5ce4e30a719ad428e677faa3a94c0ca63ae20a5bf772591f68f1c06f74c5cc6f

Analysis

max time kernel
8s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240624-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
submitted
18/10/2024, 14:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
57d9786caf8ae81a6cd292fe2400e8df_JaffaCakes118.apk
Size 1.6MB
Sample241018-rd2blstaqq
SHA256 5ce4e30a719ad428e677faa3a94c0ca63ae20a5bf772591f68f1c06f74c5cc6f
MD5 57d9786caf8ae81a6cd292fe2400e8df
SHA1 507b46a7d1e23b685907352439b42e2d52a7c7fb
SHA512 ff5edd21308f41957d394f3845bbf4247420ed9fafc9bd1967bd613f8c94e8c70c97cc181e83bae6de03ee1df5bfe4ba6d6e5ef7cb2bfc22583c7efcfd90a023
SSDEEP 24576:+H1UW/NPVU/71J77wxjZ7P/KPCzi6LULmRKQr7NXcgeJwHRLgVhFQjKZ:+VUW1PQ1Jghl/K/a97NXgsxgVhmjKZ
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection credential_access discovery evasion impact ransomware

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	ginlemon.flowerpro

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	ginlemon.flowerpro

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	ginlemon.flowerpro

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	ginlemon.flowerpro

Changes the wallpaper (common with ransomware activity) 1 IoCs

ransomware

description	ioc	Process
Framework service call	android.app.IWallpaperManager.setWallpaper	ginlemon.flowerpro

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	ginlemon.flowerpro

ginlemon.flowerpro
1⤵
- Obtains sensitive information copied to the device clipboard
- Requests cell location
- Acquires the wake lock
- Queries information about active data network
- Changes the wallpaper (common with ransomware activity)
- Checks memory information
PID:4658

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Location Tracking

T1430

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

wallpaper_orig

Path /data/system/users/0/wallpaper_orig
Size 95KB
SHA256 8301158b3c967057e7c15c4b5e324d4c7795fe5aa862e94c5fd734f890193764
MD5 11da581704b43f4dc0c28e5aeb5c7764
SHA1 641361c2025f8d5c92bdc5bb4390ed7fc7ef8b40
SHA512 96a652e76fabda43fb687b3df4d435b355740c0d4884d87ef6d99703be93a75581381ee50845a7028847e54dd68463950c2f0e7279e04edbe2b67632949fbe75
SSDEEP 1536:yoUaTYcqFaJFxZLfOzyNCZva2Q4Jw48DHH5RqbC96ExBKmwz6lVJnhWquRNdxzIu:yTYqFKFjL2zy482rQHHSmxEmU6nJncqA
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppList

Path /data/user/0/ginlemon.flowerpro/databases/AppList
Size 20KB
SHA256 f6dd3d97de17f29fb10c5a3d05d7d97b0b2650f92baf7dbed5b1c87941b8a10f
MD5 f0b99075dfd3f66c28bfc3452cfd3c3e
SHA1 4e03a83e031c9df69eccbfb002a6564cf28059e6
SHA512 e39b8279a2e74fb5df3cab4b71abeb7e6b9977641366bf88a4879498f5e6c075824a5ddd0ec09e5996ad44082d74f8ae64e6748a367f0a49befc46e604d067be
SSDEEP 96:+8UjZ4owFpb4c6dw8yQVSdj5C+mlytktuVDpRM5wFBsl8/y50bEDyZ:zU1wtIl85
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppList-journal

Path /data/user/0/ginlemon.flowerpro/databases/AppList-journal
Size 12KB
SHA256 d42b26d51ec3ca9499224a7fa7da23cfdc61f61c3a228959c46cdff2c6e44551
MD5 efde9d8a5514eee1c616ab93808e35a8
SHA1 aa5dc4e1808898b595ad28d54fb52bfacf883c3a
SHA512 00e8f4977bae6867e802a3a9bfb2328b48869a2a7f6aba4691bd7c93c7e6ebdf5e6690455efbb8f40ed3bed8fc638706bad6f40c454627d78d08aafdb08206b3
SSDEEP 12:7+tttpOAqLlQhexF32SXBvVK1xAR5gfB5qRmBEyPbK:7+txHqLlQcV227rgp5JGSK
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppList-journal

Path /data/user/0/ginlemon.flowerpro/databases/AppList-journal
Size 12KB
SHA256 7dc69be126f58bfe6aa61cd194f22e74323338c2eabd76d686a7bdf9276c78ed
MD5 1dad43b3320abe3210bbf45df8c2594c
SHA1 0a0d3ea384e3aa45912e76d2cd3c0007a7696f97
SHA512 c1bce9e6248857b55e62db62fc861776a329a3ac305a135ca3135eb0f3ff2be8716e898206f03c8ac6e02dca0aae9420ccba8f00d89bfb255547a553bc4fccd1
SSDEEP 12:7+t9SSkVJpKoL9GHwVbpqLyxJhexF32SXBvVK1xAR5gfB5qRmBEyPba:7+tvKz9x91qLyxJcV227rgp5JGSa
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppList-journal

Path /data/user/0/ginlemon.flowerpro/databases/AppList-journal
Size 12KB
SHA256 2562be96eadf459ecb48f7aeed69114d3ab4020e9c504e93867105d67c8feab4
MD5 1888bd9cf2a60092056f66edcd207f45
SHA1 c4e2dcd013f7bbb5db5265494113b58052daee34
SHA512 23c53fc3be6c44bed6a61f8c3cbcba2e3d829900738c89914287a15d2d9577a457e9998286bc22e7e5a708519a7b6c03dc181c505a55e581225c3dd3a818d7f5
SSDEEP 96:7jEVDpRM5wFBsl8/y50bEDy7HwFpb4c6dw8yQVSdj5C+mlyACHUjF:7R8bmtSEUp
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppList-journal

Path /data/user/0/ginlemon.flowerpro/databases/AppList-journal
Size 512B
SHA256 df04aa04a353158e72d6ed2d781ae1f465253236bce8131cbb8d54b97db1ccb2
MD5 a10fccb9029836f92cd5752763a70d32
SHA1 72dce9878fc24d4ba03ff76e029fe3660f106b21
SHA512 e4cca3aea9632eb5a6983b70ebaeadbf73a7ee4bdb044dd88dc44c591b253b2245e0b11775faac8503370bd99a182801395887813877cd60153bb7ab4467a855
MD5 SHA1 SHA512

Submit Download

AppList-journal

Path /data/user/0/ginlemon.flowerpro/databases/AppList-journal
Size 8KB
SHA256 8f48c213dd0307c6f4261a3f2e727a08ae8efae6da2c1b33dd1b922f10518a0f
MD5 298c3652a147b9b70246e5e9493a4bc1
SHA1 9cd755a4214b4816bc217fc83601b75537457e2a
SHA512 575f34e5e2f8a2da2b81f5d13b2d0ceac04b011845bd24bc803828d71484bd780deee86d3bc9aca2f69a15ae1c7807f9f475094ef39e3735b2becbc17b814fb3
SSDEEP 6:7+/l9jdn172vg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKv:7+tNevqLiuWdYRmBEyPbc
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppList-journal

Path /data/user/0/ginlemon.flowerpro/databases/AppList-journal
Size 8KB
SHA256 c9ed3afed3081e83113b2c3ce637bff91ed675720f7c4d50ffa665a60e9a2682
MD5 196a42be9de7b8782c1bb3e83767035f
SHA1 f5aeae3db108e12598f8a13410a13a302c735d35
SHA512 c9a766aa37f827f62afb68ea1b6055975484a95e6ea18e94dec2e73f599673366e2aa0061b8a3d5d10d8dce33a8ff1e45ffd7ea93cbdb57f7e681b68fd5820d7
SSDEEP 6:7+/l93uIPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKsbW/C/6n:7+tVuAqLJdeWRmBEyPb0/S6n
MD5 SHA1 SHA512 SSDEEP

Submit Download

FlowerBubble

Path /data/user/0/ginlemon.flowerpro/databases/FlowerBubble
Size 20KB
SHA256 12879018ca5bed1b7a353b75b2db7538a8da7e99563b4c54e2b4655267d2504e
MD5 ded18053b43bf8295217b2e69a548d39
SHA1 54723b0c460c956e6b2257e4745fbb776fb6680c
SHA512 e2fbac7d90741822ab33ee37c8e9579d873b61b6531580ff9a6817c1523e10ef4b6a6d004697f7697ee3887d69f28eccd6dec23735ee255f818aee2ed7d34a56
SSDEEP 12:TLgE1yNTSFby0D++4EvMuQjRFI74AoRmBEyPbAVOwG:TLgEIh/hYGSEG
MD5 SHA1 SHA512 SSDEEP

Submit Download

FlowerBubble-journal

Path /data/user/0/ginlemon.flowerpro/databases/FlowerBubble-journal
Size 512B
SHA256 6f2e8f96433c6c0dfbad7ddfe0fcf22c1b8f085b8d7d60e9bc4208f040270650
MD5 03e6f5376b1c341a28a3d2ce72861232
SHA1 d0b357bc23cd9b3c67599413037fb231e2e26183
SHA512 2bef133825ea60dfe29f205cd2e6c8c69af8535c0ca8d296b4aa45dd066a2398fa0c2da4b0e02a45d743ebcd0e0fe7de9ec75cf53e00a4905210ecbe41ae77d4
MD5 SHA1 SHA512

Submit Download

FlowerBubble-journal

Path /data/user/0/ginlemon.flowerpro/databases/FlowerBubble-journal
Size 8KB
SHA256 1680e303de94104a95b44aa62d91534b213f054ff7aaf7f2cb0c1384571c696e
MD5 1b60ed7dc05d1a1e8eb5ea47fe8d7ff6
SHA1 adc5d9b3aa6b26d445f210ed0aa45096cf1d1ba9
SHA512 24400ae4a91578a2cf9db26a23a7feefb70dc60eacf3e6963eb1e17822eedd105d23e4ca0761b9277832cf4d76961356dc8472a103ebe0d3cf30d6f645d02c7c
SSDEEP 6:7+/l9jiEn1Og9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK4C:7+tBinqLiuWdYRmBEyPbA
MD5 SHA1 SHA512 SSDEEP

Submit Download

FlowerBubble-journal

Path /data/user/0/ginlemon.flowerpro/databases/FlowerBubble-journal
Size 8KB
SHA256 7139d5b54da66c55656e336fd0acb3e72102c9f6bd67998cc3f665ccf38d7c69
MD5 2f2464b42bd0e0dc59771c7ad6419a9b
SHA1 b4ecf53862eab8beaf8238a24e8d46b9bb9d006b
SHA512 a97d23f1218924e2b2a9711fe72712678f70a4bae97e90782c3714f079c3976df781900dab239c10e4d90c41515d7536d4cf3c37b2f8a35801806703fb6ff5d1
SSDEEP 6:7+/l9OTzPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKsK//EI:7+tEPqLJdeWRmBEyPbrqEI
MD5 SHA1 SHA512 SSDEEP

Submit Download

BubbleBitmap

Path /data/user/0/ginlemon.flowerpro/files/BubbleBitmap
Size 4KB
SHA256 64517d852e50818c1b205b930858c75cdd897909f8d6066639374d370f417ec3
MD5 e66bf53b17cf2de65e69979161a5b135
SHA1 6a2526ac5a50f116f8128e9e514d6a4a2325cfc7
SHA512 ca3be83d41253b14af29b623c4063bea2091f4ced394600f62837595542518e272e845793f2e26162fe124587d0060e03993a1cde9dbdf1a0472357b508bef20
SSDEEP 96:A4Y9RFAwW7hiG21cf8rAoFb2F85z8ftFz4b/rNCxF1Bw24:A4Y98wWdXZf8rhcFIcHz4bRCL1Bg
MD5 SHA1 SHA512 SSDEEP

Submit Download

ClockFontData

Path /data/user/0/ginlemon.flowerpro/files/ClockFontData
Size 101KB
SHA256 57e547714635f2248e78a96345c6ac75cd4aaf17a0a4260eeb1de3c5b3018a01
MD5 032593b9c5501617c8bce79dd118d94f
SHA1 bccd9ec1ebba2d39aef7cd6e37010fd2a11b392b
SHA512 f5e37a034b6703b07a0cd06a8a7bcca3ace0dd9a7a7b8e133ff212a7e73c06fdcf78c8be9543f528de453f5fa7dd08c1b3e712c1ebed7b176472a6fdd7e2d05a
SSDEEP 3072:oeWplzYCIy6NcEfGqJUw2tonPCKDg2kp8kVwS8Brz4ZP:oIU8A8B3I
MD5 SHA1 SHA512 SSDEEP

Submit Download

ClockFontHours

Path /data/user/0/ginlemon.flowerpro/files/ClockFontHours
Size 5KB
SHA256 a500b26e392d73042c01ef24db224e178a7fed47658f7ce0831f15a7a808f80f
MD5 df266b56b2fcb3a9ce4db5f722630652
SHA1 70560fbc68c1edcec0ac240566e4ae55bcd752f3
SHA512 f8302c6dc4c36550d64344a5680a772559ef02a5c1d5d7028fefab698bb161540fa70794b1653c2ded7d4a79daaa2171acde2a5b09beb1014e0541c6f10adcad
SSDEEP 96:E4wbXWDqUIy5nlQVZWgTtT00suScnf99pBIAHH44tO1WXzcDG509Hti6G:DwbmeynuVJp00FSC99fIA3EWXoq509Hr
MD5 SHA1 SHA512 SSDEEP

Submit Download

ClockFontMinutes

Path /data/user/0/ginlemon.flowerpro/files/ClockFontMinutes
Size 107KB
SHA256 5da31246695f492fa8793d8333fb7eb86706856362cc801ac88fe9fbfb8e430e
MD5 96f41710ac3c16ccddae9c1cdec31a95
SHA1 9b8101ff24c2287d7c384f74bd0bcf118f627078
SHA512 9486711e71a5f3f5e4d620ed6677c92d553cd6180b4985dba3bf89dd2f95ff5f9ac18aa27cc63bea87db5e26652add40f9767cd97cf9646dc5f73e6f3ca63f21
SSDEEP 1536:zjxhBzFWGkGNCGTE/xLAaw/PXiE+y2wo8FlNBQvUCJtAxpsK:3HhTEpLAJHyEc8FlNvPsK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads