f2fde590c20ca2d53fd5c811f76d0ed8fb0c47144874d8846d7a31e8fec9014d

Analysis

max time kernel
127s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
01/10/2024, 11:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05b776dc396c02df47cbcd2809769e5b_JaffaCakes118.apk
Size

1.4MB
MD5

05b776dc396c02df47cbcd2809769e5b
SHA1

5441687af48b09946b4a9980f4b17a7c6df6e258
SHA256

f2fde590c20ca2d53fd5c811f76d0ed8fb0c47144874d8846d7a31e8fec9014d
SHA512

d364d249e25d60c3867acfabaf86bb5cef384bfa4daed65f0c2af23e770a9ab4bcd57c998a28506faef24eb273b7f50773c7768af824ebacc5b5fabd0c11646d
SSDEEP

24576:Q5NpCuEDl6FlNY/f1DD2Gx0CAuEDl6FlNY/EOTclRnpwE1btC3zFUaTRLKRLHiB:QpC/DUF7m1vBe/DUF7UglRd6jFMLHiB

Score

8^/10

collection discovery evasion persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/sbin/su	com.madvideo.adultvdos

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.madvideo.adultvdos:vserv

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.madvideo.adultvdos

Queries the mobile country code (MCC) 1 TTPs 2 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.madvideo.adultvdos:vserv
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.madvideo.adultvdos

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.madvideo.adultvdos:vserv
Framework service call	android.app.IActivityManager.registerReceiver	com.madvideo.adultvdos

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.madvideo.adultvdos

Checks memory information 2 TTPs 2 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.madvideo.adultvdos:vserv
File opened for read	/proc/meminfo	com.madvideo.adultvdos

com.madvideo.adultvdos:vserv
1⤵
- Requests cell location
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks memory information
PID:4248

com.madvideo.adultvdos
1⤵
- Checks if the Android device is rooted.
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4367

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.madvideo.adultvdos/files/eula.zip

Filesize
14KB

MD5
537c1a9c2701ed4d42f0124a9ad3a30d

SHA1
ceec3f82ae6d8f318d00804350a91099b1c30d85

SHA256
d30b54aa42412fd2ee81ae65870ef9e8878ffc05bd70a749007e0749121f664f

SHA512
3056292cf1f7ef07ade44d9c86c9b125ce66fead9dd1db10b3750a3ac2b920cc8c45641037f1236d55af32d025b31b39ff64d180d0512304c555adc029ea2c8a

Download Submit
/data/data/com.madvideo.adultvdos/files/offline_startapp_eula_body.html

Filesize
22KB

MD5
da8d5b926af3923f0d1f400c9521e2c4

SHA1
7a577a74ea3f7f3769e01a4e91b5f8c54caa14cf

SHA256
769c69a56439955dcec9378d50b30e2a4d3c27127e9f57d15b7ec7b5e5118d4e

SHA512
9997e16ec832b6c970ae0b16772908aacfe7326ec4cef212b044706c17b74053ee72814a1c396322873be26a693e348101948fa850e20705b60a3c4facb77109

Download Submit
/data/data/com.madvideo.adultvdos/files/offline_startapp_eula_footer.html

Filesize
13KB

MD5
9818dabc2eb86d5f4f071e9d67334570

SHA1
117e7978c9293d86ea5492b90a4999cc24225dbb

SHA256
1f075332b57fdfbb9417718f3c0d9f27ffbb2c135b3291aca4b9f2911d7e9e3b

SHA512
79937390d4b02688abb0e24cef356024c3dbd3cd59d85ea3300556af59f0648293ed24fb5db740a4329fdddccf43af3b7679135555397a3adedd3eeccf5423a0

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads