79846c929fb3ebe6425fd83c06c4c0d9d43ead821d6da75e37472b99a185898e

Analysis

max time kernel
129s
max time network
137s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
13/10/2024, 20:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

41f767ee5f84e0b0c3b0b0943ba4debf_JaffaCakes118.apk
Size

841KB
MD5

41f767ee5f84e0b0c3b0b0943ba4debf
SHA1

a625e142236dec98a53baaaaa4e48db1e890951f
SHA256

79846c929fb3ebe6425fd83c06c4c0d9d43ead821d6da75e37472b99a185898e
SHA512

9f1c0d00da27f5eb5fd6b9e1d12916d87f2e5642a526d8aeef0f35a55a956573a8bd9fbb4a43839a84858bef41a98bfd06b3e8df59e4b6d8a8ba8f9a767dbc58
SSDEEP

12288:FTufHLI6xRbH7F/tRr1d2GWxZUZSOT1FUe4nOUV2R8/Iagn+qs1lHG0GJeK3UzVw:FTufHssAoTodNARZFtXLcX8jkqH/j

Score

7^/10

banker collection discovery

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.appoffer.batterydoctor

Reads the content of the browser bookmarks. 1 TTPs 1 IoCs

collection

Data from Local System

T1533

description	ioc	Process
URI accessed for read	content://browser/bookmarks	com.appoffer.batterydoctor

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.appoffer.batterydoctor

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.appoffer.batterydoctor

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.appoffer.batterydoctor

com.appoffer.batterydoctor
1⤵
- Queries information about running processes on the device
- Reads the content of the browser bookmarks.
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Checks CPU information
PID:4493

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Data from Local System

T1533

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.appoffer.batterydoctor/databases/whitelist.db

Filesize
16KB

MD5
122049bd364333dacd7397cc7553a294

SHA1
28aa28bdb865024e04d82363bdb70fb821a7110e

SHA256
ffaac12354ba667a605e7690116f32a1ae5b6c7e7674fe9d9bccc190affea596

SHA512
035faded2a1ab710d9c8ed994dbd36c2564312281dc3cede7b4b9c3b66b68a8ec7ccb6e86b90eab9cdca9ceb7b5284379eb60c795758596d48239f2d845dc72e

Download Submit
/data/user/0/com.appoffer.batterydoctor/databases/whitelist.db-journal

Filesize
512B

MD5
88bc3ce2cbaccf82550a6cc6ba1ea965

SHA1
3aa587905c4a4d220fcd7aa9a1be031918c67e01

SHA256
85fbea0df4dfcfb3fbc9fb0f59eef09f9bc49504be94914a319b6e8ef75a4385

SHA512
e4e261aa2feffd54dc2e5ba5f54e3a74ecebbcd71d430aaa999d67f7524ac390a03c5ffcd347e4933da2b861106887a6837857402bb7dc88877eff58148665bf

Download Submit
/data/user/0/com.appoffer.batterydoctor/databases/whitelist.db-journal

Filesize
8KB

MD5
8d0ddfba23c23ed8dc0ab48d849e68e5

SHA1
4f94ac3aaf9ae6cfd54e0f70d2b5dd833266290f

SHA256
e985c561c4c0a730994c2bdf8bd87394e91359ad7d8d44997eec60bd814858ad

SHA512
7ffeeec346352d68e513eba200fc3a0f8489b7ee050a29bcdfabc94112c8958fd97f4da8169555ba59636386b7e9c8f600b4eb191f8c11f3dc1f89e45b24ce11

Download Submit
/data/user/0/com.appoffer.batterydoctor/databases/whitelist.db-journal

Filesize
8KB

MD5
cad324496927b420da71ee609bcf1a4e

SHA1
d015baeffd25540d2dbe0865e6e4c2269d64c00c

SHA256
03a59ae42451f9155eea5f715a9f9ca76dba1295948b253d70addab7033504f9

SHA512
2c9bc4b4f7e0cb8808dc118339172024a00d68c279fedf2c725303027f39dceb696ac0dfb55ce7fa2ad88214e2c2e4a103d916b14fad8048360e417f98dd3620

Download Submit
/data/user/0/com.appoffer.batterydoctor/files/mobclick_agent_cached_com.appoffer.batterydoctor

Filesize
105B

MD5
ab3c5497783b23ec937a5076d74f3267

SHA1
ddf7e9da8fc98115dede8348f3b2debe4e00531c

SHA256
3d140156ec8d2c9b8325f8e8cd003208882ff55cf85c7d1a7257722d91716652

SHA512
c32377ff638263f9f191e36e652c673cfbf5a4b8983622a304b5f17a10b1946a86b12871b8c73f12e9012754d00687082114e7ded9de29c578e4fbca9f7d1799

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads