256593eb8a44a9450726551679a798c43a1f264d371f1905a734647dd36ecaded13
SHA5125a2bf4e3db74c4b4b27f179470870deed03fea788587ac09ee7f4fd3fc03d4c30330e1db8f747cff07c07e7db6b9902ced0fb35c27e3e1750539db47af88afb1
-
Filesize
28KB
MD5cf845a781c107ec1346e849c9dd1b7e8
SHA1b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA25618619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
SHA5124802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
-
Filesize
36KB
MD5a1cb28fe773efad34343a9d561ae4229
SHA1aa02f8adac46d87c4566f86e79bfa6b38e818423
SHA25623b8d6990e9a205c38580c0397cc816be9de2fae52cf5db0aaad70dcb51fc53a
SHA5124278471083231b5a06632b80a49d554b52a9e46a2874208d7c6c554708c9ffacd37e718c564220197150b7fb4e093b42877f06b94f688ed16714604885703e9b
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
72B
MD5f58f13d0fc991322df1eec4c68481464
SHA1fac54fd6dfb4fa6e0b0f548eb024573dca8cd259
SHA2561d3ba112a38305e67ffb1aa4a0e0e70b3a22809904675efecec0c949d0b76396
SHA512e1ef5bbe84095b5ed02d1d9b23bc7e034b67715b3535473553a2d797b86ddbb81028e0cd5ccc457be1828893413eb368e04f29b7c3a2878f933a025153cca535
-
Filesize
143B
MD5e226bf9446849dc009baa24a537ac74c
SHA1b6b4de6d0febe5a29c94656ddbf85823f20d6204
SHA256f4748057d8d507d1ff277a03fdef8184f0e215e4be2de5315b48c647fb0d8a19
SHA5120acf633e9b926ee1c43ba5f11357a9f31524a62e7487fe95b70feee27740197a4cf725c3a0aaeadb2fdc441ce4af69e0800ae23bb7a64c7525e7044ed49c6541
-
Filesize
216B
MD5b54fd28d048208709a578c7275e036db
SHA12ec3bb1eff10ab7830320a82843d5606d77cfe7d
SHA2565c3d162ebedebe7cab9b28375c53b898b2ce4aae0ea7d6304ed81667cfab8ed4
SHA512dd64d465e6d9a3789cf1e60de406dc67bc05d84915fea2ed0fc36b9d8cdddd0a0aab286f56b2605e0f55c7d4017a85bf64a9466c81ac6785c59372d826346f81
-
Filesize
288B
MD5c7ea4b26bb185d2d1cabea6c64b50cb6
SHA1453d8b6c12f614ba9819036fd01b5f573b940d65
SHA25661205729a8a10f814364c9952f179738a3d06f0c2839abce7ee9f1a9a2a4414f
SHA512a5c16485898deedfb9463b4b5e4406e9324eace33d2e6eae1b5be56277d4ce8d87000812519327bc78a2baf1fafe5d05563994b22607ee1c8f8d0b10d50f8167
-
Filesize
5KB
MD5a86dfd7a465778b86aa21d5d5a26c7af
SHA160db617b6ed9313cc23f4b41aaed121b65a72107
SHA2567256f1fb64cf5130f0e0810c8f5be73d46f881f38de5bc6405c92d6d21ce1276
SHA512dd31946acd018c2e9b5e54c486ff5f3bd134c4bd1f2c2b3b957f4dfc82cf2115287b6e2ed8b3723ad86c0ce679a88467d2db8bcc0e5071563f6d96cf36907a10
-
Filesize
88B
MD5739811c1525803a8dbae6288ec332b88
SHA1401dcb7e9fa185c19dd754adc721c6f6ccb76919
SHA256fa65fe9293975183ec4aae13728911d9751b927546a1d6220a508498928fcd21
SHA51246ac377addb01a6060c8fe45564b28681bd3dca81714b0514a7342604060d99580555ca26e5255bd28d07639c9ecea4ba558c456e1eca7fef2d5162f53c4fe63
-
Filesize
42KB
MD58f388f06caca62732f1de59df8454b9a
SHA155c04257d8734090960d179f5912b03cbe624eb2
SHA256d2a4094f53a9bab584ae7160072499c0eddd968d14f56221d0ebe698174312b5
SHA512c186e0146cd9848f7798545c680673521bf04958e38bf9cb6f37c284e2fcca854e893d0751b65151a2279c16ce879b59fb4262429e14f3b804c54e6d30ece68e
-
Filesize
42KB
MD5b9fff83be0423460003164d3f885b71f
SHA1a25c7545f0a83ec66dbe5550a2c906d38d7244e1
SHA2566343f3d34569d3a38b2571ecaf0e754d9c49360296e4ebe23c6813b6bdbbd4b1
SHA51257abf9d30424991bcecc6d09837fb85461a8725556efb7bfc4374c34bd3e372c1bb3f0c9003ded7e97a52d4e78907424e19edcfe146a2539b3b96d01d2b9f954
-
Filesize
213B
MD50b1a44733410f1829eeaf9fc158233de
SHA152457c95a2e4469fea015d8b2955f17016444bf4
SHA25657c82995603b5efce643ef811e0c9721542e9bfe6fbdd5858ce0ba8fec51b4ef
SHA512d509fdbe8d220f23b19e5d98d852a848408c45c043753fe698bfd39014393069ec2cebd7e4ca3136ae8005b0d92e06da44c225b99327eef95ffd274ba16c2df2
-
Filesize
32KB
MD5b15b00bf90b7c93b3665eda88fbc4808
SHA15d90cbaee0798753afcad7e6555a92d2567dd02a
SHA25692882182a7ffae56437ee1b2b3a68ddc0594b28c1e3a4254920023015cb4b429
SHA512cbea5c61e2043c01bbf5b0ba79e45106bf011e29447317a4bc66560afb52177f2268f5fd95d84868152b25b1aa4368256392d24eed3f4fb9a56cb2eaa1b27059
-
Filesize
167B
MD5f715a27d2efa5a97b020ba4d69257d4b
SHA1144a39f859e72cf98818b208bb6d6e197e022d82
SHA256fbe9cb05e288377b7fe30eed98a262d7c0c2bb9edbdcb5ec6d2304f7305bc766
SHA512bd934b37902df189d4ae860f7b0c0ff8f77e2deb395a115d6512163858ce381233776e9c195c62d60606cfa7d6d59dacb22a06115ae30d47f7afd87d47ca3a62
-
Filesize
512B
MD58d37d9c9ce44a4bc5d57179aa6074202
SHA14487d4bbd32399b9c5338997355da5dfb1e10b4c
SHA256fccffedd22c0b558ea8f03e6818b47d472d15bb3c2ea12203cc4ee6597fff3df
SHA5126c1587e60666af7e59d83b7f7be8be112dce24d9337b8096f293d9b40306e44ad09cfd8581fab0a11c21253947eab2ffae712eaf106abb1b5559126e6397f19a
-
Filesize
28KB
MD58371426e4333c67933c02ec9422d747c
SHA1df0f128671a48f349b5d3e57a5433b4a39c4f058
SHA25657c05bd54ffb0af6fadb2843548bf27c97bbab29301e22f188c16435e6ab762d
SHA512053c9e047afa9532af3db4b75eca64ea260607086bb7fcdcdfa3aa72a7ec9cdf3740f2c9cf1f9979524221042b9cfd1f1021117d7e4fbaf6cc62af10f7daec6a
-
Filesize
576B
MD503e6b7b2e8a0406089fcdb34bbd1effa
SHA1a32ffdff8f923c921b0ee82c3740887c0d77a8ab
SHA256372ffbeb6e6d885815990ce759e5d63104d68e1e834d1161fb3727c2576fd183
SHA5126038474cbcb51f05103d998be8e2d80588eb2fd14f06f397ea4496ac5bf2f740b4a24ffc83c4e07e1fdb7fa4bd0667fdededb02807ec055c8fa06dd599e0e946