Analysis

  • max time kernel
    149s
  • max time network
    132s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240624-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system
  • submitted
    04/11/2024, 00:46

General

  • Target

    8e5237a5fb68f92e9b6e0d37c172e4e2_JaffaCakes118.apk

  • Size

    2.8MB

  • MD5

    8e5237a5fb68f92e9b6e0d37c172e4e2

  • SHA1

    bb7eeadac560a80ad0dfdfca61649b01861f323a

  • SHA256

    59abde0b18235002444e4cfddbabcc2fb948f9a2618edec896f8de4f58647cde

  • SHA512

    1998b77026a50cc9737822d91f5716e2af8952b7b785ea213b4cdd5828dac5016410214ed8107ccaacdae17c828c996a15ac62f9398091acbdacda824dda89f7

  • SSDEEP

    49152:YpsBnPFA2bKW9GbYUGDH7dhJlth7NcuRphXF6AKv5igsK3rAbcNQVi3jFf62NZly:YpMtAZmEPGD7xl1cqhXF6AKv33rAQNQR

Malware Config

Signatures

  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries information about running processes on the device 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about active data network 1 TTPs 2 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Checks memory information 2 TTPs 2 IoCs

Processes

  • com.ezzebd.androidassistant
    1⤵
    • Queries information about running processes on the device
    • Queries information about active data network
    • Checks memory information
    PID:4443
  • com.ezzebd.androidassistant:beyondAppMonitor
    1⤵
    • Obtains sensitive information copied to the device clipboard
    • Queries information about running processes on the device
    • Queries information about active data network
    • Checks memory information
    PID:4500

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/com.ezzebd.androidassistant/cache/volley/-839601416681133063

    Filesize

    20KB

    MD5

    894e53f613d3bbf376b5e5a580dace0f

    SHA1

    5beb341d7501ae9151d4455f32b48b67b47a82db

    SHA256

    3fe1a6f6e57b864c66fc687fad13d9c8255999a13fefa2c1c7102d0d2d5c962d

    SHA512

    74e251a74fc8002bc4afe4319d555477d8b2e8114d097208ea1b9448568ce8060d48ea7282ed9aa21c71140ec8fe4286d97db2e488c7cc59e9671a8058b188e1

  • /data/user/0/com.ezzebd.androidassistant/databases/beyondAppSDK.db-journal

    Filesize

    2KB

    MD5

    e4539bb5af3725eec79d7635ee670723

    SHA1

    8e6ef994ef9f5dd7b1a036560b4d4061e772bb7a

    SHA256

    0ada25a78015b89b078ec5747e6bc7a167f4fa65de4d29f09a0a53a46040a0dc

    SHA512

    45324eb5bb087d6c95dd0bc75a159cc2d6e9f444d03527fc34222b92ff2ef481195fde7abd8c3e83d2edfa55b27be1bcbf9ba4a32936b223fa1b0f4c418d7984

  • /data/user/0/com.ezzebd.androidassistant/databases/beyondAppSDK.db-journal

    Filesize

    8KB

    MD5

    20a3e82fe4e9614c032ee158c85e2a96

    SHA1

    61a034d191ff858067940321e879b7e8c2519525

    SHA256

    d0f5a3281f9933f6fd6da24320a0054d4ea2977fe82e3d97f818cfd2dec6fa02

    SHA512

    7d031e5726cb1770c3a7f78f2c2bd180bb2c15d8317f5d190218ff7e4b6d7db22b3aa3eb17bf0ccb1e76ac2898939f57afe74db376a26183a095c086a1ebdf49

  • /data/user/0/com.ezzebd.androidassistant/databases/beyondAppSDK.db-journal

    Filesize

    8KB

    MD5

    3edcd8b04bdafab95dceb0d4007d064d

    SHA1

    c112c4ba19c56f6056cb8cf5be399102854bea87

    SHA256

    16316bdd2a0cd31cdcc0642551f07eff098607b682dedd959942778e24ae8564

    SHA512

    2d8bcbf037b02fe91bbfa8c317dccd8f31b00aab97a3141e8c42ed2e92389ede26631f16ffe31f694ca153d4414fbf0ef92c6ffcaf34c50639c4ff43839e3549