Analysis
- max time kernel
19s - max time network
152s - platform
android-9_x86 - resource
android-x86-arm-20240910-en - resource tags
arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system - submitted
17/10/2024, 06:05
Static task
static1
Behavioral task
behavioral1
Sample
50fbf3ab78b4d360d866d035b2928b5b_JaffaCakes118.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
50fbf3ab78b4d360d866d035b2928b5b_JaffaCakes118.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral3
Sample
50fbf3ab78b4d360d866d035b2928b5b_JaffaCakes118.apk
Resource
android-x64-arm64-20240624-en
Behavioral task
behavioral4
Sample
MyBro.apk
Resource
android-x86-arm-20240910-en
Behavioral task
behavioral5
Sample
MyBro.apk
Resource
android-x64-20240910-en
Behavioral task
behavioral6
Sample
MyBro.apk
Resource
android-x64-arm64-20240910-en
General
- Target MyBro.apk
- Size 1.5MB
- Sample241017-gs73laydln
- SHA256 2f8faa2c03cea4ddf9112251a57a29a93aa2619ff7613b2dcf738a78d0c9f054
- MD5 1254af5d5e7681b78703c9e89b3d4977
- SHA1 012bc4b2b33b5b2b9d15e7b877e1ab7a7531b768
- SHA512 cf2e5757b40e64bee900bc4ca97cbdf885357bf23b88a96427a082d52c1c1408db8b037bd8bd83fd59274f5cd0f081e98e29b10db6f17bb873fed716b1b6d594
- SSDEEP 24576:o9Q977IPzWch8MbRezSJbZFgBnxfxeDFan0G1EJIpxsaMczSDykE:X9PIPzWch8sRtJbYVx2FpJIXsK2DK
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Reads the content of the browser bookmarks. 1 TTPs 2 IoCs
description ioc Process URI accessed for write content://browser/bookmarks com.llq URI accessed for read content://browser/bookmarks com.llq - Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.llq - Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.llq - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.llq - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.llq - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.llq - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.llq
Processes
-
com.llq1⤵
- Reads the content of the browser bookmarks.
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4214
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.llq/databases/ZIRCO
- Size 24KB
- SHA256 864f26a270cff3731c272c07550a42bcba2358696667c9d6f578a2f252d51a23
- MD5 59cf974c2fe889cd5cc75cb255d1a464
- SHA1 29cbdc9090a04f1db1c27a425e70534d3a105d91
- SHA512 d596e8c45759dc567ecc92442f929237c2f5c39a5a2f2ce62911b92c736bb7f2c3e64c6d230514b74beac0687774bccdef3ba09851a6e1fb97103c102d513101
- SSDEEP 12:TZq4Xa1U9Q6LTSFbyYAyO9eFu/9Q6DfRmBEyPbD3Owzkaq:TOO7qAT91Fz0GSzz7q
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.llq/databases/ZIRCO-journal
- Size 512B
- SHA256 30cf1dc7529cc4969f174e1bd37b3d6b6b8063b60487552261149edd7c7122ef
- MD5 70667d1bba96369ecb380de80f0dc567
- SHA1 68068c96301fe4817a093190f9f80e2384f79dc2
- SHA512 3631fcbffd32987cffea577fb323943f550fe9e4c36f10c4ca375fbf793dd29932f2cae2b2b7283912cb2936cfcc7cec2e2e7a5fd22f9cd40066c110b6a40194
- MD5 SHA1 SHA512
- Path /data/data/com.llq/databases/ZIRCO-wal
- Size 44KB
- SHA256 b5f456ee8cbcb148b973acfbed9b8d9f0197e1f38fd429ea50cb709f7086e951
- MD5 3d53c5244cefa89b4d12d96b62833cf6
- SHA1 b286a7ce13501a346083c88cfa14002554b54182
- SHA512 153cd25103dd666f24696ff8542a20ab5b3562a1d696cac99acca01ae89245fceff3cff12c9c7d8ab6a78cd5b62c0a813cc0653b07937eb6b8a9a32d73f31e65
- SSDEEP 24:KQ7zyGSP/gt/RN2YOO7qAT91Fz0GSP/DzO/NrBl8yh:dzNSP/gt/RzR7qAp/SP/DzO/KO
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.llq/databases/bookmarks.db-journal
- Size 512B
- SHA256 092e1f9226e13dd4506b5d29b88ff0627e91a6143b04186bed4abd9f73759abb
- MD5 a8f188556c755bce16811cc18e20595f
- SHA1 ecb382caea0e7943600ef0bf508c2a923f430c68
- SHA512 b462f68de7a0e0ee0f752bc3828fc224f6457ba7b2445e8bd4c78ba55568565fb203aae5147aec611f90c77dcc290c200c313d24166910e93493e27f472ac58a
- MD5 SHA1 SHA512
- Path /data/data/com.llq/databases/bookmarks.db-wal
- Size 32KB
- SHA256 7430556723063ca9d2202244d3ef23365ba30c4697d01067ac9c018b4e9e6fe8
- MD5 773352c86b265de8e2c482ac57fabed2
- SHA1 c27dd25e4ac174792241967d5ba1b0fe5fd121e1
- SHA512 8a0c3027202133e7e1bd38229e91265167289dd283fdb359c747c5d70d6a2ff023940b7fba780adbb20ec384b4d4294aeec66ffad416694dc12365654ddf1551
- SSDEEP 48:GiUi9szNSP/pi3mlFcmlQiY6TwW41VSP/piHic:G5X0PRq4nlQ4UW+8PR2
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.llq/databases/download.db-journal
- Size 512B
- SHA256 ea84fc26518fd50562abf0f9bc1ec223fc4625db789c182a398118c5c2b88428
- MD5 fdad3e4a637fd7b9a3944f362aa70436
- SHA1 2e0cafe800441ad7dab5c261a390393751286e23
- SHA512 d944357a1dc62735763e7438d971a61f1d17b0360cf34e48fe0535c9b184dc5b603fbdeba521e24fc67c421efcbea8db358f77784489db0fb12520f6baa59083
- MD5 SHA1 SHA512
- Path /data/data/com.llq/databases/download.db-wal
- Size 36KB
- SHA256 164a07fb6c7d065dd2a43fb8e023d3b874e8663bcac3edc627004dc56543534f
- MD5 6f78db8718ae90904a351a5ac7068c9d
- SHA1 37ebfb312d6192080ed09941cbcb5f066911d174
- SHA512 379b9e968ee4a94235912f9f2315775c271513a1d51a2650278747d21cfde0f5547b908e45bdfe084cbb0eca7439f02dd7f6c9b541200d8452a1ee636ad8d261
- SSDEEP 24:KyzyGSP/Ymk3bMaWyFIfGSP/pqZF3bMaWyFIfGSV:HzNSP/paNIOSP/k5NIOSV
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.llq/databases/weave.db
- Size 4KB
- SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
- MD5 f2b4b0190b9f384ca885f0c8c9b14700
- SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
- SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
- MD5 SHA1 SHA512
- Path /data/data/com.llq/databases/weave.db-journal
- Size 512B
- SHA256 da2e0959f80d6041bd4628591d2c40fd9bcef1602b4710160ad30d8f4e9f5812
- MD5 3d55f7f4029ade83c92235f3ccd75732
- SHA1 617d32cd56f1dee5103ac63759e6b21fb57c794c
- SHA512 570cd9feefbc16f320a0ef4a54f43213c367c62d2944cbdde3e9ea8bbfc0c4918604fccfb5b53d770707ce632d48916a7f9156f0916b4f84a900a06037a5d4c4
- MD5 SHA1 SHA512
- Path /data/data/com.llq/databases/weave.db-shm
- Size 32KB
- SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
- MD5 bb7df04e1b0a2570657527a7e108ae23
- SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
- SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.llq/databases/weave.db-wal
- Size 32KB
- SHA256 13a1da9a6d08a4ba035967d5546bfc0515f6795172039b3163cf253d568a1ee5
- MD5 f5fa2c543fddf7cbb8439cb9ca543f5c
- SHA1 3fd9cc48ef723490e9a98f6dad84cb2fbfb20ac0
- SHA512 aa7b5b5fa04861d553d03a7d87c3e2df067158eb2655fb4f9d4261b4b65c0a8f76ab56a9d1bf8e812d7b3e8bee401798c7ef9c99488c5080e9572c4805d6db0b
- SSDEEP 24:KJ48zyGSP/l0hh8Ns0qK7L30CMadGSP/E:GzNSP/lLNs87L30VvSP/E
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.llq/files/homepage.html
- Size 2KB
- SHA256 193e20d0dcd3b2e3a02bbead8a6581e09e7b3f7c6b7613ad28e3e65909f36c70
- MD5 aac7d9154602a9be5122d9ebbe066c9f
- SHA1 900b8830bc6da60763327d49ef05792472f60f33
- SHA512 ad6275b4a2ebf6cb0c6e3f1e62e489901cfa4c4e5adc1b2ba1beebb57357a81d871f63f7678d93904e1c8b6221da15ae6deb79dd3d48e3d78e62369feb2f951e
- MD5 SHA1 SHA512