Analysis

  • max time kernel
    143s
  • max time network
    131s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    23-10-2024 16:16

General

  • Target

    6fd04ee775cbf375b44f1f07c9c4f06e_JaffaCakes118.apk

  • Size

    4.9MB

  • MD5

    6fd04ee775cbf375b44f1f07c9c4f06e

  • SHA1

    843559e486187792c183d1e400f4bf340584efdd

  • SHA256

    5de805bafadf9c1965b488a9720728febd87cb03ba0cd1eb4e4e44dd37daaa89

  • SHA512

    23c22707699b78e07807c1167bf0f1c4bb12e346109794115ac9adacf11fd5dd3aba79c590dfaed614700c2e91bf09d17076f001a78da16745fdc45d5777b866

  • SSDEEP

    98304:yJtAQEY6PHv5lvnGsJbOkNZNkt2TLhENUOHudezPbXafuN2uV:28DuwhfNktuLhENtOomWci

Malware Config

Signatures

  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries information about active data network 1 TTPs 3 IoCs
  • Queries information about the current Wi-Fi connection 1 TTPs 3 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 3 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 3 IoCs
  • Checks CPU information 2 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.nemo.vidmate
    1⤵
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks CPU information
    • Checks memory information
    PID:4255
  • com.nemo.vidmate:remote
    1⤵
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4298
  • com.nemo.vidmate:core
    1⤵
    • Obtains sensitive information copied to the device clipboard
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4325

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.nemo.vidmate/applibs/libdecrypter.so

    Filesize

    25KB

    MD5

    c1a97e8bb34d219d329a7269a0daefcb

    SHA1

    eca07f7cbfca9caf2fbdc670a9afc56955805f7e

    SHA256

    47846073ae64c1187ce26a74157ddcdb7a7aa84775fe651a0242bf0428d794a4

    SHA512

    03a04fa469a35672de2efe4941706238a0a1538615bcf26b18ab00a347e71291e77dd7e5c104585a0b0a748811c1d67b4455fdc3d6ff87fcfe4bbe157593e5e0

  • /data/data/com.nemo.vidmate/applibs/libdecrypter.so.tmp

    Filesize

    37KB

    MD5

    8b77bd605fed731a527dc8312e4cf2d1

    SHA1

    c2b1c9f4075eed7ff0bd8e56e257be831627ab16

    SHA256

    83eeb8b4649d66ec2f8c237d25409b1af88ff0ee64fab3d38c770424d7f9f4e3

    SHA512

    692d069b7f82b69a85d7724d197e2044d259203ce1f1b2af287f5d1506af306594ec2c70c3ff2f85bd80e12dd0fb9282ce934915ef3f327fc427f87a035c7cf2

  • /data/data/com.nemo.vidmate/databases/bat_statistics.db-journal

    Filesize

    512B

    MD5

    bf22b26a6432a38ebf2458d3f2c1cd0f

    SHA1

    99e8d075cc1e93a57ce42646929adaaee9a2566a

    SHA256

    ac453825ea9cc29b7a8dc94cf827198baee2b4932b54501709ce6078bf3f8c5d

    SHA512

    07a24f89af9c71f6fbb908feeaac2782530a0578fc910adc36464eb872fcb489b8a16d1e5bb0b95c21f1b151334e7b115706d39a3b519a88c89cbb85c2bf5ca0

  • /data/data/com.nemo.vidmate/databases/bat_statistics.db-shm

    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/com.nemo.vidmate/databases/bat_statistics.db-wal

    Filesize

    40KB

    MD5

    3310b9ffebbe1c7829a7bfe468d24c24

    SHA1

    44021998945be6c6422dcf7b0516e0a8e5f3b688

    SHA256

    201fb5a80e16633b87e227adbf8b8b381fc425b1cb132390c5d24a4e9b5ad083

    SHA512

    2377d5cfa372445930a1019b3a89c2b842266e0c16b68ee286c9ea30f2c3db34989de693f3f69c43fe610e5def6301debcbdc8e20e9419bd592d5ed5adcc4275

  • /data/data/com.nemo.vidmate/databases/vidmate.db

    Filesize

    32KB

    MD5

    949eee2645983f2bc18bcdd3480e762a

    SHA1

    2f3dafbd382ee8fb3a30b3deb23a48dcd06e0167

    SHA256

    2dad4262a24bebb82f540becf9227e5a294dfc9751644cc08372e820e9a1c4d6

    SHA512

    880b66de05762db684d4c3b65562f5e67d80f766c10d7f18855bab12a67f5a37d56a55e17227a2a16b5472822aca099248279390f6f5eb38de077defef079ec5

  • /data/data/com.nemo.vidmate/databases/vidmate.db

    Filesize

    32KB

    MD5

    61054c0f213b905a785d337f9660831e

    SHA1

    a15e5f904baf300061d274e5b831ae9669f381ce

    SHA256

    dd38872168a16cdd4e023e9362618a369ae418d9e6c675ecddd94049d3ee72e8

    SHA512

    a4c54ade2c7acab905a3050859f213c73143b6e63e2849a5a5a99d9606b8792e266f0bfecacb4b52e9541765ec9c69ef524b91c685edf89eb9310d21195ddc1c

  • /data/data/com.nemo.vidmate/databases/vidmate.db-journal

    Filesize

    512B

    MD5

    75896dd0ec5f4d7ef5c21a97c6314648

    SHA1

    96cf5a3d10f30a0ca7fe5ccb89f3c4f1e3bf67ef

    SHA256

    17b57cc1bad534b22ec1d47b2f519de35b947f32052890ca841b49ba9f6b1f38

    SHA512

    f231a07c7572f5f6c6090d40cde483b99f823d5d1b676052878f1018c3fe47165aa235cf292b94a47b8f8e6c7797ff93699e4dd9fbbb6c66b6990e19f5de289e

  • /data/data/com.nemo.vidmate/databases/vidmate.db-shm

    Filesize

    32KB

    MD5

    6845bf3b700155caa2c4f9390e369d4f

    SHA1

    4eaab018efd9c601c3da4b83842eb961be93e87c

    SHA256

    0f8378feb64385335db6e8383f4201ede3833f4f7ded714eb3ca609b54303277

    SHA512

    81bc591191b22756a360dc09600be5ce33c5f2ebfb7ad48bb281954070d8a609d81354d79054a38347ee485bc572a36d0fd1e5c1c20a51e6b75c84635ac11320

  • /data/data/com.nemo.vidmate/databases/vidmate.db-wal

    Filesize

    32KB

    MD5

    5738b1e92cfb48174b108cdbc85e7e28

    SHA1

    1eb3f4e1ca13bc3a8228d20d2ed9d7b64858adf9

    SHA256

    c6dfbc69296f6a0edeea278c6ce3286521e3fcecb13853820bc7ad49cebf41e5

    SHA512

    11992ba73d2e1c9623dd939cfe2f7bbeb06cfcef494975b85f56ebc83fd8218eedc845c6d3c1567c886ff7a03866fe10434deedfe57e59857fdc7ae8a876ecbe

  • /data/data/com.nemo.vidmate/databases/vidmate.db-wal

    Filesize

    28KB

    MD5

    664a9ee2a790b5ffe67e2515a9c7c0c1

    SHA1

    f39eefe35eb78cc56900508ff28b50c047d5f00d

    SHA256

    0a67ec76087f143c7181a59babd0ac5ccfaf60209f46660d680a3feaaec09822

    SHA512

    217c6a468e4082bd37e13fa5546d9a09ac0d466f194756bba3242e9d2b704e29da262710f47a70c14d21669c81a36a282958fa48239f36bb464f4fd033e5222b

  • /data/data/com.nemo.vidmate/files/domain.db

    Filesize

    2KB

    MD5

    2bb4ee1a3f8fe0442fcd5188967f5a9a

    SHA1

    ccae6aae3575063c357776d857d0b10eb03fed6f

    SHA256

    05dfdad8b2c94182d8f9ad2229980b55b88d7d15596345bcf3519c9a96f59f8c

    SHA512

    d842095d3c5f4d585b696550a84d410a939ea5349489fc33051869d6bd341ab86305a308935d157db9d7c5437202d495f1eb8651fe327d38382397a83b2292f2

  • /data/data/com.nemo.vidmate/files/gaClientId

    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

  • /storage/emulated/0/Android/data/com.nemo.vidmate/cache/-1725509009.tmp

    Filesize

    1KB

    MD5

    669473f4d87d9c9dc97e0cb184eac5e7

    SHA1

    600ed2fbee399540267016c44eef34b0388ce250

    SHA256

    5c3278b018dd9353f59f2872afacdebfcca1556b29cce4777e9f7821e25b804e

    SHA512

    30f97eacfc2d6ced4fda61fde725de54c7746e33f64dd48cb8821efa9c72a119a0323e02352a9648ea1a5c6fda5e3b82ce62aeb24e3f5d4a2fce2b746fb7ba25

  • /storage/emulated/0/Android/data/com.nemo.vidmate/cache/-2008801442.tmp

    Filesize

    857B

    MD5

    496fee12776798503c9da05a69657457

    SHA1

    7bb56ff581c55e25d16b218bc6ca29efd0e207bf

    SHA256

    b2a013232be45a05cf4bf8dc59b58e18e69f3e44935dd95c7041884c271bf208

    SHA512

    f8dfa4f677682db7f510b66eea83eb8f7a752a06819e2420f24284afc2f0844033d5b515c37dafded08b8b5f59a62c6c565d745fc660439f069776fab62c31af

  • /storage/emulated/0/Android/data/com.nemo.vidmate/cache/-308023827.tmp

    Filesize

    685B

    MD5

    da73f9836f9e7543f4bc3de392ee13f5

    SHA1

    46ddf69082b354aefa12b8e37d59c4b2990bc45a

    SHA256

    baecb2f616f896ddd946e794422d2f5f0cbfb2c39dafa42e909baa8c1a94090a

    SHA512

    9829732e69a14b0b86ca927da2974711933c35cc353fdbaccf215fb7f3cdd54eb63dde50423928b6cb18b80a60b21c8816c9dc8818dda9f9b8fcfe1646bcb018

  • /storage/emulated/0/Android/data/com.nemo.vidmate/cache/-43066166.tmp

    Filesize

    387B

    MD5

    4e8e0e80aad5e09ecaa9e87dd71692db

    SHA1

    20b34f6c7b8bad3a7eb967714f476cd2a3a2f225

    SHA256

    1aa305a95651408c3d7dae9aa40e0b2d1e506785102886c00c876d7fadff7dc2

    SHA512

    02cd008b39bb1fe6a8b11c27fd44a98fd6461cbe5ed72099735a882e32654d0f11901dfbfea68f8eae1b7c7d7d16783aa09f1dfbf29296e2193aa66b6e2319ef

  • /storage/emulated/0/Android/data/com.nemo.vidmate/cache/-623984890.tmp

    Filesize

    14KB

    MD5

    855c468315d90d62defac2ea312d1ccd

    SHA1

    4dda6353130b6efc9d3b1662353049ab7abfc518

    SHA256

    5ff81dd7bb2f9269f689ba0c3ade89bdc121780260ea0f44a985206736470b48

    SHA512

    14841ad463dfe0c70a36e6afcec714e796378eb8a6adb53e34f27b74f2478911018aaf8ec2f1cfbdae3efce63bbd9ea59b5ab48a668b37f0cff7a490b56a093c

  • /storage/emulated/0/Android/data/com.nemo.vidmate/cache/-948674819.tmp

    Filesize

    1KB

    MD5

    57f3005ea5231f2212a777ec42d9b0ce

    SHA1

    efe5070229a74e6763d6cf2bbf23e569418fcede

    SHA256

    94d1fef87899678ad7bc2fcfd7a3109b5988ee43d37ddc704bb468d8a960eef3

    SHA512

    296b15072ef7eec80f4c8f7677f17ad7a587982afd7a53d617733e95ebda12c1558a94e5d4ddd6290894e2a77b2ab5475b15e7e51c91aa723f221f4ae3ad8075

  • /storage/emulated/0/Android/data/com.nemo.vidmate/cache/-957699607.tmp

    Filesize

    16KB

    MD5

    1b1f2c9f2248713390ec44101e33393a

    SHA1

    d4e5ff8a28d9909d33dc91d0c61b8104f9796b6f

    SHA256

    99d78dec6b2723a68f038cf93064292442ce91372da8191d0f462092c73ce0e9

    SHA512

    9598084f1545c7876243e546d95592785a4b706559a31833dcb5bc3a6774734383bf8b90d26fe3b93ed5b0522df849fec3e992c7e89f06c70a3ce49355690545

  • /storage/emulated/0/Android/data/com.nemo.vidmate/cache/1112198336.tmp

    Filesize

    651B

    MD5

    7fefa94b622707b6dcc07ef967df9f8e

    SHA1

    3c35e5dd3ad1742ae5ae77bb01a24d634f0fd888

    SHA256

    cb15a2e414ded57f58ec830f6e71e0b4094346e1c896d1c7b0dac13ecac997f0

    SHA512

    7eb1dda8dc44fc5a007a3ecf5119b1e4a7b9cd90cb9f4cfd7eafbfbdab843974b8ec9a29228b0ed39ef44d12114de63f4e320242e4b7e096494976b995f2eb9e

  • /storage/emulated/0/Android/data/com.nemo.vidmate/cache/1390306468.tmp

    Filesize

    772B

    MD5

    5571d04feb7caaf58241e951f26bf573

    SHA1

    79709a2bc0876f8854274bf1cb255702e51b0f27

    SHA256

    014a4ba56d5012d3e320b46e933d2921b9baa6d3c109ee79d037152d1f7f2ed4

    SHA512

    389d4f5738bac79b59d5d6c139508ac72d5430598049b971e6aa078a43d52ff1f546f3f3619c25a45a69385a9cbbb4fa31ef864b7e94e2051d5dfc9f2a67a034

  • /storage/emulated/0/Android/data/com.nemo.vidmate/cache/1513531731.tmp

    Filesize

    2KB

    MD5

    1ca76657e5ddf5f448657be8e00da355

    SHA1

    b3124d4f0028da6bacbba704d4357b85133b4ce5

    SHA256

    6c552fb3ee515562c78e187a6fa60b17cf4c024982b80aecbc0020b608310e2a

    SHA512

    909255b3fa8b827469ccae9489c7ed4beed1c412bf30b84941a8f4ebd3fa8417727e0b52ef8ea5d3b7565f39b050d4f864785864a055cab9ac28701480e02967

  • /storage/emulated/0/Android/data/com.nemo.vidmate/cache/1621214789.tmp

    Filesize

    828B

    MD5

    bbab24a2b66fdf91ddf2bfd10a3da620

    SHA1

    d06f39d22a1e1354f7c5f8fc4553e848b47509d9

    SHA256

    50b4b37f05a67c94d1af9bb9487b8260928439288362ee1e4161d646bc464a79

    SHA512

    7e2d34643407d0323cec27114a651fb0709d8d965007998861fd71e59cc8b361bf11e99bc5e5983f9bf9758a162c0dac83aa22c1a17a2ba0dc1d64695f725d40

  • /storage/emulated/0/Android/data/com.nemo.vidmate/cache/2028145440.tmp

    Filesize

    552B

    MD5

    ce1a811002e8365fcfbf00f71d636e4d

    SHA1

    7e84d0ef17ee4c91bc47de89465ba62dbaae27ce

    SHA256

    427fdb94c5f8710a554eedc4c656cd0a65ccb0ee59e8736b7402a8ea9c1a3f0a

    SHA512

    51604782cb4f9c9af7a8a148e5730ff6371b25ce2e503ec10987d74ffcb8b1e468c0a877054294755aa39fd151c62d75568eb8dda72699ab4cb9438dbbc402c4

  • /storage/emulated/0/Android/data/com.nemo.vidmate/cache/2065442279.tmp

    Filesize

    22KB

    MD5

    6eec07313ea17f76de72618491a22134

    SHA1

    80bebce1b8741eae8cc3e6e04bfa47a8323684c6

    SHA256

    3829657ac434e5b25bc339380a229fc09837d486f99bc6719fb2b53cab91799e

    SHA512

    cd1d1121e02f8f115ae72545e691264ebadcb4e8f0ead0e8079a3ade4e0946cfe227edafe343da06eaed77a1f69cfc424e448e6f5907403c1114e7e6aeab167c

  • /storage/emulated/0/Android/data/com.nemo.vidmate/cache/241514297.tmp

    Filesize

    1KB

    MD5

    cb530f2acd9e6218d014061aeabbdffe

    SHA1

    25cb73cd0e5f2accf7b2ae426759645d066ba197

    SHA256

    cbe9c6323564d90762d5cdb572b106b8963aa5274c474fb56d414990ccee4449

    SHA512

    e0a43e6a8c132a72c450674b12cc2325caf4329408b38b0fd25b0afa35b019470b69bb957b6cdcc8e6d4ecfedc97de9d6e1b2fef6a3d472779afe827396cf20f

  • /storage/emulated/0/Android/data/com.nemo.vidmate/cache/550518375.tmp

    Filesize

    786B

    MD5

    6d0fb3928647f0576ccf9d3cbb170d40

    SHA1

    44b411528bfe94a6eaa688c3d23e4cef86f16e3f

    SHA256

    13a31fba45c8e79795a87b14bd9d705de00fde1819b4cf08c68f5e59f92d9a0a

    SHA512

    9613e151a79e530e024e238aaa89d034426a9ff25c07776c19b20baf6480f019936b90d78003290c7036917f191833c151c59bd70b1010db9d6e86fd5c89ffaf

  • /storage/emulated/0/Android/data/com.nemo.vidmate/cache/6551928.tmp

    Filesize

    978B

    MD5

    ec53a2544ab7d4cf268abb2b2c314f2c

    SHA1

    febc7de66c402ba4d8cd9ee0ae2070d286e66bf1

    SHA256

    d234a226a7afd757953ac468e3be4e7b6f9742ee21feb2d6816f0d3573906746

    SHA512

    9de61992f982c2713d9c37c46b028621b5a1f1de2831cdc1979a9a921c4353f165498796a129e30adaf813ae7afd80504cdbd8c4b739679d31be594a90feae74

  • /storage/emulated/0/VidMate/cache/1373056533

    Filesize

    7KB

    MD5

    6f7a114430ffa782d48b9876c5a72b90

    SHA1

    e10c61804e7ad4703452a4c4f7aff2225dae0a06

    SHA256

    7c448fd18ca446d33d178640a733c270e356aeb67a13367992c1dbc28a6e7f83

    SHA512

    7296f531a1af56bd8cda99ff5f102e67a2ad7f3b322fd62e15a11f8e2bf01b5fd0fc92969799dbd30c881acf44e9cb22dcb328fc2afae0457bd5f75eaafad16b

  • /storage/emulated/0/VidMate/cache/597493799

    Filesize

    80B

    MD5

    b19bd4c462fdde6bd61571d960eb6415

    SHA1

    099b1768009c65dea0afb75bd96366b0029aa497

    SHA256

    1df53d49d9b15bc744abed9db8b212e42f180c044fa5156136a007f26be50eaf

    SHA512

    294739fd2537d9b507253814f2be585d087cf1466853eedd99878c9eca35d472660803ddea3aec2a13f2611dfc804dd889354b8d027f45cf429c4906c367a277

  • /storage/emulated/0/VidMate/config/task-journal

    Filesize

    512B

    MD5

    2c06963962cd698bb354e79f2d9141de

    SHA1

    443142b1069d47d67396f0b4284528a07e6b9520

    SHA256

    11496017bf8d2800f84f18dff0d1661eb003c55b58f595b534cffd4a703c6f8f

    SHA512

    8ae49823c035d854d61d70559bee6ffeed3f8f56063976bd5054f73c819223095c2abaee21e6ddeb1151a6339f6edf9ee3f4bb30bc253d363418efb9fd8d2d28

  • /storage/emulated/0/VidMate/config/task-wal

    Filesize

    48KB

    MD5

    5a7bbd7976f574b9a3feb2c283c612fd

    SHA1

    d34ce3be2d73725ed09791bc6ca55f5fc39d0e12

    SHA256

    0ff49323ac7fa7eb9cd73d1243e7b7f1340d8c6552c3c81a881c5a53b8249b84

    SHA512

    e9680d1ffe7490cde17797bfc9b3b25bf74d4b17a5d7bca8572c15b222307f7ff715eec05077da10d18c9028b9643af0764b94135a076eb2edf066b47b65d3e6