Analysis
- max time kernel
145s - max time network
154s - platform
android_x64 - resource
android-x64-20240624-en - resource tags
androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system - submitted
19/10/2024, 01:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5a479b18294f816f06876cda565ccd5a_JaffaCakes118.apk
Resource
android-x86-arm-20240624-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
5a479b18294f816f06876cda565ccd5a_JaffaCakes118.apk
Resource
android-x64-20240624-en
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
5a479b18294f816f06876cda565ccd5a_JaffaCakes118.apk
Resource
android-x64-arm64-20240624-en
4 signatures
150 seconds
General
- Target 5a479b18294f816f06876cda565ccd5a_JaffaCakes118.apk
- Size 2.2MB
- Sample241019-cap2vasbkk
- SHA256 2ef2a8acc4cf65b008d1c77bae6d1de78332636d3fba01210d0cd7d424a17f2c
- MD5 5a479b18294f816f06876cda565ccd5a
- SHA1 2ad761ed095ae816f6e48101a6ed627c0dde33eb
- SHA512 68e22510ce84bf877345d086c857ee0dd199e1aaff4e05afae02a3ede4cdc17bebd04dc171e190ea57ae7eb09308742296d435a9261ea1da5a145100da26741a
- SSDEEP 49152:5mWe5ckBoGvosoR7uZDsCB9V4gSgxkVHXOeofaD25eUtSbcWgKTYN:5mWeSsA7KBDbSikhOxfr5eZNPM
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener cn.bluesky.colorlines - Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo cn.bluesky.colorlines - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone cn.bluesky.colorlines - Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver cn.bluesky.colorlines - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo cn.bluesky.colorlines - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo cn.bluesky.colorlines
Processes
-
cn.bluesky.colorlines1⤵
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5060
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/cn.bluesky.colorlines/cache/data/www/main_phone.js
- Size 43KB
- SHA256 0423a276ce734065ba9f3c809724fd28bab41b5afbb92af617d93e5c7116de4c
- MD5 ef907e75a0bf392d8e54e53b8fb99f5a
- SHA1 8f9f38b44e5340214433a91d4f0cd4b3c28250d9
- SHA512 9fd381210a316a0bc323af8e53ac2f1d3488a2a02a549e32eadbc9b961439665fa2fdfb81fb7525c758e41f40f4ff36a3b8ea2a608033726f3685df734135113
- SSDEEP 768:NhZw4MZ9/TejLF1fqOl3E2Mnf+ayasECwSXH/JzB3B201Zcx9XoviXVFoBj2hjg:ny4HLLMnf+Z9dw+MUZc/ov2VFyjOjg
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/cn.bluesky.colorlines/cache/data/www/main_tablet.js
- Size 45KB
- SHA256 15faee5e9e634f842927abac042212dd0335ea4d2b3b94bd611bc703dc6a6418
- MD5 884a0f2cb1740d284cca00cc5028c570
- SHA1 a26dacb88e0aca1fe034f32bdbdf714461780174
- SHA512 a558ba6c9515eeabb4811c0e3d51ae5e5567412378ff0fdfa60d233138f47fd8cefb2da05c0790449ffb086f9247788dc6a95b5de50b5bfbc33c0f4f10e98dc8
- SSDEEP 768:7hZw4MA9/TejLF1fqvl3EkMnf+ayasEbwSTGHwJzBRMQGZcxfXoIefvSVFUBj2hM:dy4ULcMnf+Z92wADGZcFoIeHSVFGjOjg
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/cn.bluesky.colorlines/cache/data/www/phonegap.js
- Size 47KB
- SHA256 a00c62e6db495a5a2a052a6a249d8bf1c018abeea8d88e596fe85453fd60b14a
- MD5 d51426023e1893886c21ef6e8db249c4
- SHA1 db2c49d4f24d08d5e92a98921602467e24f02779
- SHA512 ec81f45c41798910b6035c14e6f4d7194ceeeaa6460785347730a440804a0717284b2d424443dfc1f34e2f4f9970b6e97e569e71be4beb27a80db5247c4667b1
- SSDEEP 768:PS1TI3HKcHim1vDprLNgtUPcnQ7s7GrGDG5sKWVFBsa3s7rodoRz+GqXek:PS183RCm1vDtPcqs7GrGDGUVzAKm+Gpk
- MD5 SHA1 SHA512 SSDEEP