Analysis
-
max time kernel
33s -
max time network
131s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system -
submitted
15/10/2024, 19:21
Static task
static1
Behavioral task
behavioral1
Sample
4992cb7c8158830a16fd47b8243988f1_JaffaCakes118.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
4992cb7c8158830a16fd47b8243988f1_JaffaCakes118.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral3
Sample
4992cb7c8158830a16fd47b8243988f1_JaffaCakes118.apk
Resource
android-x64-arm64-20240624-en
General
-
Target
4992cb7c8158830a16fd47b8243988f1_JaffaCakes118.apk
-
Size
549KB
-
MD5
4992cb7c8158830a16fd47b8243988f1
-
SHA1
291501e76d9081aaa22f3212e3c2fce6bbd09308
-
SHA256
dd9243ac560fccca43dca5b93e2121a95e9a33bb7394a5af8464f9a76a69162d
-
SHA512
443c0bb2c4de2445c345e7ec4138c0ddb04beeada28586db5d52882d9b6b84685a067e02f59676ac649b2ac9316dc3e3b4072a1fa808ff55fae526475dccca07
-
SSDEEP
12288:L9fnxozeoj7WWYQeEbr+2683sz2RuLApsn0GK:xfxozeo3WWYQlq26L2Ruus01
Malware Config
Signatures
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
description ioc Process Framework service call android.accounts.IAccountManager.getAccountsAsUser vn.adflex.process -
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo vn.adflex.process -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.taigame.sms142 -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.taigame.sms142 -
Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.taigame.sms142 -
Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.taigame.sms142
Processes
-
vn.adflex.process1⤵
- Queries account information for other applications stored on the device
- Queries information about active data network
PID:4310
-
com.taigame.sms1421⤵
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4344