5ce4e30a719ad428e677faa3a94c0ca63ae20a5bf772591f68f1c06f74c5cc6f

Analysis

max time kernel
7s
max time network
151s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
18/10/2024, 14:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
57d9786caf8ae81a6cd292fe2400e8df_JaffaCakes118.apk
Size 1.6MB
Sample241018-rd2blstaqq
SHA256 5ce4e30a719ad428e677faa3a94c0ca63ae20a5bf772591f68f1c06f74c5cc6f
MD5 57d9786caf8ae81a6cd292fe2400e8df
SHA1 507b46a7d1e23b685907352439b42e2d52a7c7fb
SHA512 ff5edd21308f41957d394f3845bbf4247420ed9fafc9bd1967bd613f8c94e8c70c97cc181e83bae6de03ee1df5bfe4ba6d6e5ef7cb2bfc22583c7efcfd90a023
SSDEEP 24576:+H1UW/NPVU/71J77wxjZ7P/KPCzi6LULmRKQr7NXcgeJwHRLgVhFQjKZ:+VUW1PQ1Jghl/K/a97NXgsxgVhmjKZ
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection credential_access discovery evasion impact persistence ransomware

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	ginlemon.flowerpro

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	ginlemon.flowerpro

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	ginlemon.flowerpro

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	ginlemon.flowerpro

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	ginlemon.flowerpro

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Changes the wallpaper (common with ransomware activity) 1 IoCs

ransomware

description	ioc	Process
Framework service call	android.app.IWallpaperManager.setWallpaper	ginlemon.flowerpro

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	ginlemon.flowerpro

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	ginlemon.flowerpro

ginlemon.flowerpro
1⤵
- Obtains sensitive information copied to the device clipboard
- Requests cell location
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Changes the wallpaper (common with ransomware activity)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks memory information
PID:4967

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Location Tracking

T1430

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

AppList

Path /data/data/ginlemon.flowerpro/databases/AppList
Size 20KB
SHA256 64412351533bb768c8877fbea9f99182938921037548fd66259cc22c301871ce
MD5 1ebfa64cdc52293915c3dced88504405
SHA1 dbbe4af1534d4764c445287c866ad6e1ec8ba27f
SHA512 de3d4340ab5c1a45dad85f86cdc78daa6799abde34d46c67845749bbe8410d96f0653b66a2318f86e58039a8631820b4a0d26d4f73cf42a185a891284a3b0acd
SSDEEP 96:+EUjlTtXpbeib62wyQVSdj5C+mlyJSUcX6m3HJQwZsl8/y50bEDyZ:7UHRcI85
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppList

Path /data/data/ginlemon.flowerpro/databases/AppList
Size 40KB
SHA256 cd9056697725693a6375d111a586fde6acb3f030d279bc7e6305bbbe8667d198
MD5 4b0afe9efc051ad3ed94768aedc99ea7
SHA1 642185924590ec59a9de0ba0fc2878036d8b8992
SHA512 8007874b3482470eab56222c7e07b6799e6641d38dce20a6b9514c881e40ce9c8ac3f0cb214d528cf6ef8527b56266d99dae434c978548ad0752d37c305c8229
SSDEEP 192:8UG1sZ0z66mUNdca2Gy6NFaZGMj/t4lFrO2kmFqpbvtthSPiVU+gihTyH5qNQy:lG1sOzqCa0u/t4lFRcbjhSQU+RTyZqNn
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppList-journal

Path /data/data/ginlemon.flowerpro/databases/AppList-journal
Size 12KB
SHA256 ffbd4c68a04143eb1658bdd507e2942e7875d719d874b50269b60c56f9117551
MD5 7f847583dc1611ff3c5d528d356b99ca
SHA1 b8c401615b424f0825b0b7fcfe312e4faedb0b0a
SHA512 cfd5fe443ba74b70231f5724846348e4fa0b731e2433fdbb97b450c364b0492410031d2b1b46c18fbca51e7364c67120639667101456cf024655e46bceb8f84a
SSDEEP 12:7+tb/qLl4hexF32SXBvVK1xAR5gfB5qRmBEyPbm:7+trqLl4cV227rgp5JGSm
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppList-journal

Path /data/data/ginlemon.flowerpro/databases/AppList-journal
Size 12KB
SHA256 a9933eea8a39a9022b95df5d39167917f4516fe1db4892da9413e0d46ca9bd12
MD5 279c97ee9ecbbf260291ee3c450a2bec
SHA1 219364dcd32478c7fdf816ef365e90e5a2f17206
SHA512 b5403c47de3eca4245df9275356b3573b1090356fc69601a60e8002471cd66a26a8480439902d66c4851995f9debb09a945213369ba6b828486f811957a2d2bc
SSDEEP 12:7+tiSSkVJOnL9GHwVqqLyx0OhexF32SXBvVK1xAR5gfB5qRmBEyPbm:7+tcKux9qqLyx0OcV227rgp5JGSm
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppList-journal

Path /data/data/ginlemon.flowerpro/databases/AppList-journal
Size 24KB
SHA256 7f300b3f9d69c4503fb2f1b3f2618a7625b174a9e7e13b6155610a8997b06062
MD5 31ccfe26a6a4c9d3e035473881ef77ff
SHA1 beaf860226498e44a6a40d9dfa20d5db91ae7d5a
SHA512 a965b6edc291b0ea35d3f719697645c439c94e73bad7499cd7eae9c5f088d01146636beda4bb7d2a6dc27466b38b79657f4d7c8cae93dd6b695343d1405750ea
SSDEEP 192:7qL6NFaZGMj/t4lFr/1sZ0z66mUNdca2RkdTyH5qNQawU7:7xa0u/t4lF71sOzqt2TyZqNXB7
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppList-journal

Path /data/data/ginlemon.flowerpro/databases/AppList-journal
Size 512B
SHA256 699bbec51124dc17cb174593440d4f52a269b80ed4d8e72438611b1df81b235e
MD5 79d13b1fec4dbadd0c1ae69213c89406
SHA1 bba9346b339066d4906eb5a9ed68fafce5538143
SHA512 07ebddcce8472d6f9604619c558ed3c508d28040c2f9bf87de7b929524d1301c186ccf228e8702c4b6e738216f4aec624eeee6926eb16756bfb0042cb4a5d2cd
MD5 SHA1 SHA512

Submit Download

AppList-journal

Path /data/data/ginlemon.flowerpro/databases/AppList-journal
Size 8KB
SHA256 ab9dbb38d7dba82d4cfff60b058d12f0f711828eab825747df005305cced9c23
MD5 9fc31bec87ae0443a63ebd0ca8d14f86
SHA1 5b9d6a18dfe69a6927002d8182765c55668f09c2
SHA512 361fdef54b4427f567fc8f4ef0a12d55e0ef28e62eb21a862e8ff873cf500362255540a1594f75696227649b77a6eaa0056c63f15b67676ee8f8e46fc17def65
SSDEEP 6:7+/l9CHn1s72vg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuK8:7+tMayqLiuWdwRmBEyPb3
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppList-journal

Path /data/data/ginlemon.flowerpro/databases/AppList-journal
Size 8KB
SHA256 449de105fcd7ce26780dccc33abaf270daab41ae5cf22c24ab603ec1b2fcff4c
MD5 c6dd4de0a75971b512311a92222a70fe
SHA1 4f304ae9e1978b17b6bfbd04d2eadb37e09e18cd
SHA512 6155ce50b8f8230134eccf04fc0484265801262e99d4b2cf2067b1ae73ec025acf2d1595ced2562b89b0ad78975c867316c4c7c773ce7288f6a0037b48adcd46
SSDEEP 6:7+/l9I/GPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKOt/gn:7+thqLJdTRmBEyPb3g
MD5 SHA1 SHA512 SSDEEP

Submit Download

FlowerBubble

Path /data/data/ginlemon.flowerpro/databases/FlowerBubble
Size 20KB
SHA256 d9b814269c40b81f0bcc73fc445e2c880ec8b40d16aae69f9b139f0c4c9eb20a
MD5 499cbafe630b309acd0a1dad57ed6b52
SHA1 825a505a348bfbba2eef667d9c61c334d1164787
SHA512 d43950da317fa7e90ce93dda348b9da738dff16c586cbe6dbf6fcdc7a41b11306650fb33e51ad14a9ee8ce35b619dced4d410fc036cc3bb431b7b332308cfd5e
SSDEEP 12:TLg0yNTSFby0D++4EvMuQjRFI74AoRmBEyPbAVOwG:TLghh/hYGSEG
MD5 SHA1 SHA512 SSDEEP

Submit Download

FlowerBubble-journal

Path /data/data/ginlemon.flowerpro/databases/FlowerBubble-journal
Size 512B
SHA256 f1e8f3a0e42a94479dbde3f31d1e82abe5609afe63b946bbd47c4b455b708971
MD5 a4e047d98d38e8a7143c2e6ae5c306d0
SHA1 ceb42ea40866f3ece33d1d8e98ade97ea8f33b36
SHA512 96315920e2389177e533e3a38a42703b8a89cc54c5c1bc63f9cc900889c5bfc9a67159af0bde884eb941bd074330719d1cdd0cbcd8f3e44394c4d01660c1c019
MD5 SHA1 SHA512

Submit Download

FlowerBubble-journal

Path /data/data/ginlemon.flowerpro/databases/FlowerBubble-journal
Size 8KB
SHA256 4056f662f53e5ebb006173c51a9032ad38132a8fcd1fcf8e54cd66a57efa4ee8
MD5 be75c1b3e07bb91f7d0ad8b2fcd00835
SHA1 ec604c970738cc09323fc0ad386fc49b66ee930b
SHA512 65948d6256ae524f01db75c754442450e2b7cc08945d6a5b0489eac8899cb98d5beb8fc03e8ed7dfa5bd165b452fe1420fe5d441b6cbe885d9f4c02a869c0c03
SSDEEP 6:7+/l93qn1KE9g9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKG:7+tdyqLiuWdwRmBEyPbB
MD5 SHA1 SHA512 SSDEEP

Submit Download

FlowerBubble-journal

Path /data/data/ginlemon.flowerpro/databases/FlowerBubble-journal
Size 8KB
SHA256 73d9227779918142ffc800abc1db64282190e3c6cdf4ac50158092954041c2f0
MD5 af63f5eb0c7205b533f1c72a6682e6d3
SHA1 f9ab19b91ef148e9c44cd82d8bb51372035da232
SHA512 e2d96aa18561ff0af38c5f6e7c4873668328fe3545bde0b59023304f5b6889ecd15e48ab026b59cad4c3d65b62b1d36eab82895a9722b262177cdaec873acf6e
SSDEEP 6:7+/l9DPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKs1/A:7+tJqLJdTRmBEyPb/A
MD5 SHA1 SHA512 SSDEEP

Submit Download

BubbleBitmap

Path /data/data/ginlemon.flowerpro/files/BubbleBitmap
Size 4KB
SHA256 64517d852e50818c1b205b930858c75cdd897909f8d6066639374d370f417ec3
MD5 e66bf53b17cf2de65e69979161a5b135
SHA1 6a2526ac5a50f116f8128e9e514d6a4a2325cfc7
SHA512 ca3be83d41253b14af29b623c4063bea2091f4ced394600f62837595542518e272e845793f2e26162fe124587d0060e03993a1cde9dbdf1a0472357b508bef20
SSDEEP 96:A4Y9RFAwW7hiG21cf8rAoFb2F85z8ftFz4b/rNCxF1Bw24:A4Y98wWdXZf8rhcFIcHz4bRCL1Bg
MD5 SHA1 SHA512 SSDEEP

Submit Download

ClockFontData

Path /data/data/ginlemon.flowerpro/files/ClockFontData
Size 101KB
SHA256 57e547714635f2248e78a96345c6ac75cd4aaf17a0a4260eeb1de3c5b3018a01
MD5 032593b9c5501617c8bce79dd118d94f
SHA1 bccd9ec1ebba2d39aef7cd6e37010fd2a11b392b
SHA512 f5e37a034b6703b07a0cd06a8a7bcca3ace0dd9a7a7b8e133ff212a7e73c06fdcf78c8be9543f528de453f5fa7dd08c1b3e712c1ebed7b176472a6fdd7e2d05a
SSDEEP 3072:oeWplzYCIy6NcEfGqJUw2tonPCKDg2kp8kVwS8Brz4ZP:oIU8A8B3I
MD5 SHA1 SHA512 SSDEEP

Submit Download

ClockFontHours

Path /data/data/ginlemon.flowerpro/files/ClockFontHours
Size 5KB
SHA256 a500b26e392d73042c01ef24db224e178a7fed47658f7ce0831f15a7a808f80f
MD5 df266b56b2fcb3a9ce4db5f722630652
SHA1 70560fbc68c1edcec0ac240566e4ae55bcd752f3
SHA512 f8302c6dc4c36550d64344a5680a772559ef02a5c1d5d7028fefab698bb161540fa70794b1653c2ded7d4a79daaa2171acde2a5b09beb1014e0541c6f10adcad
SSDEEP 96:E4wbXWDqUIy5nlQVZWgTtT00suScnf99pBIAHH44tO1WXzcDG509Hti6G:DwbmeynuVJp00FSC99fIA3EWXoq509Hr
MD5 SHA1 SHA512 SSDEEP

Submit Download

ClockFontMinutes

Path /data/data/ginlemon.flowerpro/files/ClockFontMinutes
Size 107KB
SHA256 5da31246695f492fa8793d8333fb7eb86706856362cc801ac88fe9fbfb8e430e
MD5 96f41710ac3c16ccddae9c1cdec31a95
SHA1 9b8101ff24c2287d7c384f74bd0bcf118f627078
SHA512 9486711e71a5f3f5e4d620ed6677c92d553cd6180b4985dba3bf89dd2f95ff5f9ac18aa27cc63bea87db5e26652add40f9767cd97cf9646dc5f73e6f3ca63f21
SSDEEP 1536:zjxhBzFWGkGNCGTE/xLAaw/PXiE+y2wo8FlNBQvUCJtAxpsK:3HhTEpLAJHyEc8FlNvPsK
MD5 SHA1 SHA512 SSDEEP

Submit Download

wallpaper_orig

Path /data/system/users/0/wallpaper_orig
Size 95KB
SHA256 8301158b3c967057e7c15c4b5e324d4c7795fe5aa862e94c5fd734f890193764
MD5 11da581704b43f4dc0c28e5aeb5c7764
SHA1 641361c2025f8d5c92bdc5bb4390ed7fc7ef8b40
SHA512 96a652e76fabda43fb687b3df4d435b355740c0d4884d87ef6d99703be93a75581381ee50845a7028847e54dd68463950c2f0e7279e04edbe2b67632949fbe75
SSDEEP 1536:yoUaTYcqFaJFxZLfOzyNCZva2Q4Jw48DHH5RqbC96ExBKmwz6lVJnhWquRNdxzIu:yTYqFKFjL2zy482rQHHSmxEmU6nJncqA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads