Analysis
- max time kernel
144s - max time network
131s - platform
android_x64 - resource
android-x64-20240624-en - resource tags
- submitted
19/10/2024, 15:10
General
- Target 5d3c9b7826eae10462820a5e068c734f_JaffaCakes118.apk
- Size 4.9MB
- Sample241019-skddssvalj
- SHA256 0c142a22e4ec9942e923cd4289ee8a8f33e1014015b41fd2c2f17d00538fa041
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
- Queries information about active data network 1 TTPs 3 IoCs
- Queries information about the current Wi-Fi connection 1 TTPs 3 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
- Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
- Reads information about phone network operator. 1 TTPs
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 3 IoCs
- Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 3 IoCs
- Checks CPU information 2 TTPs 1 IoCs
- Checks memory information 2 TTPs 1 IoCs
Processes
-
com.nemo.vidmate1⤵
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
-
com.nemo.vidmate:remote1⤵
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
-
com.nemo.vidmate:core1⤵
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
libdecrypter.so.tmp
bat_statistics.db
bat_statistics.db-journal
bat_statistics.db-journal
bat_statistics.db-journal
vidmate.db
vidmate.db-journal
vidmate.db-journal
vidmate.db-journal
vidmate.db-journal
VMDataList.db
VMDataList.db
VMDataList.db
VMDataList.db
VMDataList.db
VMDataList.db
domain.db
gaClientId
-1713556296.tmp
-1725509009.tmp
-2008801442.tmp
-261255729.tmp
-308023827.tmp
-43066166.tmp
-948674819.tmp
1112198336.tmp
1390306468.tmp
1513531731.tmp
1621214789.tmp
2028145440.tmp
241514297.tmp
550518375.tmp
6551928.tmp
712665220.tmp
-2088103286
1623163196
597493799
task-journal
task-journal
task-journal
bin.-1023037926
bin.-1026730799
bin.-1030142960
bin.-1157310440
bin.-1206480048
bin.-1232223098
bin.-1265412596
bin.-1297995627
bin.-1335655842
bin.-1414086022
bin.-1480569092
bin.-1481878012
bin.-1493213699
bin.-1524426801
bin.-1945138922
bin.-2048467764
bin.-2070460954
bin.-305078748
bin.-329252029
bin.-337754696
bin.-351609045
bin.-384643725
bin.-416234040
bin.-506512288
bin.-506653317
bin.-513665842
bin.-594669370
bin.-697456421
bin.-720603021
bin.-744745097
bin.-847848994
bin.-883123340
bin.-895622138
bin.-900727957
bin.1041209642
bin.1146892246
bin.1182550675
bin.1336096918
bin.1340052249
bin.1380420205
bin.1380934036
bin.1467091314
bin.1523974732
bin.1576499317
bin.1600123808
bin.1632541100
bin.1681923566
bin.169909989
bin.1767186721
bin.1812310538
bin.1830611474
bin.18378139
bin.1858799582
bin.1884864757
bin.1886738273
bin.1943484315
bin.1943521122
bin.194488986
bin.2011781211
bin.2048058510
bin.2122898808
bin.280013257
bin.284768489
bin.289312685
bin.315773902
bin.336434061
bin.336537290
bin.342655310
bin.470621641
bin.488566325
bin.570895930
bin.614306190
bin.617759855
bin.691129688
bin.694675984
bin.757307270
bin.878899286
bin.966557182
bin.967736616