Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    02/11/2024, 11:10

General

  • Target

    8524b63b879cb9712a49088eed5332e2_JaffaCakes118.apk

  • Size

    2.8MB

  • MD5

    8524b63b879cb9712a49088eed5332e2

  • SHA1

    b7a1e92e7f4085d6499891a46fc87f98ce8975ef

  • SHA256

    2fa925b7ae8480046f481e31ce82c9e4b3463386a882be2dc189e77bbff025f8

  • SHA512

    f2fc46e5c11fc1f4ae080642f0225e85d95eb6eb553cf17108e66fc0154aad0d4104c2cb8dfdc4139c6022f795d49f38f9dc253deb897476b3c12421c0a83d3c

  • SSDEEP

    49152:wpsBnPFA2bKW9GbYUGDH7dhJlth7NcuRphXF6AKv5igsK3rAbcNQVi3jFf62NZl2:wpMtAZmEPGD7xl1cqhXF6AKv33rAQNQh

Malware Config

Signatures

  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries information about running processes on the device 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about active data network 1 TTPs 2 IoCs
  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
  • Checks memory information 2 TTPs 2 IoCs

Processes

  • com.ezzebd.androidassistant
    1⤵
    • Queries information about running processes on the device
    • Queries information about active data network
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks memory information
    PID:5059
  • com.ezzebd.androidassistant:beyondAppMonitor
    1⤵
    • Obtains sensitive information copied to the device clipboard
    • Queries information about running processes on the device
    • Queries information about active data network
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks memory information
    PID:5113

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • /data/data/com.ezzebd.androidassistant/cache/volley/2132231888-623260666

          Filesize

          20KB

          MD5

          e9a84a9a4292c6370d5519ceb2ee6956

          SHA1

          802e834100dd65896cd338b8adfaf0e571a53a56

          SHA256

          c136974b3a4db61930470fe214125874f7edcfd15c897be3387d05de99372715

          SHA512

          09b2047c544415173904cd3abca829548c88f60c98561feefb523c12487ac77cb3bfee7ccbd1009fca6353cdf6cabaf6405d369ce9af89a89691c4d7027cfb41

        • /data/data/com.ezzebd.androidassistant/databases/beyondAppSDK.db-journal

          Filesize

          2KB

          MD5

          aeb28ab23f7d95310d0e0efa24a06a35

          SHA1

          bba2095b7c62842cf88b33cd44d2888d7f4ee905

          SHA256

          def0e18252cb51d0529862603a579087583e90ad49007e7269714a2eaa237a1f

          SHA512

          6972523555102956dcc0740f8d6f694bee0ec57aeb507356a3cdc4ebfcf33fdf58ae85817e5abf86db80c94b1a60567bceeee74ea33e4c1f85cc286a0cefe761

        • /data/data/com.ezzebd.androidassistant/databases/beyondAppSDK.db-journal

          Filesize

          8KB

          MD5

          44deef03833438650929622648f33d65

          SHA1

          111c1b0eb1c94c46a51497e6cc413fa73254cd73

          SHA256

          7e1574a8f617afb3c01ea98864ef1b940d259b19b60329050b9f4eb890794631

          SHA512

          2d6c44cb173dc9b894f8df8512587dd5941ed55212ebac42b160223b137deb9f08f9ab5d4ffcf95ecf7885c25970a681539d1812f4dc2680a6cfd570bd2ce0c7

        • /data/data/com.ezzebd.androidassistant/databases/beyondAppSDK.db-journal

          Filesize

          8KB

          MD5

          a32743c3dd05ede744ee2af65fc42731

          SHA1

          945f6a22fb00f9618345f4703f016514f2da6feb

          SHA256

          4700415315e01879369895a0ebce3bbf3436794e758039c26e8d98cb382f2319

          SHA512

          f5da8c2b9b34639ebebe2d96918fdd9d61f6cf364ca85a1be92cb3fa0c6a4aa9e1976dc8297956bdd5e62d402cefb77064fa0497f30224f73af05cd719030973