Analysis
-
max time kernel
149s -
max time network
132s -
platform
android_x64 -
resource
android-x64-arm64-20240624-en -
resource tags
androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240624-enlocale:en-usos:android-11-x64system -
submitted
04/11/2024, 00:46
Static task
static1
Behavioral task
behavioral1
Sample
8e5237a5fb68f92e9b6e0d37c172e4e2_JaffaCakes118.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
8e5237a5fb68f92e9b6e0d37c172e4e2_JaffaCakes118.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral3
Sample
8e5237a5fb68f92e9b6e0d37c172e4e2_JaffaCakes118.apk
Resource
android-x64-arm64-20240624-en
General
-
Target
8e5237a5fb68f92e9b6e0d37c172e4e2_JaffaCakes118.apk
-
Size
2.8MB
-
MD5
8e5237a5fb68f92e9b6e0d37c172e4e2
-
SHA1
bb7eeadac560a80ad0dfdfca61649b01861f323a
-
SHA256
59abde0b18235002444e4cfddbabcc2fb948f9a2618edec896f8de4f58647cde
-
SHA512
1998b77026a50cc9737822d91f5716e2af8952b7b785ea213b4cdd5828dac5016410214ed8107ccaacdae17c828c996a15ac62f9398091acbdacda824dda89f7
-
SSDEEP
49152:YpsBnPFA2bKW9GbYUGDH7dhJlth7NcuRphXF6AKv5igsK3rAbcNQVi3jFf62NZly:YpMtAZmEPGD7xl1cqhXF6AKv33rAQNQR
Malware Config
Signatures
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.ezzebd.androidassistant:beyondAppMonitor -
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 2 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.ezzebd.androidassistant Framework service call android.app.IActivityManager.getRunningAppProcesses com.ezzebd.androidassistant:beyondAppMonitor -
Queries information about active data network 1 TTPs 2 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.ezzebd.androidassistant Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.ezzebd.androidassistant:beyondAppMonitor -
Reads information about phone network operator. 1 TTPs
-
Checks memory information 2 TTPs 2 IoCs
description ioc Process File opened for read /proc/meminfo com.ezzebd.androidassistant:beyondAppMonitor File opened for read /proc/meminfo com.ezzebd.androidassistant
Processes
-
com.ezzebd.androidassistant1⤵
- Queries information about running processes on the device
- Queries information about active data network
- Checks memory information
PID:4443
-
com.ezzebd.androidassistant:beyondAppMonitor1⤵
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries information about active data network
- Checks memory information
PID:4500
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD5894e53f613d3bbf376b5e5a580dace0f
SHA15beb341d7501ae9151d4455f32b48b67b47a82db
SHA2563fe1a6f6e57b864c66fc687fad13d9c8255999a13fefa2c1c7102d0d2d5c962d
SHA51274e251a74fc8002bc4afe4319d555477d8b2e8114d097208ea1b9448568ce8060d48ea7282ed9aa21c71140ec8fe4286d97db2e488c7cc59e9671a8058b188e1
-
Filesize
2KB
MD5e4539bb5af3725eec79d7635ee670723
SHA18e6ef994ef9f5dd7b1a036560b4d4061e772bb7a
SHA2560ada25a78015b89b078ec5747e6bc7a167f4fa65de4d29f09a0a53a46040a0dc
SHA51245324eb5bb087d6c95dd0bc75a159cc2d6e9f444d03527fc34222b92ff2ef481195fde7abd8c3e83d2edfa55b27be1bcbf9ba4a32936b223fa1b0f4c418d7984
-
Filesize
8KB
MD520a3e82fe4e9614c032ee158c85e2a96
SHA161a034d191ff858067940321e879b7e8c2519525
SHA256d0f5a3281f9933f6fd6da24320a0054d4ea2977fe82e3d97f818cfd2dec6fa02
SHA5127d031e5726cb1770c3a7f78f2c2bd180bb2c15d8317f5d190218ff7e4b6d7db22b3aa3eb17bf0ccb1e76ac2898939f57afe74db376a26183a095c086a1ebdf49
-
Filesize
8KB
MD53edcd8b04bdafab95dceb0d4007d064d
SHA1c112c4ba19c56f6056cb8cf5be399102854bea87
SHA25616316bdd2a0cd31cdcc0642551f07eff098607b682dedd959942778e24ae8564
SHA5122d8bcbf037b02fe91bbfa8c317dccd8f31b00aab97a3141e8c42ed2e92389ede26631f16ffe31f694ca153d4414fbf0ef92c6ffcaf34c50639c4ff43839e3549