Analysis
-
max time kernel
149s -
max time network
136s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
-
submitted
29-11-2024 12:52
General
-
Target
b15b11f438c8db93327bb679bc09a89c_JaffaCakes118.apk
-
Size
27.1MB
-
MD5
b15b11f438c8db93327bb679bc09a89c
-
SHA1
5a4f289422430a8bc68941e311bc50190f570ebe
-
SHA256
723cd3eb202c5f6ee70cda2ea84464d124216949f3d4bafa25e7a52bbafdeb94
-
SHA512
39c84eff8e1e689c05e6a7ad9f88a68d13030ab40c1430c8387be2b28e91832043a0c49a778defd93307b12132f89bfedd065dae4c6774924a366e4da42cb187
-
SSDEEP
786432:s9g5ZdpzPhkV1RArCY6hCeS7T+jaZLjkv8jyjZ:s27zJCva6hWHhjkv82F
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 5 IoCs
Runs executable file dropped to the device during analysis.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.redantz.game.za2p1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Listens for changes in the sensor environment (might be used to detect emulation)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.redantz.game.za2p/cache/1582435991586.jar --output-vdex-fd=119 --oat-fd=116 --oat-location=/data/user/0/com.redantz.game.za2p/cache/oat/x86/1582435991586.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.redantz.game.za2p/files/audience_network.dex --output-vdex-fd=116 --oat-fd=124 --oat-location=/data/user/0/com.redantz.game.za2p/files/oat/x86/audience_network.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
1User Evasion
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5062bbff70c468e6c2a38c15af3c17a60
SHA1cf16af7888d5aee3a18524350c71b0762e4dcfeb
SHA256770c372b2c61b719f3e3602ca588cf9f77703066f0a622bbf9e219f6c31cb4c8
SHA512692dfce0e65ca2322efd199f23efae8395b0d050be399449147b3e65810fdbfaf37cea239d57f39fbf8b8c171c93b4e8fda60bc3a77aef94f12784411c88a5e1
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
36KB
MD56721f436a4f9cbd986bb154456828145
SHA147eb8e50e60c44b5b50b5e2124ee850a784cca4c
SHA25604550965fd8567c0425683dcb37d0d81c472d92d86d3afd331a9e5cecebb5469
SHA51228326918f17b6dd80f1cdac4d135808191a0b938a5833bbc90b6dc7564128c08f86bfa1a858c3276777a9bb5bd5395eec005b82f6b7e5eae8066970413fb6d2e
-
Filesize
36B
MD5a4e92e261933a1768e8af01128cdc2a4
SHA1c128a73d08161c433d9881ad4f15a7fb62cc45c1
SHA256250901352fd48d7aca8282c9a27ca0d5c20ac9447d4ca19344c33c197befb769
SHA5125cc9f9de2cb14561e4b50976433b9e59402b8127306bfe2114fe883a7c639211462c16066d3cd4a980758166733e4110a32f5701722205cad20d8e6522bf55c1
-
Filesize
9KB
MD5e8e0527a01aefdb89afd2c508f131da1
SHA1f1103e6b260c657ceb3d95f1b023af3fda8b133a
SHA256f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce
SHA512fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34
-
Filesize
148B
MD5a3b78d197d786c13687c3f0f89703bd8
SHA19967f0726b6b1ed3f198904547b81920f8329621
SHA256c5e6754556dbe01b055066f23c28ddaaf5fe67cee4baed00d59dc993335b3d97
SHA5129a47c9bb977edec9d29d22f280e0078ca931a722eaecc2b085c6b5aaf6246d17a6ad07c9faca45070bb5b89a3ee6cf896f5e2c7e73fb033e3ac57471df70a8b1
-
Filesize
294KB
MD54daea8150568d4766dcd91e72e9eec15
SHA196ba652d91b2b30b7a9fd3bf27f317b4fb1945e2
SHA25671810c3c9bc65213181c0bda711396c51464da2f25b9487ab27ce2e3cca329be
SHA512b24ada5f7c7a9960de6cfe5630850e145698a05227b95fde942a72dbed8e00f6c1662a14eec04662734f580090ef17f84af2104011f22963192d30bf784d0604
-
Filesize
1.8MB
MD542493ee45356fb2fccbfc3356e528aa9
SHA13ed7ab64745501da3a5bbdde0505a536ceb4c8a2
SHA2560c244885a1ff062d8c717b27579484000547d87f6ed6a5c7f35f7a4efd8fd4dd
SHA51212c85464b3627b5d1f3f6eb2b7b28fd70b4a997cbcbd42e969b4b413b970aece7533fdb117f0540c9fd6804b478f7a1053bc2e37c6c9e5296b6aab2e6ab9bbc4
-
Filesize
33KB
MD591c4a59ee49721a794ffedcef327f9f8
SHA1899390ec3f9a8cddf46e0e16b5094de7b07466b7
SHA2568a29d284324d14ec68ce7625d9bd2aca4b8f8151318e4ed49c04793078fc0e67
SHA51233e94e25afbcb7913df880dc279766a4f105a7271f82bb523f92a1e1f418537bd18d3df7e4e25b7a50c9e1632fb712b14d461612d5342cb6caa84749e4d057c8
-
Filesize
6KB
MD590cd1eef95f6a13167c8e7a1a63c433a
SHA14a45f949347167326f29c78f445d3cf45e01c8f0
SHA256b069180b9e3524acaaf737a640cf42df6e25a982d88a79b039d06fa235278e0c
SHA5129a8e147368e893212dc66334bcfcc987194bbfd774ee823f6f75b3d69b3a493af5f437c540b68a544ccbeb9e6f5777ead4ed80dec8b30458f3af81715598ee29
-
Filesize
849KB
MD5cd39ebfef90eacdd64eb76b5e5fdc51d
SHA197993a6bd597e0f83cd8ea90e35b35c2b2e79c75
SHA2563dcb84b9adaac88f1283e8da0a7848769ce96724efaee23392cb1620f5d27b27
SHA51248a4742334d3b49967449dd2cfaa79c9751c68eaf5c5c61a3c96f3db3b58d220c62fe047e7cdf3ad7c17b7a30e7caa5b81a327fd7eb3834d167b0d39c8d1c46c
-
Filesize
38KB
MD5423e4e0c410646ea31677c54b64156b6
SHA167b53560d5531fd0b854a018a5bf6b9aa680eece
SHA256baca4c376fbfd235f28c629ec67ca59b0f96d72d40cb851a91d09712b9460937
SHA512ec3d703c8e3d14149828b151f050a25d487dc2ebeb2cf27777fd4afd469f2a1e11bff99aaf41f6346ddd11cb8af07c85329d9aca2be9d68adb9c6c8e78d876d7
-
Filesize
105KB
MD57395d5aed853676551ada33de073ab7f
SHA1bf7fc45e83a981bc9514df725145ac1245cc4ed2
SHA2564fb565c9d0bb9379c355f356a907ddddb352b953a35fd345d7e7996d00d2c141
SHA512b49d528472e4d9b16dfe5458e99128a2544714c77c0badd232e981da05d7825914b2ac92b5d9b360ba8191c4e0e1ade0af2a0d2f0346ee9828a18c29967cac6f
-
Filesize
4KB
MD5a5cb3d5e5ff689f75974c36301ec211a
SHA147150bb3814c9fa728c5cf038e4ec76b9a4eccfe
SHA2568389099ebe6dc67dacd482b20ffc150a15ddc34c4d99711c41dba00c888bbc2a
SHA512ac954de81a820edf5e1a19fb56cfc494756bfcbd1226bf15189a26af445bdb533fc350ff83b7a46f3a38bd72a9b5a0acd09de252179000f266c1a9e54633ee30
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
Filesize
1.5MB
MD537982159fc58abe0c52fa11f5500f2ce
SHA10b93b94af7bf3a112e18f56bc43387d943c5043a
SHA25604c39dfc7f8613151eda03eea3f25a4c986dd07075fe2dcfcb71ae69b6162132
SHA51272ad23185f963336bfdbbd6415c9638f90fc0da848ea6f94f45b3d4f5c99abcc068a377ce8fbe0964f2c447256d8a389ddc16f6ba91fb376564696b72f00ed91
-
Filesize
460B
MD5f8e3f7f7ad808112362cdd74b64dc0e9
SHA14e2803d4d28307c38ba335634ed815352d898e3c
SHA256ed7170e979164716d1e77ed2d00e16c10f929fa547debb08f5e39ca35c6fd2b1
SHA5129af7a6769e3284046511e1ecf7b73961d7c6f3558e490909bce4119a0c4c1486272fd95f66252b59850bb57de1a05e7cd6f66259a6233ea04bc2decea20d13c9
-
Filesize
20KB
MD52048eb6124a452540ee51dae4145aadf
SHA1d05005b2cd7fe4cd652b0d7fd1bdac2c19d51451
SHA256105c54b6fe3f25350e92187467761598e4c21d62b1091b77d091f65f3bd98864
SHA512bb6cb3853dd2a5d0701e20607d4e153ae201268dd2e5e2d06cc2df208b3b4dc50132a4ab428251b1644d2399fcc717662438d082ff14203387bab8794109d44d
-
Filesize
20KB
MD5fde2ee00cbd121cfab5290b078aa3ceb
SHA1e2b77d5320e155e413d040a8c20020962065b2f8
SHA2562897b0812077c654a9b3fbb0b6303d5cde681eeba7ad9981de65716c7810d685
SHA512a9326aff8e454a2b4ac09984ef2a65fddd4dc146b4c44d839035549bff8c9fdaae490326d0b018f76c1ca2e4fb25426d74f550ca0950982fba632a023af99a56
-
Filesize
1.5MB
MD5fb8afbcc7369fd9879443941557b97f4
SHA199d9e78db9235b79e25476da23e273583a16f3e7
SHA256a9c710057ad07ffe6582d25a6ef89241918874ca4414389b23a7f35cfb76edd1
SHA512ea597d25df97322dcdea4dc3b34fd7b114e74746a3a71b2c24f7e98f20229a9e56e90d904a8783832bd7c335b7307bd3e30ab58ab15f8b7af2827a223c63c2e4
-
Filesize
4B
MD5098f6bcd4621d373cade4e832627b4f6
SHA1a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
SHA2569f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
SHA512ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff
-
Filesize
1.9MB
MD58a96664d5012df7b6a06c69ab4d16ff3
SHA1956168588a58ba328ea969ef3dba8f49ae8b6b90
SHA256cad36823da18e2a0c119b647b2c49afe9240aa6612e8ccc77e614c5c68877bfc
SHA5125b682542d2742ac9f12b94d974dccdbd5af24abdd6a459c20ea5fc6ce5a98eb4d6a96b3dcc513b97fd923e69448eaf8c1150002be90bfa276d3f46bc109c1bf1