Analysis

  • max time kernel
    3s
  • max time network
    153s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    17/10/2024, 17:18

General

  • Target

    52d067cb22ad6ef2b03e4f91468920be_JaffaCakes118.apk

  • Size

    375KB

  • MD5

    52d067cb22ad6ef2b03e4f91468920be

  • SHA1

    d243f4a4a7fbf0b52abfb897a4482ac6b2a20115

  • SHA256

    cda975fef4ea0ef0f218ab99dbfc060ed2b807c2b34f25b8bd63414cebade0d4

  • SHA512

    0aaca096f7d2d39c21a5310c6107683331ce7f0bb139c795a77f4b4c82f2413a3397a93a3397a12182f81f7dd89250e92f0e05d9be6b267b8a10d58ed600a55a

  • SSDEEP

    6144:PTXy9U+kuwFrX6LgCfffe1ueffZixfw3ENHgURiw6n7BvJcVYCnMbB4/fOt6gqMz:++Ff6LgCfffheffZsNNA1w67BvJU/Mb9

Malware Config

Signatures

Processes

  • esxfxca.qd.bp
    1⤵
    • Loads dropped Dex/Jar
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4219

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • /data/data/esxfxca.qd.bp/databases/myqqdb

          Filesize

          20KB

          MD5

          a8469352bcab1100e621f71e85df5f2b

          SHA1

          2876a9fd6a9d646183c0f389c97a8730422e3bc8

          SHA256

          6e01f1d316dd6282c4f5d812df0dba21b28f3df8e38b8e65388301d437f1a91a

          SHA512

          447e472f090588d4b43f2a8356971222975a68a3f7a77f11bd4bd2573aff3dba469eca45f6ed9f3be798b22913d7989cfa6c3c432e1f966c255a070fe72f12de

        • /data/data/esxfxca.qd.bp/databases/myqqdb-journal

          Filesize

          512B

          MD5

          b2e1d7f1ba1a5918c68b67cca0894b41

          SHA1

          fc70100209969888defdeae4b84aada5152c29cb

          SHA256

          dbb24c4d2f69fa9c2e056f859e129c34f07354159b3e6f65d1e5309658c78e2e

          SHA512

          476b3f8c7c1cd9c61d270ebd21c09e308e239b19c666d945d5c36da9e4cd479d0b995ffef381931cdd4efb7450c3ef31a41f6959735df7411a3be5b0098c3d0b

        • /data/data/esxfxca.qd.bp/databases/myqqdb-shm

          Filesize

          28KB

          MD5

          cf845a781c107ec1346e849c9dd1b7e8

          SHA1

          b44ccc7f7d519352422e59ee8b0bdbac881768a7

          SHA256

          18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

          SHA512

          4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

        • /data/data/esxfxca.qd.bp/databases/myqqdb-wal

          Filesize

          32KB

          MD5

          d8dac81cdefa8d63926479588bb7dfe1

          SHA1

          e31846df7d5d8fb51a16db04e7a5ec2aca70c0b4

          SHA256

          240418365eed49e5ebc4429e1afc611997c35565a1a5ffaf587a9b1abe675266

          SHA512

          57ff8dc10f765b68bd1c877e8bbcb4021deadabc9b494599401a66f13fd638fba291f5e905e97ad231b681a70a38d6cfd608f11f412830915a9c9d7e2a54c44d

        • /data/data/esxfxca.qd.bp/oko.jar

          Filesize

          20KB

          MD5

          4d271112b02d0ef90b36a24a6b1ceb43

          SHA1

          7ae2004a73e1ee67c08ab620fae7a3f6c10e30aa

          SHA256

          d39982077825dc257b9258dad2b9011ad0bd286fbdcce24f4dacb814d24b0676

          SHA512

          f0093461ea915e5de904f16c40c941e8b74492b81cdda9c8f53109c44eb2498986dd763a12f7ae81fa435f9c488b1c0edc5b9e3fca4b1fc06875d90c4f0680ab

        • /data/data/esxfxca.qd.bp/oko.jar.tmp

          Filesize

          20KB

          MD5

          8a6e99c5d0023705adb9d397d2d5b434

          SHA1

          45b7dff87441deefbcd3b9c864bcd1987595e24a

          SHA256

          d91e754a8098a6ed7e1f3713598cb067a89ffaea6d52a8c615521340fc00d205

          SHA512

          1f92827f3c999c8289a34a0d05b82aee8c3dc95a0993afbfd73428329a3bc1023687da793414dbba8abe08feed6886d7121ee8047da0d1ba34a8f346b51f07e0

        • /data/user/0/esxfxca.qd.bp/oko.jar

          Filesize

          44KB

          MD5

          4821a760a00e3eee0fa594232a74d482

          SHA1

          d968db780a779d2ef3d2e8b6872b0a0d36952131

          SHA256

          b8e371291b4a6def026b736fa8ef72cb60a19e8a8957ec1a2cd6f433f773b9c2

          SHA512

          fee4acaa652779d51f1fdda74f105cb103caadc1e95ab8a598726efe93bdb90c283a9549aa6333b4df993657e2cc0933b27f7de8d4022438ff2e01799956f4ba