5e8e23df42386910ff49fda13b1ba4088f135770b6aa5b9913002a65db5d60bc

Analysis

max time kernel
138s
max time network
156s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
28/09/2024, 04:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fb770d5edf64837fdba014d5071cc994_JaffaCakes118.apk
Size

567KB
MD5

fb770d5edf64837fdba014d5071cc994
SHA1

7187cde1edeec14f92662ab1e40a68e111715c5c
SHA256

5e8e23df42386910ff49fda13b1ba4088f135770b6aa5b9913002a65db5d60bc
SHA512

e547da4689ca5a52d47f7a0e3db44fa5e0aa73ce8f8422ddd80c5339081fc7b253e5f9085e161e8f0a655bd4fca6f20cabd6dd67146b3b1149b7aa7346750576
SSDEEP

12288:kW3+sOgiYi7jrdnvAtfdR7RCjG4/fzmSKIDmJubWgw2JU4x:Z3+spWn0FB4S43dBmJuBwf4x

Score

7^/10

banker collection credential_access discovery evasion impact persistence

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.qqly/files/__pasys_remote_banner.jar	4988	com.qqly

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.qqly

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.qqly

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.qqly

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.qqly

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.qqly

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.qqly

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.qqly

com.qqly
1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4988

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.qqly/files/Track/1727496212_32f15e29-88c0-481b-af07-33bdd6c7b304.dat

Filesize
230B

MD5
fdb5103bbaee59f4590393d9c1363d27

SHA1
a42371ade8afce88eea1fbc5ac8ad5dd5650d1c6

SHA256
a8898b2538657d9fdab3221656d13c411d4a5b9123e7007475d8cec72b01fe2f

SHA512
88d678d0ee6df5f6dc36605d353af872efdc7ee73b7f99dc4d5082eb66c47d7b701b1552dcfa4441177b62996895fa8a30409483303571e4b6551c73fac399d7

Download Submit
/data/data/com.qqly/files/__pasys_remote_banner.tmp.jar

Filesize
135KB

MD5
130dbd08f61689b42bd3712e84f54738

SHA1
ed0500d3300c7b232780f4bcd887d5ae4cb57190

SHA256
1cd995355babd2f2450f7a99445041c91e3d2976ea672531eaeff98b1ba546b5

SHA512
e29e5e32e481c8d4d85e989155a9bea6ec8c6ca0d36a245aa9da89591a1abc17c86710a4d1ea349aa002acffb07fd060525c7797af9386c1ced731929b791dba

Download Submit
/data/user/0/com.qqly/files/__pasys_remote_banner.jar

Filesize
231KB

MD5
70c1376baee742d1f93c936eb55de4d8

SHA1
c5aa85c1d110aca04ba708976f84fed3d10f18fb

SHA256
b22027e777621b54c12e9efe8dab7e8574b01c259f68429d44250a7afe4c23f9

SHA512
5f1c2e3da8a8f3c472c9edd6fe891eaedf85ec4de5cf256cdfbcc637a849ccfe675037e129793ca9e1d3ad657fd98c2b78f6870283da91dcb2dfd743dd25e5d8

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads