3aafcee876f7f08306cc604618a93d653d1b0e218def199367b0a9900adc296a

Analysis

max time kernel
63s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
17/10/2024, 17:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
52f2b2bd6d9daed71608fe7a2a02367f_JaffaCakes118.apk
Size 751KB
Sample241017-wheevs1apj
SHA256 3aafcee876f7f08306cc604618a93d653d1b0e218def199367b0a9900adc296a
MD5 52f2b2bd6d9daed71608fe7a2a02367f
SHA1 27f36a592e9c396cdf62983d9691bcd1da1b0b83
SHA512 f96491ad59289924db6207e3e32cfe79bdd52c5dfb162cc9f4ad9ac103c543be48d289378fd33fcbeef4b5acacbc5787b0d22c30c988e686a722c913d2100f37
SSDEEP 12288:kAt95TCLqX/kv/004T7mqLgeRqC+vNoedDxTjbTdPU50osGf84k2TvWiY:Ddck0Fe5eNoYtjdQP9vWiY
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

banker collection discovery evasion impact

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	ck.coolboy.timer

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	ck.coolboy.timer

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	ck.coolboy.timer

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	ck.coolboy.timer

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	ck.coolboy.timer

ck.coolboy.timer
1⤵
- Queries information about running processes on the device
- Requests cell location
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Uses Crypto APIs (Might try to encrypt user data)
PID:4498

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Credential Access

Discovery

Location Tracking

T1430

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

TDtcagent.db

Path /data/user/0/ck.coolboy.timer/files/TDtcagent.db
Size 24KB
SHA256 dd26b16a913de77b562eaa6f2979b11e281b0bb9bff5ebf62fcb2e3f776d8600
MD5 3544649a908e7f5c353d8b79ba4d6633
SHA1 ffde9e67d642aef7b15db17662d0331a60045be4
SHA512 a75960df62e2927086145a0d33343fed26e667245ccfb8dc0791cd2e98b586f9c73a7620d988e7184f4f2cf900daf843a90366092b69c101bc66f3c960bc0e3b
SSDEEP 24:TL6z3nxeb0TDHYB0ECWYqlBl8Uxz/gpEGSP/Q0T/1Goci+05:T2LxeYTDHY8qlBaUd/gpTSP/Rf55
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db

Path /data/user/0/ck.coolboy.timer/files/TDtcagent.db
Size 24KB
SHA256 76d948ad27f3797a823834ce32fddcdd9101a383cc7fcd1183d9704dbf69b298
MD5 44164fff3de5a58f22d8de9679da4337
SHA1 3a522fee68644af965c484cc5ec9ff0f308fa330
SHA512 ffca4a0327697e6d99152ce553c7e621678f34423c0395f48d3c510e282012d17c108cfbb4aabea85db943ed63740e927ae92c91fc70d7946ee0a03f1492c2e1
SSDEEP 24:TLS3nxeb0TDHYB0ECWYqlBl8Uxz/gpEGSP/5XH0EBGocWGoci+05:T+xeYTDHY8qlBaUd/gpTSP/2E3V55
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db

Path /data/user/0/ck.coolboy.timer/files/TDtcagent.db
Size 32KB
SHA256 4e596e1c353c0a4168ec5a393fd881e3b539b33d584adac18146c331b92db9a9
MD5 d710d1d5c3360dabdbf10310ae7f67d6
SHA1 5255a96e4df23d99e1110f19f3bc89392f09f66f
SHA512 3f0c67c8990b95655e1668974ac8958b75c18b6a4cc47751c5a2edeb21514f7caf865d5a08449897614e931f6585d5e33257a60ec57ca48058aab2db22d8b2a7
SSDEEP 24:TLi3nxeb0TDHYB0ECWYqlBl8Uxz/gpEGSZGQQQ:TuxeYTDHY8qlBaUd/gpTS
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db-journal

Path /data/user/0/ck.coolboy.timer/files/TDtcagent.db-journal
Size 512B
SHA256 e7abe6fdeae243cd6c2010d3dac24045a7d64604426e92314c132eba398dfc74
MD5 6bf9608a7c5134af9e1d1809c75694d1
SHA1 ccda42bacbd828586a92fc4f644ccfb1fd2966f2
SHA512 c3498a5b0eb3c0d6238f3fc336c93570b509220f65148a17661960a85af4bea2685987815dee5b6dee02dcafab017a70ebe2ee27f9fa84761a3e7c8a7303869d
MD5 SHA1 SHA512

Submit Download

TDtcagent.db-journal

Path /data/user/0/ck.coolboy.timer/files/TDtcagent.db-journal
Size 8KB
SHA256 ae1d5efdaca46444a6135ca18087c9e758ae26427aa0a76e280f60215bc548ee
MD5 3425137e5c8bab1cf793423cdedeb797
SHA1 9729e638b6654fb3f20020bae3966e3f943befd1
SHA512 976f47c2775e15619730759818c465e3ac5d47c4f97c6b5f8ef1566e92d7f83e16072762a8010d694421cb478b1c599b7899cb6e0881d780387e4333009a7172
SSDEEP 6:7+/l9HDn14g9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKN:7+tlKqLiuWdYRmBEyPbG
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db-journal

Path /data/user/0/ck.coolboy.timer/files/TDtcagent.db-journal
Size 4KB
SHA256 798972844b6d0dd73efb9d5b22df9308bb55bf3724d75bd4f9a1c9cd5840928c
MD5 40d49b70bb5fc0dd951ea412bd0212f6
SHA1 e0be29d8f50cb32de20dc0a8e9a28c32a867163a
SHA512 d8d64cd8af6ca3dd61e90f3d36757aae19dfd56590e7efc8b81577d588ea5eb7d7291904a197ec0d3a835e800dc26778a51bba7b164c3aea0179a3ff35d2d885
SSDEEP 6:7+/lFplGPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKkQ:7+tFpl6qLJdeWRmBEyPbdQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db-journal

Path /data/user/0/ck.coolboy.timer/files/TDtcagent.db-journal
Size 8KB
SHA256 c829ee02c7f448877febe48026168fc9a691c44e60a88abfacccdeae0c129281
MD5 468b024214f4eb704ed874db24067c77
SHA1 ff9dd5ac3c84306a65ca1e1a13ea8454ea6c9b34
SHA512 5868364d22efd944554034dfa31c8b42c7b1c2ec50de60898396bd0479200c48688d1d6cae106c047aef1a0712537eb5c63458319ab34ed6adf50d5102487ab9
SSDEEP 6:7+/l92l4Pg9bNFlqhKtT/kPlOERX4PBX4ogLugMBX4suuKS//O:7+tHqLmNRmBEyPbZO
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db-journal

Path /data/user/0/ck.coolboy.timer/files/TDtcagent.db-journal
Size 8KB
SHA256 337c87ab9bcd3f18f0ce0b05778a81529cd1f91ac2cadd5d02564eccea4e78c5
MD5 6fe7ba2644704b20d61059d9133ce2da
SHA1 db12bd8733b2adf3e62d2465d9a358d2f1c644c4
SHA512 272ca07a6a72f2ef913fd7d0c704b43d8bf00059907230c119e6644d60803e10cae87083331cbe1e85020f67fa1b66f939cb64f91d7b6f5dc60f2d08a4ae3ab9
SSDEEP 12:7+tIinqLy69QyNTSFby/8UxF9/gpvRmBEyPbHy:7+tBqLy67l8Uxz/gpEGSS
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDtcagent.db-journal

Path /data/user/0/ck.coolboy.timer/files/TDtcagent.db-journal
Size 12KB
SHA256 47fb17be4154e14a91b719cec1b28918d9a43552bd8ec9edac664030e104e5d2
MD5 cbe50dfacbb72654b5e11dbb24d1a3a7
SHA1 9d904d90ed0ef737787520c97761cabfe22f5e5c
SHA512 cefe9dd16a94d73472fa873ac22fbe8f12cda957c86eab9ebe3ecbe18df49624d8b2a803d2c5015059a83d27aa779ed36d60382dbc447ec190b0ce344ae2275a
SSDEEP 24:7+tD9P1Goci+0M7tPaqL6z3nxeb0TDHYB0ECWYqlBl8Uxz/gpEGSv:7MD9756Aq2LxeYTDHY8qlBaUd/gpTSv
MD5 SHA1 SHA512 SSDEEP

Submit Download

__local_last_session.json

Path /data/user/0/ck.coolboy.timer/files/__local_last_session.json
Size 119B
SHA256 bb3adc1ee8561f9db10b057c771be1ae032d6ae83a4f756e3b99a0d7452f8c12
MD5 f009a09370d459f5f1248bc741e3b767
SHA1 d0d3563d8443060717ba4efa8964fd8b439a1670
SHA512 c544c80c7c359a43144c4047eb97789c07295ae695555b26476c75e722dc828fc121cfb72ad3154581811d4f33e1dca0987b1463e6f5de413976476bfc436989
MD5 SHA1 SHA512

Submit Download

__local_stat_cache.json

Path /data/user/0/ck.coolboy.timer/files/__local_stat_cache.json
Size 93B
SHA256 35bd7711c440b2ee99db7e7cbdc23974e20b01807cdd8ecb8cf8835fee2d7f9e
MD5 24f2292bfdc8df3d67bdb738627a0530
SHA1 a84f69808e280a07edfd250160fbc4a692798c58
SHA512 798f452b31c5db137cd97858a235a1ce17482b70fce4a6f6ae717cd3bf0856f8462f5413aa1a58cf25345dc891718342a73f7598d24614414642aa01d03444dd
MD5 SHA1 SHA512

Submit Download

__local_stat_cache.json

Path /data/user/0/ck.coolboy.timer/files/__local_stat_cache.json
Size 25B
SHA256 c8a6624f390568f0ddcb9841336aec6a564460fdaf6624e562b32935b8956f19
MD5 2d805b13f2f28dc3ca9bbcc000f49bb5
SHA1 9eac165b4d81258fd3967cde5cc53b53b1dabcb1
SHA512 5db8c57bab36bcf9db698c1dce70318cbffc156dd1d1c1e09e5b7ba60aff07b598ebbf26c4bd8a2b03bd6e59ef2dde2d944a22a8d8a19ecc8378e83afb7c83b0
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads