Analysis
-
max time kernel
5s -
max time network
145s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system -
submitted
10-10-2024 13:45
Static task
static1
Behavioral task
behavioral1
Sample
302afcaf752e4556ac3538949f0dd671_JaffaCakes118.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
302afcaf752e4556ac3538949f0dd671_JaffaCakes118.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral3
Sample
302afcaf752e4556ac3538949f0dd671_JaffaCakes118.apk
Resource
android-x64-arm64-20240624-en
General
-
Target
302afcaf752e4556ac3538949f0dd671_JaffaCakes118.apk
-
Size
6.6MB
-
MD5
302afcaf752e4556ac3538949f0dd671
-
SHA1
06a7709ad99f3d88063079b8c12ec2c30fef9057
-
SHA256
c933ddd319da46d85bc26a7d3afd4595c5afe16aaf38380d4cb7d6debf532c5f
-
SHA512
0368447748fc36682640629037aa9d7b286b70cc8d0339f7098666a6370da1b877894bd04365ecfb51f98f865531db55948d88647d5a73ea5b482ac6e0cd78a1
-
SSDEEP
196608:Kva4un9zzWcpzg066Wby3wfQ0kFHXBnD6kMSEmYl98VrF:ka4u9zzWog4J32VkFHxD61mYqF
Malware Config
Signatures
-
Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getCellLocation ru.dx.videopalyer.activity -
Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock ru.dx.videopalyer.activity -
Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo ru.dx.videopalyer.activity -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone ru.dx.videopalyer.activity -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver ru.dx.videopalyer.activity -
Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo ru.dx.videopalyer.activity
Processes
-
ru.dx.videopalyer.activity1⤵
- Requests cell location
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks memory information
PID:4252 -
getprop2⤵PID:4364
-
-
getprop2⤵PID:4384
-