5cb303a8ae0ec0e791858cbe01609a09e48d8a336e39ef30735004fca8fb29c8

Analysis

max time kernel
125s
max time network
150s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
09-10-2024 09:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2ea938d08957dd36710b7a5a9ed69710_JaffaCakes118.apk
Size

412KB
MD5

2ea938d08957dd36710b7a5a9ed69710
SHA1

7a49fafaca24f6f50555ea0eaf30733593ba9288
SHA256

5cb303a8ae0ec0e791858cbe01609a09e48d8a336e39ef30735004fca8fb29c8
SHA512

9a1a96f0c1d2822c561f3bbe45d9775823ef4e6d350bcd59b88cfc9bbd97c6940a0ed08693e3ce809132f225f4c6ff36bb284aa6a1f95a78ba97e1aa7b51b561
SSDEEP

6144:RkBZ2zPIe0t4VfF8b/Tp/ezO/xaHTcJS8HmLcWaLTcJS8HmLcWawTcJS8HmLcWa6:RUZ9eDQ38waiRy2iRybiRy5iRyp

Score

7^/10

collection credential_access discovery impact

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	ngjvnpslnp.iplhmk

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	ngjvnpslnp.iplhmk

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	ngjvnpslnp.iplhmk

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	ngjvnpslnp.iplhmk

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	ngjvnpslnp.iplhmk

ngjvnpslnp.iplhmk
1⤵
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4473

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/wsset

Filesize
18B

MD5
4e0b88cc6c011977206b91d1170d0d86

SHA1
7c1fe55b144c23d588ee393bb9a64a5f632cc648

SHA256
0d2103c21aa02c206bba61f07d8b1109899f84fa5bbde3c5c0bd6a0142d15df0

SHA512
ef7d49a623be7a49c168d3388a9d1af845bc37531bff616452ccc71dad75b936b9973a93dafa8c83df1d95439b3bbdb10f7ff2b92cc9dbeb258ab1d206424534

Download Submit
/storage/emulated/0/wsset

Filesize
34B

MD5
433b2bf332a3d946156a8f75adfc7f1a

SHA1
69d5bcbe5fcdfec71a8afe5ab082182753f65139

SHA256
86cf7fb0d02bdda3911f906ba3587276fda66abc7543d9636af1b71a3ca28b78

SHA512
89c571c0126df71c62399fa2b30a4ba4a71ab3f6066270549a23492cd03dafd8135e245d1df2989cfef051cd3cf77d261cd27848b6a4bf9491eda1713966563a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads