3aafcee876f7f08306cc604618a93d653d1b0e218def199367b0a9900adc296a

Analysis

max time kernel
64s
max time network
130s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
17/10/2024, 17:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
52f2b2bd6d9daed71608fe7a2a02367f_JaffaCakes118.apk
Size 751KB
Sample241017-wheevs1apj
SHA256 3aafcee876f7f08306cc604618a93d653d1b0e218def199367b0a9900adc296a
MD5 52f2b2bd6d9daed71608fe7a2a02367f
SHA1 27f36a592e9c396cdf62983d9691bcd1da1b0b83
SHA512 f96491ad59289924db6207e3e32cfe79bdd52c5dfb162cc9f4ad9ac103c543be48d289378fd33fcbeef4b5acacbc5787b0d22c30c988e686a722c913d2100f37
SSDEEP 12288:kAt95TCLqX/kv/004T7mqLgeRqC+vNoedDxTjbTdPU50osGf84k2TvWiY:Ddck0Fe5eNoYtjdQP9vWiY
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

banker collection discovery evasion impact

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	ck.coolboy.timer

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	ck.coolboy.timer

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	ck.coolboy.timer

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	ck.coolboy.timer

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	ck.coolboy.timer

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	ck.coolboy.timer

ck.coolboy.timer
1⤵
- Queries information about running processes on the device
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Uses Crypto APIs (Might try to encrypt user data)
PID:4252

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Credential Access

Discovery

Location Tracking

T1430

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

TDtcagent.db

Path /data/data/ck.coolboy.timer/files/TDtcagent.db
Size 24KB
SHA256 6e8a0278536bca5ddaae31ba28f35a7c34c4abc31a4fb2b1f8d7cb36d93a3d1e
MD5 3f722437f70402962fb9fd09b4a90b77
SHA1 eae7f8b5eae71cc4b408d59ccdbad1277003fbf4
SHA512 c1fff44ad0e308b46409f2e1a22a8730b78aa4dfea6470ed97682b58ac3ad1d754a7c3f5c85c55db4d7b7e6adbdf5da22e8fb968fa336bdde027023d2a1d61c4
SSDEEP 3:pqA15bjLlS/yJFmLG3ckO7rkU+VvRU/QDHK1:pq+bjLlS/azcBvkxvRUEK1
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db

Path /data/data/ck.coolboy.timer/files/TDtcagent.db
Size 24KB
SHA256 b7cccc12def808ebdcab1c40434e41cc40caa6f197bcda175254aaccae9466b9
MD5 cf039abd680ddb44938899ec39db8f12
SHA1 132df6135d12695c8c28170751bea14ccbe2df9a
SHA512 9e7243a506365d181c58a08b1213cded4b820db618b6ccd8c144e4a8e90aaaa78a620120a32fe53f86feb5b3fff581d9d72a0d21f6e88bc6a534156e0ae1e926
SSDEEP 6:tj5nf5/BKEvRUEKkS/azclAkdLlS/azcBvkxvRUEK1:fBBHPDS/oclHlS/ocBvkNPI
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db

Path /data/data/ck.coolboy.timer/files/TDtcagent.db
Size 32KB
SHA256 b455bb6d9ca4b802054f6f1e72d66184b37897ba60a1e5b5de456454ddd07828
MD5 0fcb31920c258bcb52a89d3acddf2d4a
SHA1 dd764d611e087ef4e43f0a5cd3f3be85e062eb17
SHA512 009f5d30aedf58e5c88835cee9a6b87a073660627beda8a09070eeb9139be05f78d11677ce31152f57a988ff132a469d9231140fea3f4c7cb078d39fa55509a3
SSDEEP 24:Ts3nxeb0TDHYB0ECWYqlBl8Uxz/gpEGSZGQQQ:TgxeYTDHY8qlBaUd/gpTS
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db

Path /data/data/ck.coolboy.timer/files/TDtcagent.db
Size 24KB
SHA256 a9a2335e9b0f446573e2430201cfa2af2306e0c351c2cb06de3df12dd0857426
MD5 c22010506e1e5703cb1d069be42ca136
SHA1 a7af25d566253668644ce96f90159e280210e073
SHA512 0a46f4931ee53b86839c4172ca0d87d7d3c4d27eec2d137a055651357b5764efea62fd58fe47b31ca9da8b106bda7b9b411a6c33c53f0f1979d64b7fb089064d
SSDEEP 6:pq7Pw/vRUEK9Y/DbMTJvy+bjLlS/azcBvkxvRUEK1:WIHPvDu/3lS/ocBvkNPI
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db-journal

Path /data/data/ck.coolboy.timer/files/TDtcagent.db-journal
Size 512B
SHA256 49e3ef82642d8decb032da11c6d782354dfffd9e3d88c2f07409fe65b0066b1f
MD5 c0d811bbe551bf9544ed5b60f61d9f21
SHA1 290778468d6c4ce68c6d034941cb804a523fe0f5
SHA512 0d866ca8a6fc8efb5a989042f1d202631fe015626a96a5592985e7af3b8392b5736a707f4a00a3a0e84f19ba0b9a8e6aba427f44d9a5ffc8304b6d7dd1744ff2
MD5 SHA1 SHA512

Submit Download

TDtcagent.db-shm

Path /data/data/ck.coolboy.timer/files/TDtcagent.db-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db-wal

Path /data/data/ck.coolboy.timer/files/TDtcagent.db-wal
Size 4KB
SHA256 f118d5643f5ac3b49fa6aadbc335f7e65854e2fa1c1ebe9234d278e3f9a7a8d5
MD5 7611903ec5d0080b5f0835141c3903f5
SHA1 f38d2ff8942cced04673979c67be71de9f365cd3
SHA512 0c991db9c75d49748a5c38f999cbf8997c653bbad677a9ebe5d50a079f829e2662042b9bd2bfaaeacc2215d04d2cd6b13d9bb5ce0c85a96a9f5306dd91f29d0a
SSDEEP 3:OlH/lQc4GQ/RtDE6Ljp15bjLlS/yJFmLG3ckO7rkU+VvRU/QDHK1:KC7DY6XxbjLlS/azcBvkxvRUEK1
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db-wal

Path /data/data/ck.coolboy.timer/files/TDtcagent.db-wal
Size 8KB
SHA256 07a0f981c85b6e7d98d49ecc16f814e3bc7c078b2dfc8975eb88298a8fe3c55c
MD5 aee90d1bfedc8d034125320942edc8d8
SHA1 6d31af9f8af1cd37acd99c228a9e5cd7695cd2a6
SHA512 aae8031c1f075ddfd13e53c1d33ac32dd1eea9917b7c9a161462563a4fda0f1272dec1653dce3135dd6c3b464420ba8b189a02c898d559d8e3142a8315725bfc
SSDEEP 6:KEIj3P7yj5natoI5/BKEvRUEKkS/azclAkdLlS/azcBvkxvRUEK1:KEmqGoCBHPDS/oclHlS/ocBvkNPI
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db-wal

Path /data/data/ck.coolboy.timer/files/TDtcagent.db-wal
Size 72KB
SHA256 9b0f5ac6cb9b4ef42c9c688a9b01df386589672ed9d39f15f7ebb974ca9cedd2
MD5 fb66fedcc7364ae1362bb19eae46ee84
SHA1 60d8f0e468f0ef03914eb614d64d40d45db8b807
SHA512 d1fafc7ffb5af2c5d398cbd71670d668493a64723897416eea1ad6031f77f08a46a900e63d7d70e0c041333859ae8fc702591ac61c58e1e781ef1af027a4da74
SSDEEP 96:G0P2NxrPFUd/gpWPHla3ql8Ud/gpWPotX68ql8Ud/gpWPKzvtg8ql8Ud/gpWP:B8qBeaFa3q/Beaa68q/BeaK68q/Bea
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db-wal

Path /data/data/ck.coolboy.timer/files/TDtcagent.db-wal
Size 16KB
SHA256 bf212dbf1510ffbbbe846b70edf8c2f8cb5e064473fd6bf4b001c61070534fdb
MD5 9daa8b54be30d73a42de44e41258c484
SHA1 04e53e7ca23bb0532cfa0346a9134406e5803b16
SHA512 14870aa98370e0526df2e3f0093c11a7ace26b65094277b83bb086465cafad6ddc8148cc96fb241a0fee9eae27b524a10b08489d4ed3214bed6de1879d86331c
SSDEEP 6:K+vCugmPw/vRUEKR25uetDeGWrSd/DbMTJv85CbjLlS/azcBvkxvRUEK1:KbmIHPXDueDut3lS/ocBvkNPI
MD5 SHA1 SHA512 SSDEEP

Submit Download

__local_last_session.json

Path /data/data/ck.coolboy.timer/files/__local_last_session.json
Size 119B
SHA256 45bc629db5a9482447f32f293e271a36a22156a6f9a8c5c95613241844cefc56
MD5 a17525e2ac8436fa5f3eeba46bd247ef
SHA1 8261af22998e38476b1feddf2dd186626611f2eb
SHA512 93b58187a1219ea8b5a02e0106483403fcd17bf8759c4866aaa1bde39f459f4348daceaddf9e457a5a1667df48a1be781ac8c530303b5489b63c88840720c7b8
MD5 SHA1 SHA512

Submit Download

__local_stat_cache.json

Path /data/data/ck.coolboy.timer/files/__local_stat_cache.json
Size 93B
SHA256 fa2437ef5b2d5f78a40cacf3d7de38a9bf9a80d8b21b600a2eb08f52bb64e4aa
MD5 1827376ac3cb2b9c9e38e55fa159a26c
SHA1 e7bbd7ddc379a394c85fa6ac57c87543d6b6abc0
SHA512 37f1559e8c0abb93b4d720d44724353367d7c4ed8dff0b7daa09c6036808d50edf73cffedf7c0c6bd0f566409e43be632500fb975676dce25cd0cbcd35931a83
MD5 SHA1 SHA512

Submit Download

__local_stat_cache.json

Path /data/data/ck.coolboy.timer/files/__local_stat_cache.json
Size 25B
SHA256 c8a6624f390568f0ddcb9841336aec6a564460fdaf6624e562b32935b8956f19
MD5 2d805b13f2f28dc3ca9bbcc000f49bb5
SHA1 9eac165b4d81258fd3967cde5cc53b53b1dabcb1
SHA512 5db8c57bab36bcf9db698c1dce70318cbffc156dd1d1c1e09e5b7ba60aff07b598ebbf26c4bd8a2b03bd6e59ef2dde2d944a22a8d8a19ecc8378e83afb7c83b0
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads