2fae3654a1d9aa428468f3258a302ccfb0f1319eb4be3654680643b28e008da4

Analysis

max time kernel
28s
max time network
153s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
08/10/2024, 21:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
25f3077810a169cbdb154b46cfbd8ea4_JaffaCakes118.apk
Size 4.2MB
Sample241008-1pvsmszfjp
SHA256 2fae3654a1d9aa428468f3258a302ccfb0f1319eb4be3654680643b28e008da4
MD5 25f3077810a169cbdb154b46cfbd8ea4
SHA1 270e2d0fc333ecb380d620d7c763723e0769f79c
SHA512 74c3e90e276a65315134b382622b741eba1c0b82700feaf737cca4be77edadec42cf90bb05edde018857934e80a8176c6fa5dcd85f9fd7ea23cd5e64ae57501f
SSDEEP 98304:GDgLexdJ93ToXOtubFKlBVX4gWwB6FRHZoe9Fz:rLOtjoeIEBVIgzgHZoe3
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection credential_access discovery evasion impact ransomware

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.koplay.launcher

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.koplay.launcher/cache/1582435991586.jar	4448	com.koplay.launcher

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.koplay.launcher

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.koplay.launcher

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.koplay.launcher

Changes the wallpaper (common with ransomware activity) 1 IoCs

ransomware

description	ioc	Process
Framework service call	android.app.IWallpaperManager.setWallpaper	com.koplay.launcher

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.koplay.launcher

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.koplay.launcher

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.koplay.launcher

com.koplay.launcher
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries information about active data network
- Changes the wallpaper (common with ransomware activity)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4448

com.koplay.launcher:download_server
1⤵
PID:4488

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

wallpaper_orig

Path /data/system/users/0/wallpaper_orig
Size 743KB
SHA256 85feee2427dfb6091297d81160d8a2b95066fb67f287605d66f88dc21747f3bf
MD5 a84e27f129ffe3f269c023230eaa3009
SHA1 cda3b895c1517ddd617e7652e73dc8678300f4e1
SHA512 9bc03be741ea3bab1ca6c482b82fba07f54e9cb3a0616b8692895c647457b3af22f2dc434fa43534e0597ca5293ae2ee2ea843d5226096e9029d4866c77297de
SSDEEP 12288:7Gn8iSIt/V5eN8KJjPFgUo38XhbBGy/SvyBi15fALUkYzseV9UTd1xC7ZQE3F/p:7mpZneN8KJjPFxo3qBWyBa2LdAjgE9R
MD5 SHA1 SHA512 SSDEEP

Submit Download

1582435991586.jar

Path /data/user/0/com.koplay.launcher/cache/1582435991586.jar
Size 9KB
SHA256 f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce
MD5 e8e0527a01aefdb89afd2c508f131da1
SHA1 f1103e6b260c657ceb3d95f1b023af3fda8b133a
SHA512 fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34
SSDEEP 192:uGJqbQwgQYuNUnEV4bAa0s/ombgmdxjX5fGpTVHb3qX:LkMwTTNdlns/ombJB
MD5 SHA1 SHA512 SSDEEP

Submit Download

1582435991586.jar

Path /data/user/0/com.koplay.launcher/cache/1582435991586.jar
Size 20KB
SHA256 2897b0812077c654a9b3fbb0b6303d5cde681eeba7ad9981de65716c7810d685
MD5 fde2ee00cbd121cfab5290b078aa3ceb
SHA1 e2b77d5320e155e413d040a8c20020962065b2f8
SHA512 a9326aff8e454a2b4ac09984ef2a65fddd4dc146b4c44d839035549bff8c9fdaae490326d0b018f76c1ca2e4fb25426d74f550ca0950982fba632a023af99a56
SSDEEP 384:Za0jn+huC5sMvRuvypj6f2ZzJgm+poK+l8m4qxXpj/7wyxBLBiok+9VQ3AKm8:ZU5sMvu/f2/gm+pDAPzj/Dip+9y3AK7
MD5 SHA1 SHA512 SSDEEP

Download

com.koplay.launcher

Path /data/user/0/com.koplay.launcher/databases/com.koplay.launcher
Size 24KB
SHA256 4da844e9920528445524bfe2fe02ad7ca0c1d2ae3d4dc3eafb3fe8ca2b33bd93
MD5 ce3ab16d8ffff753920793eccaf14df7
SHA1 121db5fe1d910b87e9da7cd6a05b866c0441a0d0
SHA512 f57bd0ea2a1263684bc4930728b7e5ffa28e23a39948806e43b94693d1fc3e778921fe0a6127225d3dcbc5a80de0615564eaa2cd69b4738448ef269d6c01bd2e
SSDEEP 12:TLZlxbYyRWjBGUpWTuM53WtixNtr8uTzFU2FVtNrhRmBEyPbD3OwG:TLKe8sV/uGSzG
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.koplay.launcher-journal

Path /data/user/0/com.koplay.launcher/databases/com.koplay.launcher-journal
Size 512B
SHA256 0a7e4bc33f75ae23111ebb751d2276e3fa08d801353fe44b0479115d66f74be4
MD5 8fc46c816926342510f6741b1f811cd3
SHA1 7fc53de37f17abf862669b9e43586c3a66791f27
SHA512 a891205239d9cf2e9029218985fc2e88b6108b4fe7c708843a2a4f0a92861d8213f65e5556dfba250f82fb840a1fe52d153a506aed9661a6e532ad52504c090e
MD5 SHA1 SHA512

Submit Download

com.koplay.launcher-journal

Path /data/user/0/com.koplay.launcher/databases/com.koplay.launcher-journal
Size 8KB
SHA256 1d7cb62204b1a6c98d9b4abb9793701e64c9a47f09dfe4cb9368825d1859f50b
MD5 3ef129ac7d4dcd4cd88e7037bb7b63c8
SHA1 560833cf883d000036fb0ba27efbf9b3f810631f
SHA512 ad7d6d15586ff61161e27425a8601e944f05088796752c3e5f62e521fc5bcafb1f4e44bf07e375ea41a7db52dd125828d3499c2a79937c2fbfe63334c53f659c
SSDEEP 6:7+/l96un1qg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK4u:7+twtqLiuWdYRmBEyPbM
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.koplay.launcher-journal

Path /data/user/0/com.koplay.launcher/databases/com.koplay.launcher-journal
Size 8KB
SHA256 cd31472f20f40981363c6142c09163301b79054ff58c33bb7a96dbac24c59f22
MD5 25235b142cbbd9db97b806ecd8eb11ae
SHA1 45cadc88583cbd18ad965af14869c1fc910ae5cd
SHA512 24873a05172ee572ccd69fa1fe51111be48bf7345ea71d54c9c732eb03c0b0747711ea6ef1684c705821ca561f8b4763d1fe21ed71fab3501889d8337b406661
SSDEEP 6:7+/l9lIFPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuK8Gl//5n:7+tLIBqLJdeWRmBEyPbKX5
MD5 SHA1 SHA512 SSDEEP

Submit Download

xxx.txt

Path /storage/emulated/0/xxx.txt
Size 14B
SHA256 288896d3f5ec6bbb294b0df997394bea9bae79046516d2b77b85e0763e8b1057
MD5 59d394af07b501b7f1f2cb4d43d7febb
SHA1 14d0ebaa46b30c05c5a6ea7ed573cf0665ce2bcf
SHA512 7a6cc251d1d72fbf968bf726222116354355c5e25383e91b683870caa823e860a3442f46e55c8e6b32184441555fc1264a715d4418f3d8ac7e3fb77f29864a54
MD5 SHA1 SHA512

Submit Download

xxx.txt

Path /storage/emulated/0/xxx.txt
Size 22B
SHA256 0b9646012aa2a498f0dd429fefed105e94118a873b286e60ce0001341d1ddaae
MD5 df490ae6ec48e79265f13a5eb352bb2d
SHA1 870ba61703f44bae4898a31156ac6a1144d113c4
SHA512 d75bde017aae5111b1a409419c6ad1c998d5fba4134227cc96c9aac00a6d3bedeaf8ca86648420dec322cf8b7383bf1141140307a29b9a05f247a117d8f2392e
MD5 SHA1 SHA512

Submit Download

xxx.txt

Path /storage/emulated/0/xxx.txt
Size 8B
SHA256 9c8ba96b243b537b9fc01df33ad29645d9c8bdc431260df4c3ed7c9a1fbd0269
MD5 ad9fb38bb838d3c0e744be02fd6068fc
SHA1 d535690709c02cefea1ad85bec72c18463dac5eb
SHA512 24147bae609ec6b0cab4ca75eab74e366e8268aa8504e483a044297fe145990d5b0299d188962a7198db6ae5f930087bd21731cc3407be2988b15d5871206768
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads