5e8e23df42386910ff49fda13b1ba4088f135770b6aa5b9913002a65db5d60bc

Analysis

max time kernel
140s
max time network
152s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
28/09/2024, 04:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fb770d5edf64837fdba014d5071cc994_JaffaCakes118.apk
Size

567KB
MD5

fb770d5edf64837fdba014d5071cc994
SHA1

7187cde1edeec14f92662ab1e40a68e111715c5c
SHA256

5e8e23df42386910ff49fda13b1ba4088f135770b6aa5b9913002a65db5d60bc
SHA512

e547da4689ca5a52d47f7a0e3db44fa5e0aa73ce8f8422ddd80c5339081fc7b253e5f9085e161e8f0a655bd4fca6f20cabd6dd67146b3b1149b7aa7346750576
SSDEEP

12288:kW3+sOgiYi7jrdnvAtfdR7RCjG4/fzmSKIDmJubWgw2JU4x:Z3+spWn0FB4S43dBmJuBwf4x

Score

7^/10

banker collection credential_access discovery evasion impact

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.qqly/files/__pasys_remote_banner.jar	4474	com.qqly

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.qqly

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.qqly

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.qqly

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.qqly

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.qqly

com.qqly
1⤵
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Checks CPU information
- Checks memory information
PID:4474

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.qqly/files/Track/1727496215_ede95be3-0bde-4c0d-bbc0-505c540f42c4.dat

Filesize
230B

MD5
5df1c0367bbb91e8701a53f962588dbc

SHA1
981d4f2fc03390aaafe274d1200c606ddb7d1cd7

SHA256
8d2f8811c3acef2fb71f5826bc4862d365af793b087b4fe6a96fb326e376bd42

SHA512
2143027fbd321100e32b2debeaaa5474dc0210c3de4191a73027c2be97b1d487f0799a2e76679e30ee1dc472bb13d95709981f2a0427e1fd491848cd1d27baf1

Download Submit
/data/user/0/com.qqly/files/__pasys_remote_banner.jar

Filesize
231KB

MD5
70c1376baee742d1f93c936eb55de4d8

SHA1
c5aa85c1d110aca04ba708976f84fed3d10f18fb

SHA256
b22027e777621b54c12e9efe8dab7e8574b01c259f68429d44250a7afe4c23f9

SHA512
5f1c2e3da8a8f3c472c9edd6fe891eaedf85ec4de5cf256cdfbcc637a849ccfe675037e129793ca9e1d3ad657fd98c2b78f6870283da91dcb2dfd743dd25e5d8

Download Submit
/data/user/0/com.qqly/files/__pasys_remote_banner.tmp.jar

Filesize
135KB

MD5
130dbd08f61689b42bd3712e84f54738

SHA1
ed0500d3300c7b232780f4bcd887d5ae4cb57190

SHA256
1cd995355babd2f2450f7a99445041c91e3d2976ea672531eaeff98b1ba546b5

SHA512
e29e5e32e481c8d4d85e989155a9bea6ec8c6ca0d36a245aa9da89591a1abc17c86710a4d1ea349aa002acffb07fd060525c7797af9386c1ced731929b791dba

Download Submit
/data/user/0/com.qqly/files/oat/__pasys_remote_banner.jar.cur.prof

Filesize
299B

MD5
153e1312962520f72ea17d2b07b3e783

SHA1
3e081bc2a218488c27c06b3004b94b2ab974cd7a

SHA256
0841589c48532f5509e1ceb8054d423a1dc885405b89f3652dbd8bbb198baa6c

SHA512
cf6f1c4b042f5f7da559140acf09989b6a81bf09770ab920d4386a91d6b2528814cd3e076465cffa5261ef0384a3a2052dfbad8dd33ecd32c4515db62b90561e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads