3aafcee876f7f08306cc604618a93d653d1b0e218def199367b0a9900adc296a

Analysis

max time kernel
65s
max time network
137s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
17/10/2024, 17:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
52f2b2bd6d9daed71608fe7a2a02367f_JaffaCakes118.apk
Size 751KB
Sample241017-wheevs1apj
SHA256 3aafcee876f7f08306cc604618a93d653d1b0e218def199367b0a9900adc296a
MD5 52f2b2bd6d9daed71608fe7a2a02367f
SHA1 27f36a592e9c396cdf62983d9691bcd1da1b0b83
SHA512 f96491ad59289924db6207e3e32cfe79bdd52c5dfb162cc9f4ad9ac103c543be48d289378fd33fcbeef4b5acacbc5787b0d22c30c988e686a722c913d2100f37
SSDEEP 12288:kAt95TCLqX/kv/004T7mqLgeRqC+vNoedDxTjbTdPU50osGf84k2TvWiY:Ddck0Fe5eNoYtjdQP9vWiY
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

banker collection discovery evasion impact

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	ck.coolboy.timer

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	ck.coolboy.timer

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	ck.coolboy.timer

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	ck.coolboy.timer

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	ck.coolboy.timer

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	ck.coolboy.timer

ck.coolboy.timer
1⤵
- Queries information about running processes on the device
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Uses Crypto APIs (Might try to encrypt user data)
PID:5046

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Credential Access

Discovery

Location Tracking

T1430

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

TDtcagent.db

Path /data/data/ck.coolboy.timer/files/TDtcagent.db
Size 24KB
SHA256 8957a00fd4ca9d6d41e2bc9fe704cd442e07a0a0a900db899e7b294c6c1571b1
MD5 06e29e85adaafbd6fe301fc8cb41ad53
SHA1 90b795f6a1cacf2620cec1c3104089065e233882
SHA512 b9641d18c55e7282440ef9d2c7fb7f7c26fa698c4d171424af84c207f163d43c1ac845c6ba2e7c5766f01bfdee3f5858f185f677bb055121a211df29a2e9d4e7
SSDEEP 24:TL6b3nxeb0TDHYB0ECWYqlBl8Uxz/gpEGSP/5/1Goc5J:T2TxeYTDHY8qlBaUd/gpTSP/Z4J
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db

Path /data/data/ck.coolboy.timer/files/TDtcagent.db
Size 24KB
SHA256 1bfd5dcc5332bca4386869fc68698b218f7b155a0999a927b9f0dfc28db3b702
MD5 5f59c2d8a3b8b81950edda78b7bee14f
SHA1 83e90f680da5340f07e70486dbe80909f76c6f23
SHA512 03530bb8d9dee88f11ac6b034a1962319cdeafc6d4ef2e3a904df3e84cb2e756fc4c5e6465c77564484004d8e32aaea3443869b283e4f5bac0da6a95c71e85e4
SSDEEP 24:TLa3nxeb0TDHYB0ECWYqlBl8Uxz/gpEGSP/71Goc5J:TGxeYTDHY8qlBaUd/gpTSP/34J
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db

Path /data/data/ck.coolboy.timer/files/TDtcagent.db
Size 24KB
SHA256 9ed3d83b652c51453a17fdef6c96d0ef43dbb488e9f732cad6eee355dcda9e15
MD5 14e35e7751199b53df9fcc9eed86e460
SHA1 1c101f37ba0b76c1c9dc236d8a3fc0e0b64dd7be
SHA512 862427edb427c91ffc30f444dcb982c2a77d2833c6ccc5e972a704d8eefb287838525b30021a69275d85daa67a4ab7ba26d5543308950accb29d8aa3e5bf60fd
SSDEEP 24:TL0h3nxeb0TDHYB0ECWYqlBl8Uxz/gpEGSP/5XdGoclSGoc5J:TWxeYTDHY8qlBaUd/gpTSP/ZUK4J
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db

Path /data/data/ck.coolboy.timer/files/TDtcagent.db
Size 32KB
SHA256 65ca5a0cf65f0510e225ca2057765d724590c98759ccfb0991c22945eccdc626
MD5 f63801a7c15aefc466a9f9f60f6f37dd
SHA1 80ef2791b0ec8fbebfa3b851eb958ed5433e2529
SHA512 39ba7e38bc56f595f66d40f8bcc6bbcb65ec779b143cf838c3a4c0de88a6592f1d97580716ca2b766a531bce2ecfe4c8c65accdaf9149ffd6ffa04fa6a8f30ad
SSDEEP 24:TLK3nxeb0TDHYB0ECWYqlBl8Uxz/gpEGSZGQQQ:TWxeYTDHY8qlBaUd/gpTS
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db-journal

Path /data/data/ck.coolboy.timer/files/TDtcagent.db-journal
Size 12KB
SHA256 7f8326af26949c26a9ef584efe0f2fa6f81aeffb6193f62525fb6144f01bfa56
MD5 3978dc65c2839171f4c9453259ef8560
SHA1 e9fb990c933c773e2aa39a237df81e9c7ff97a64
SHA512 ee1372cfbe2c4cde1726050883a6d3590c6872d163926a19a16a078027089079ced7df59d552fa30a1a8446c09c3f90a0ad44c751bb88f537c8f7ffd169470d3
SSDEEP 24:7+tbtP1Goc5MsLqLa3nxeb0TDHYB0ECWYqlBl8Uxz/gpEGSPU:7Mbt74bqGxeYTDHY8qlBaUd/gpTSPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db-journal

Path /data/data/ck.coolboy.timer/files/TDtcagent.db-journal
Size 512B
SHA256 aafdbb15b64577ceb34f4e9ad4bb2fd5135738f2bcccc42fad9c96f1c2968e96
MD5 76aaf602fff2869481496b74487940fc
SHA1 813464650a083ad28d45d454c17f0c39f23f6d54
SHA512 8f5ed7605597f87c4319f629e0bf2eaf5126a9f630ba73f5739aed2ad889676e4e8c445c88bbaab0add85a84e567a7af3b9010ea823b2a45e4c68cff7b31c892
MD5 SHA1 SHA512

Submit Download

TDtcagent.db-journal

Path /data/data/ck.coolboy.timer/files/TDtcagent.db-journal
Size 8KB
SHA256 1615b7d8d41a6e74c0b11dad11d1b6544ab814dd42c84339c3e9204c2577b9d4
MD5 e1caed9bbc5252f5922f7d1d7de45d4a
SHA1 da10798c20158f599abc02d9b2278ba1c788b50d
SHA512 ece7009d2a7a112a20af3dbf8643a51cd35aeb3ce5ea754e48c98ec814fda91d833a07bc761ad44b065a0928b8435b8ba3ceacca85320674a4cffaab96fb29f4
SSDEEP 6:7+/l9g//Gn1I/Rg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKu2:7+tidqLiuWdwRmBEyPbE
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db-journal

Path /data/data/ck.coolboy.timer/files/TDtcagent.db-journal
Size 4KB
SHA256 6df4a73a1e76a0632eb56ff970cff69f8ce4adf68dea376e7a23711cf1e2c076
MD5 3e18e042ccf1f46a8c01d26b20cde9c1
SHA1 4659b0cd7840fc100ae8912ec59fd8915ddbc384
SHA512 0ba9c8394cb951bdf0c187e03770d3adf5a6ea32ee498b92f28f722615a90c0856615d592e1affa44c2a46206a55b4ab957ed1924e270aa87c52c84292f05e2a
SSDEEP 6:7+/lEtmHPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKs7:7+ts4qLJdTRmBEyPbj
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db-journal

Path /data/data/ck.coolboy.timer/files/TDtcagent.db-journal
Size 8KB
SHA256 2a4c2b6c2cdb351fbfcc0be2a9f4cc72b8d5125018265f667560f06ae69dd228
MD5 ecc62c935db4432dc23e6caf8e0b1006
SHA1 6b9fc12a8a27c72f6be8410aa91a871ce9c329ed
SHA512 2cd6090a705daefb989165ea9fb7a0eae32dd213363977ce899e3b5f43343ec6b357db2a82ac76128433704e3e70c13757a940ccab0fcfeaeccc2add3947404a
SSDEEP 6:7+/l9n2GPg9bNFlqhKtwlOERX4PBX4ogLugMBX4suuK22C/O:7+tJ26qLmVRmBEyPbRHO
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db-journal

Path /data/data/ck.coolboy.timer/files/TDtcagent.db-journal
Size 8KB
SHA256 c8e73826b8ab1594f43b25edd17d8f4d0f8a74f6519df2371bd9c35823502cc7
MD5 fe649987c9b82f53c04b1c3d50ed36cc
SHA1 f04ec00fee17f243636ed8fa6961e0bc33001f31
SHA512 d03713a71192089dc4212acfec8b7dc8ccd5d1ceac701f03c6144c6aa7d2c0ddd7a588a062c3022de2ffdbad14b9e5f25531e60dfcb3d7887e012b5e4f3b86fb
SSDEEP 12:7+tc4nqLyxqQyNTSFby/8UxF9/gpvRmBEyPbjS1E:7+tcwqLyxQl8Uxz/gpEGSjCE
MD5 SHA1 SHA512 SSDEEP

Submit Download

__local_last_session.json

Path /data/data/ck.coolboy.timer/files/__local_last_session.json
Size 119B
SHA256 82ee81dae47ad37592347e5c9e661838c3a7447a8065bc107b85ae0decdab012
MD5 c1d977c5d7a7b4307eae82d55b8a0303
SHA1 b2199142c99301a83d257dd802778ad725ca955d
SHA512 73a859bc0ca51207619471cc0a7767932ba89fdd5a89371bb782162f7dfe4ea81233124eee379910e5ff248a2ee77a305217ae48f3ff979de89d47afb73fe843
MD5 SHA1 SHA512

Submit Download

__local_stat_cache.json

Path /data/data/ck.coolboy.timer/files/__local_stat_cache.json
Size 93B
SHA256 c4eae164d3a56ce7a875b1d0dea58890101310bb0749759082e8cea68a158db3
MD5 4556b4bf63d908e078163a7711c4bbe4
SHA1 c0587be4fe88932b6866f38bf0f36b44551e42d8
SHA512 c24e110dc9441ceb4a1458f7dd5fc05f195dc4ea0ff609d17785f16109bdb02eaf2d2552bacc964b56af2577c62f1b5d087252a23cc199d3b9a4ff9daae1305e
MD5 SHA1 SHA512

Submit Download

__local_stat_cache.json

Path /data/data/ck.coolboy.timer/files/__local_stat_cache.json
Size 25B
SHA256 c8a6624f390568f0ddcb9841336aec6a564460fdaf6624e562b32935b8956f19
MD5 2d805b13f2f28dc3ca9bbcc000f49bb5
SHA1 9eac165b4d81258fd3967cde5cc53b53b1dabcb1
SHA512 5db8c57bab36bcf9db698c1dce70318cbffc156dd1d1c1e09e5b7ba60aff07b598ebbf26c4bd8a2b03bd6e59ef2dde2d944a22a8d8a19ecc8378e83afb7c83b0
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads