Analysis
- max time kernel
121s - max time network
151s - platform
android-10_x64 - resource
android-x64-20240910-en - resource tags
arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system - submitted
19/10/2024, 22:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5ef13eb3a20e9101f7917f2a04fa8034_JaffaCakes118.apk
Resource
android-x86-arm-20240910-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
5ef13eb3a20e9101f7917f2a04fa8034_JaffaCakes118.apk
Resource
android-x64-20240910-en
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
5ef13eb3a20e9101f7917f2a04fa8034_JaffaCakes118.apk
Resource
android-x64-arm64-20240910-en
4 signatures
150 seconds
General
- Target 5ef13eb3a20e9101f7917f2a04fa8034_JaffaCakes118.apk
- Size 1.2MB
- Sample241019-17gzhasdld
- SHA256 7ee57e3489a240b13546131b683956cd7fe2e790e3ecd745df012e2b27f5be0c
- MD5 5ef13eb3a20e9101f7917f2a04fa8034
- SHA1 79a5e91ee98f83aa6b01f72ab9e612f8f93b2e56
- SHA512 e736cd78d3256f595d322b63b87bc0468d22e4a13a1538d84f53bbcf6645fee6982ba9fe6882b2946e03cd27f6a79a3d9ba59733d6ea6922ed4b78dfbd97f988
- SSDEEP 24576:JR0aNN+UXLI3sVBgb2sj11ibxoloqGSZ3GqvfKXjk5cGiihe4mTG:J5NN++LI3rx1UomqGen6IeGiZ4X
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.cedar.jigsaw - Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.cedar.jigsaw - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.cedar.jigsaw - Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.cedar.jigsaw - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.cedar.jigsaw - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.cedar.jigsaw
Processes
-
com.cedar.jigsaw1⤵
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5084
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.cedar.jigsaw/cache/libadwo40.png
- Size 6KB
- SHA256 8be42a7c0b22ff3fb9bafe46958cf33a655c1b496673f3eb79f4ffa0fce8f2da
- MD5 5b60d5ef3f038523ea6d32b8297890ce
- SHA1 a4f3e2f5492b1e5620e826516c987bc84e2ab959
- SHA512 21305ade78445d40122f05eead6cf21d58ce747cf066d09a658e4cb86cbac9adf54f936246622dd0ccfbec0b64e9ff66b8815d3349e61cb52789f38157840ba9
- SSDEEP 48:xcaf+WlH5b2Mbq77oV5TDIXHQSA0Fgkkwo/RLQdVXvm8YPeaI4iLqSWHOdFMCxe:xzTlZLAMt0wSA0FgkkFdQdAqLqVJ
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.cedar.jigsaw/files/uug/user/user.dat
- Size 62B
- SHA256 787d41d1f08a5a8c713f2dbe2ba6424bf13b4a5cdb99dd81bd185c39bab422c3
- MD5 8796b917537e74d82d421b2ea35b2636
- SHA1 ba08e71620edddc9120eb61f2a46cef330b73b44
- SHA512 0ac8fdc1b7231e0b1d2de8971242d95a4fe5f708ea4d8bdf99631ccd52b7d5d79f1095d8de2a2c4d396d9e2a01899c83888f155c7902cb1ae5ef915fc1eb2d32
- MD5 SHA1 SHA512