2fae3654a1d9aa428468f3258a302ccfb0f1319eb4be3654680643b28e008da4

Analysis

max time kernel
28s
max time network
146s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
08/10/2024, 21:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
25f3077810a169cbdb154b46cfbd8ea4_JaffaCakes118.apk
Size 4.2MB
Sample241008-1pvsmszfjp
SHA256 2fae3654a1d9aa428468f3258a302ccfb0f1319eb4be3654680643b28e008da4
MD5 25f3077810a169cbdb154b46cfbd8ea4
SHA1 270e2d0fc333ecb380d620d7c763723e0769f79c
SHA512 74c3e90e276a65315134b382622b741eba1c0b82700feaf737cca4be77edadec42cf90bb05edde018857934e80a8176c6fa5dcd85f9fd7ea23cd5e64ae57501f
SSDEEP 98304:GDgLexdJ93ToXOtubFKlBVX4gWwB6FRHZoe9Fz:rLOtjoeIEBVIgzgHZoe3
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection credential_access discovery evasion impact persistence ransomware

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.koplay.launcher

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.koplay.launcher/cache/1582435991586.jar	4984	com.koplay.launcher

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.koplay.launcher

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.koplay.launcher

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.koplay.launcher

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.koplay.launcher

Changes the wallpaper (common with ransomware activity) 1 IoCs

ransomware

description	ioc	Process
Framework service call	android.app.IWallpaperManager.setWallpaper	com.koplay.launcher

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.koplay.launcher

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.koplay.launcher

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.koplay.launcher

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.koplay.launcher

com.koplay.launcher
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries information about active data network
- Queries the mobile country code (MCC)
- Changes the wallpaper (common with ransomware activity)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4984

com.koplay.launcher:download_server
1⤵
PID:5022

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

1582435991586.jar

Path /data/data/com.koplay.launcher/cache/1582435991586.jar
Size 9KB
SHA256 f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce
MD5 e8e0527a01aefdb89afd2c508f131da1
SHA1 f1103e6b260c657ceb3d95f1b023af3fda8b133a
SHA512 fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34
SSDEEP 192:uGJqbQwgQYuNUnEV4bAa0s/ombgmdxjX5fGpTVHb3qX:LkMwTTNdlns/ombJB
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.koplay.launcher

Path /data/data/com.koplay.launcher/databases/com.koplay.launcher
Size 24KB
SHA256 4666f1556a61fe956038f4753079db6bc0a1eb8febf32f63f0b2ab6f4ed2b328
MD5 3a1c8f523186d492219920950056b89a
SHA1 39841232ffa8d2c42937f6b6ea9c24fa17946dda
SHA512 1ceaf9ff60c666074f437596a28ea2990e1e5686610387fa6ebb140ba014edcef60825696ce43a50492689babbd5d0ecc70be115b8aec4fae449f588816b1b68
SSDEEP 12:TLZSybYyRWjBGUpWTuM53WtixNtr8uTzFU2FVtNrhRmBEyPbD3OwG:TLoHe8sV/uGSzG
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.koplay.launcher-journal

Path /data/data/com.koplay.launcher/databases/com.koplay.launcher-journal
Size 512B
SHA256 0003315fa323479d3a9d8f12f6b9e3b219502e89e94a55a1a97b675d63f3ba0c
MD5 526183be790ddeee1167c7aedb4ebfe3
SHA1 2288db95c7b607d4467fb097f3f0744df042ce2b
SHA512 0ebf4fd6b1d5de43ea45c6cb6fd761c9b276c9ad269e2409103b71d71c7d8ede717903039bdc0909c60f738d43c10a6b40cb6f30072a1d126ac240cdcf4af762
MD5 SHA1 SHA512

Submit Download

com.koplay.launcher-journal

Path /data/data/com.koplay.launcher/databases/com.koplay.launcher-journal
Size 8KB
SHA256 71170fe16af33a28622d750fcc2ec19cc506d128274188d575eceaf6aa1699d5
MD5 6dde7ab64de1692cff1bfad8f39be4f3
SHA1 ffbfc66a45b89abc6476feab7fa45d97500c45a4
SHA512 07902c89a7e5924cb3dc950cc0114871ad379993b938eeb09c6367812e3244e3972e757cc743c41de1aee5c87a0e1f8dc5f3cf12098e36369bd92c6adc8141c4
SSDEEP 6:7+/l9ss8Hn11s2vg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKi:7+th87XvqLiuWdwRmBEyPbx
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.koplay.launcher-journal

Path /data/data/com.koplay.launcher/databases/com.koplay.launcher-journal
Size 8KB
SHA256 87a80fe04c98ac44da7bfb9ebd60043a0ae4daebddf2f99e7866c5c5b4ebee8f
MD5 9c652f8b13721de41f59df2f8b81316f
SHA1 08a33db4c123b255e0fe5a645c1c62482d5181c6
SHA512 7b089ee9212c9102a21f9f6ec3b42a600b47018f45185471da3b0e04fb3803779930619dd812c672ea4aa4edfb1c5095beca4647a261f2011da1c54caf019eb5
SSDEEP 6:7+/l9YOPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKda/A:7+tCiqLJdTRmBEyPbqqA
MD5 SHA1 SHA512 SSDEEP

Submit Download

wallpaper_orig

Path /data/system/users/0/wallpaper_orig
Size 743KB
SHA256 85feee2427dfb6091297d81160d8a2b95066fb67f287605d66f88dc21747f3bf
MD5 a84e27f129ffe3f269c023230eaa3009
SHA1 cda3b895c1517ddd617e7652e73dc8678300f4e1
SHA512 9bc03be741ea3bab1ca6c482b82fba07f54e9cb3a0616b8692895c647457b3af22f2dc434fa43534e0597ca5293ae2ee2ea843d5226096e9029d4866c77297de
SSDEEP 12288:7Gn8iSIt/V5eN8KJjPFgUo38XhbBGy/SvyBi15fALUkYzseV9UTd1xC7ZQE3F/p:7mpZneN8KJjPFxo3qBWyBa2LdAjgE9R
MD5 SHA1 SHA512 SSDEEP

Submit Download

1582435991586.jar

Path /data/user/0/com.koplay.launcher/cache/1582435991586.jar
Size 20KB
SHA256 2897b0812077c654a9b3fbb0b6303d5cde681eeba7ad9981de65716c7810d685
MD5 fde2ee00cbd121cfab5290b078aa3ceb
SHA1 e2b77d5320e155e413d040a8c20020962065b2f8
SHA512 a9326aff8e454a2b4ac09984ef2a65fddd4dc146b4c44d839035549bff8c9fdaae490326d0b018f76c1ca2e4fb25426d74f550ca0950982fba632a023af99a56
SSDEEP 384:Za0jn+huC5sMvRuvypj6f2ZzJgm+poK+l8m4qxXpj/7wyxBLBiok+9VQ3AKm8:ZU5sMvu/f2/gm+pDAPzj/Dip+9y3AK7
MD5 SHA1 SHA512 SSDEEP

Download

xxx.txt

Path /storage/emulated/0/xxx.txt
Size 14B
SHA256 288896d3f5ec6bbb294b0df997394bea9bae79046516d2b77b85e0763e8b1057
MD5 59d394af07b501b7f1f2cb4d43d7febb
SHA1 14d0ebaa46b30c05c5a6ea7ed573cf0665ce2bcf
SHA512 7a6cc251d1d72fbf968bf726222116354355c5e25383e91b683870caa823e860a3442f46e55c8e6b32184441555fc1264a715d4418f3d8ac7e3fb77f29864a54
MD5 SHA1 SHA512

Submit Download

xxx.txt

Path /storage/emulated/0/xxx.txt
Size 22B
SHA256 0b9646012aa2a498f0dd429fefed105e94118a873b286e60ce0001341d1ddaae
MD5 df490ae6ec48e79265f13a5eb352bb2d
SHA1 870ba61703f44bae4898a31156ac6a1144d113c4
SHA512 d75bde017aae5111b1a409419c6ad1c998d5fba4134227cc96c9aac00a6d3bedeaf8ca86648420dec322cf8b7383bf1141140307a29b9a05f247a117d8f2392e
MD5 SHA1 SHA512

Submit Download

xxx.txt

Path /storage/emulated/0/xxx.txt
Size 8B
SHA256 9c8ba96b243b537b9fc01df33ad29645d9c8bdc431260df4c3ed7c9a1fbd0269
MD5 ad9fb38bb838d3c0e744be02fd6068fc
SHA1 d535690709c02cefea1ad85bec72c18463dac5eb
SHA512 24147bae609ec6b0cab4ca75eab74e366e8268aa8504e483a044297fe145990d5b0299d188962a7198db6ae5f930087bd21731cc3407be2988b15d5871206768
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads