cc54a71a073f3d3977087473d672b0f7b14a74b5ca5dfb8f8f39d51885f5ccab

Analysis

max time kernel
124s
max time network
156s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
09/10/2024, 07:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2d2952c399c0605dba2d52e03c8cb742_JaffaCakes118.apk
Size 1.7MB
Sample241009-h8ml9stdmj
SHA256 cc54a71a073f3d3977087473d672b0f7b14a74b5ca5dfb8f8f39d51885f5ccab
MD5 2d2952c399c0605dba2d52e03c8cb742
SHA1 eddda87caceaf753042f5c4c6e4ad98428fb524f
SHA512 47e782522e014cc1afae8ae46ab20d7f091064f9e79f58440a7779889efe23120adfff49073780471a682a0ae47801701ff3e833ec55c67566b2132991a8089d
SSDEEP 49152:vNOKuZIkDsqKwwMmYmQkeGdov+1BZAiWa2kXop2T:veeqKwwJdQHGdovqBga2kYp2T
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

discovery ransomware

Malware Config

Signatures

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	android.process.dhome

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	android.process.dhome

Changes the wallpaper (common with ransomware activity) 1 IoCs

ransomware

description	ioc	Process
Framework service call	android.app.IWallpaperManager.setWallpaper	android.process.dhome

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	android.process.dhome

android.process.dhome
1⤵
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Changes the wallpaper (common with ransomware activity)
- Checks CPU information
PID:4616

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wallpaper_orig

Path /data/system/users/0/wallpaper_orig
Size 93KB
SHA256 381e4b6ee30671bfc014f3474ce141a986ce1511f4706a7d9026196707b090fa
MD5 1700fc73c93f1e0ae41f1fb55a5d8bb0
SHA1 28011f05229be5ef13feadb266310486f4315a1e
SHA512 b00774e6083134a54dc2007cc8eb7bfa8438e1efeaa48194e41fdcaa5c574afbbda90e7117cc084a9154008404c54140d1418c4b5b9e0256942160fe6538adf4
SSDEEP 1536:p0wgSJ96P8gnQgr3HPYLtepwKrWUjpFzyXI2ErZIWzU41jflfkIkq/gURIAKv:3gqYfnQOYGbpF2l0U41tcIZ/1RIhv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ddesktop.db

Path /data/user/0/com.guiji.launcher/databases/Ddesktop.db
Size 20KB
SHA256 2932e61a21acf8d1a87fc23185e5be10b1f9604cf949b556886b82f0917c3106
MD5 6d0296e24abcee196ab51915064c7443
SHA1 3d6da377e1446c34f449b0591d37241378615c45
SHA512 6c0fd714dacb19e8e5df22ce9c06ca604758301e4aae49d04e38fffb0a30760935c673ad278dbcc46e1fdc8937c9bfc6cd8059d953210528bf37560027d867cc
SSDEEP 12:TLmasmyNTSFbyUiNUIoIw7W2SrRmBEyPbAVOwG:TLXAfmGSEG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ddesktop.db-journal

Path /data/user/0/com.guiji.launcher/databases/Ddesktop.db-journal
Size 512B
SHA256 962040229e7ada3a6fa085ee3ed62998555c6f840295457d6a267a1c0d8967a7
MD5 9fd4d3b73de14b87c3f620b21de1f5a7
SHA1 6f7dcce9f9f0516bd34dc6d2d85a1de5e0bb1787
SHA512 bad067e3d962cc0c4952b8e847562367b4b36b7e9d450e3d8150d8d86c43c5fb16fe94081f67c39c8b0c4df92a7767b71e791c33e04dbbb4b3f3d92588f883ec
MD5 SHA1 SHA512

Submit Download

Ddesktop.db-journal

Path /data/user/0/com.guiji.launcher/databases/Ddesktop.db-journal
Size 8KB
SHA256 9fcd9bb6006d6506c6be012edc2a04b9e3f5d9d239e995437522cea3fba91de9
MD5 ea728a7ef4da60048b4bdd06e067b69e
SHA1 0c6cd8e0533e8d97f7de1030abffa252409d0178
SHA512 6fe86ae41b01ebf0a83bdc35d314cf57b90333271754eade63709c3ee01d9aa2309d524f9b8ea065a5d95e7d81918a2de8e3e0622b8bb132c2ef342b561bea35
SSDEEP 6:7+/l9on1ng9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKE:7+tEqLiuWdYRmBEyPbX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ddesktop.db-journal

Path /data/user/0/com.guiji.launcher/databases/Ddesktop.db-journal
Size 8KB
SHA256 aacee23d2f145fe1a83b4b3e2cb826cbbc2374601bed3fdf30387e32aad654db
MD5 6848a2217afbcede4edd35f5358a94f6
SHA1 8cdfb01535e322510306bcefe426c51695cf4663
SHA512 306e6538cf1880a89ee7ad8007fde96ec7573f9db0030b2a449c7c5f0d9d1965ccd62548729ebc1aa3df3f280243066e5c6449091b172c0a3fc3029c659fae1e
SSDEEP 6:7+/l99FPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuK4nt/MX:7+t5qLJdeWRmBEyPbV1MX
MD5 SHA1 SHA512 SSDEEP

Submit Download

launcher.db

Path /data/user/0/com.guiji.launcher/databases/launcher.db
Size 20KB
SHA256 413d08e67da9e52e20317519e53e989821c4a3199b39752f1ec3d4b7660c7382
MD5 8df9cae10e4633289da2c842e883fc10
SHA1 25860c3f87441f9dbb16cac3ffb97eab0dd73d0a
SHA512 8a12dab7651bd77b80e0ff6185018f870eb5c81d356a5a3599735275598754763129c610d7c0df38221732ed87d62d1c007f4d4e9063c7dcff4406c03da2f501
SSDEEP 24:TLCq3//P2vigqVIvi+QzumeJdqVX1GSEOvNvyB/jmcAvNvyB/jiHUfvNvyB/jac:Tuc/WqVWt9JdqVASJliyNliG0fliu
MD5 SHA1 SHA512 SSDEEP

Submit Download

launcher.db-journal

Path /data/user/0/com.guiji.launcher/databases/launcher.db-journal
Size 512B
SHA256 72c827294843acf3d55ee7404c1a1c71c189826ff5fb719a27006b4ec0a2733c
MD5 7c429c6b9707d45ec19692572baa09b7
SHA1 a3d336d9a6720637879bb316ea18addca2247ac0
SHA512 57b6d6e42b362923d999da06e6477f85a5808e7de621278a033d23e95ac979fea741b53da9e3d5d00d503db26dc23da478ed732d6d9c7370dd6a4c6b3e81a058
MD5 SHA1 SHA512

Submit Download

launcher.db-journal

Path /data/user/0/com.guiji.launcher/databases/launcher.db-journal
Size 8KB
SHA256 20dae91ebd6186286e94a4b956c0fad30813fe0d0512937357696f163e7561a9
MD5 b62f2bd142206cdac3face96b10f3cbe
SHA1 76855ce9c17457e4935db910f4c08d3a2bbf81ca
SHA512 c899659dc0e9f6f529ded049353fd70a8312e35a1ce764a793f1bec4d0c4fc650cd3f68372bb83ca95b034d3926636b0962d320afcbd557542ffcce6578ffb10
SSDEEP 6:7+/l9zFn1efg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK+e:7+tRafqLiuWdYRmBEyPbde
MD5 SHA1 SHA512 SSDEEP

Submit Download

launcher.db-journal

Path /data/user/0/com.guiji.launcher/databases/launcher.db-journal
Size 8KB
SHA256 7ad7967c2e00aeff476de166818c95ac644130f6201acfa0e2df439e4aed18e8
MD5 9a0f608d8039e35d1baed296dca049b4
SHA1 5bf50c634020f1eb8253bbbfebfeda02ce2582ac
SHA512 81fbe9929eda7ca2d099e83ce163277d55dff394f5209879c9772da1f70d3911bbe8235d2155ccbee257313855a0bb2fae553a29592e6cc50c209b1f329c43b6
SSDEEP 6:7+/l9ClFPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKyN8t/p:7+t4vqLJdeWRmBEyPbD21p
MD5 SHA1 SHA512 SSDEEP

Submit Download

launcher.preferences

Path /data/user/0/com.guiji.launcher/files/launcher.preferences
Size 15B
SHA256 9bd54ce2fe34faa03d173df22621b5c747e544ed354e521889b692c031ba99b3
MD5 8045cecd3d5a4c893e3a75d47b17121e
SHA1 61f08d6c53ae857cfd4be1bf607a6c80e5e78b23
SHA512 70d34c24ccb3f90cdf930f0e24d67441e2aafc5baa5ae95c5e288b788cf25df394254f9bf55d45a5893b78457873b6169b8868a4fd45364c2b485f90bd4c0099
MD5 SHA1 SHA512

Submit Download

02181251198733467183.dd

Path /storage/emulated/0/Ddesktop/assets/02181251198733467183.dd
Size 437KB
SHA256 4a122c4c71d17f43d9223dd6159fcba08e97ebb079878a0f62f8dfc108393fa4
MD5 631a1f311f5e0161f07c3f3f217f4b13
SHA1 4718dad42bd4d3b6cd845125ce9c45444fd66fa3
SHA512 95fe5cda279ef7e739995ac281bacaee046e9370a191e9bbe4984d69d927cbd1cfd2b444a1ffb0888b7946983beb777204c77d0f6e1d56f5ed5d21fa988afff4
SSDEEP 12288:2RjEGZ25WWqrRV3yDBglikfQnL1UARqJlDzLW:2hEGZpr/CA+RqJlvLW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads