Analysis
-
max time kernel
18s -
max time network
131s -
platform
android_x86 -
resource
android-x86-arm-20240624-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system -
submitted
29-11-2024 12:55
Static task
static1
Behavioral task
behavioral1
Sample
b15fb7b56ac9ba41cba47d842870d97c_JaffaCakes118.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral2
Sample
b15fb7b56ac9ba41cba47d842870d97c_JaffaCakes118.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral3
Sample
b15fb7b56ac9ba41cba47d842870d97c_JaffaCakes118.apk
Resource
android-x64-arm64-20240624-en
General
-
Target
b15fb7b56ac9ba41cba47d842870d97c_JaffaCakes118.apk
-
Size
1.6MB
-
MD5
b15fb7b56ac9ba41cba47d842870d97c
-
SHA1
6ad7559e97813216411e88fde128ad74676a8f1d
-
SHA256
aa4d4f27aded0cebee2adb20bb633c9e091012132918a95a2d1c0a2e6e420a46
-
SHA512
15dd158df0db06c1abf6bdfa02d9efa33212dda3bac034e2eb784423622070fcae0366ad5da212e0055a8885b50372d67e510b93bd2390ef514023547fd1b768
-
SSDEEP
49152:FBS0EWQreRSdygFWMbRURXfn6YdxNrhA08UAL:zS+RSLFWMEXf6eNrhAnUO
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 1 IoCs
Processes:
com.nuts.beauty.removeclothes3ioc Process /sbin/su com.nuts.beauty.removeclothes3 -
Queries information about active data network 1 TTPs 1 IoCs
Processes:
com.nuts.beauty.removeclothes3description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.nuts.beauty.removeclothes3 -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
Processes:
com.nuts.beauty.removeclothes3description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.nuts.beauty.removeclothes3 -
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
com.nuts.beauty.removeclothes3description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.nuts.beauty.removeclothes3 -
Checks CPU information 2 TTPs 1 IoCs
Processes:
com.nuts.beauty.removeclothes3description ioc Process File opened for read /proc/cpuinfo com.nuts.beauty.removeclothes3 -
Checks memory information 2 TTPs 1 IoCs
Processes:
com.nuts.beauty.removeclothes3description ioc Process File opened for read /proc/meminfo com.nuts.beauty.removeclothes3
Processes
-
com.nuts.beauty.removeclothes31⤵
- Checks if the Android device is rooted.
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:4247
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33B
MD522518affa21e91e59bbef01a38f599cf
SHA17e34dc6cb74a5ca78a82621fa436656f96651e39
SHA25621b94a2dc500f872851c5a7276e8c885af75d0302000ed8346b8db0972f170cf
SHA512d9f2dce1688836b6ff05b01d8a258bfea7ea9eaab756d99890c3afd6b2432674909001baa60451d8270a92a369b78547e068310259bc69122b1f0f555d4b538e