d4d38d24815c1d9be3bca1741172938f19f4cbed46e40be276300c52641b3463

Analysis

max time kernel
8s
max time network
137s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
02-10-2024 01:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08427abaf1142fe2224f2ba2da1130c2_JaffaCakes118.apk
Size

1.7MB
MD5

08427abaf1142fe2224f2ba2da1130c2
SHA1

600a269918d66856c5824d5b1e5711bb469396a9
SHA256

d4d38d24815c1d9be3bca1741172938f19f4cbed46e40be276300c52641b3463
SHA512

7f65df0abb57985c4c2ec23877a35e188c312385f7ca340f09923ff3378e400f55d01f83ad53af621f8ebb8563c57fefc798e098a0e316e06a50952d3c84a0d5
SSDEEP

49152:KC72lQVvKlIYXZHcqYa5b2lbvKStohooUrmEUNUDPFOKShX1pgkHxqvIekL5LsoN:KC2aabHcqYDWGoUrmEUNUo7l9qVQ

Score

7^/10

discovery impact persistence

Malware Config

Signatures

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	net.rhmnpljs.hjjtks.puvj

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	net.rhmnpljs.hjjtks.puvj

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	net.rhmnpljs.hjjtks.puvj

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	net.rhmnpljs.hjjtks.puvj

net.rhmnpljs.hjjtks.puvj
1⤵
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4258

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads