f15c84ffa9218b9785794ce2db01fb05a0e4968767d9aa6af0d530970e1477e4

Analysis

max time kernel
19s
max time network
149s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
29-11-2024 13:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b16c7105839661a54df694da8c1a630c_JaffaCakes118.apk
Size

216KB
MD5

b16c7105839661a54df694da8c1a630c
SHA1

632305209530a7ee156c78019c593fda4d237d4a
SHA256

f15c84ffa9218b9785794ce2db01fb05a0e4968767d9aa6af0d530970e1477e4
SHA512

f75d49c06cb0221736b29ed355d86241b83cf5b9baea9495129906eff0562b923bfb74770ab1002c69dc2731b207593042e21f78eae997fad81afa9d22900f93
SSDEEP

3072:AIlbZAam/xwWaMaPC5+kAMEJGoRLG2Yv/7pcmds+qTyGZ3E9WA:AiZAamZwWaMlfFo1NOcmdsF3qWA

Score

7^/10

collection credential_access discovery impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

Processes:

srcdsnms.jlimwd

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	srcdsnms.jlimwd

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

Processes:

srcdsnms.jlimwd

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	srcdsnms.jlimwd

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

Processes:

srcdsnms.jlimwd

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	srcdsnms.jlimwd

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

Processes:

srcdsnms.jlimwd

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	srcdsnms.jlimwd

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

Processes:

srcdsnms.jlimwd

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	srcdsnms.jlimwd

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

Processes:

srcdsnms.jlimwd

description	ioc	Process
File opened for read	/proc/cpuinfo	srcdsnms.jlimwd

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

Processes:

srcdsnms.jlimwd

description	ioc	Process
File opened for read	/proc/meminfo	srcdsnms.jlimwd

srcdsnms.jlimwd
1⤵
- Obtains sensitive information copied to the device clipboard
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:5039

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/storage/emulated/0/wss1.dat

Filesize
64B

MD5
b7ef8d8dd0fa0694909ccbaa94d226ca

SHA1
9d6b01523c5149ecaf096983b25f16395fc4a991

SHA256
dc171484c642ba4327e01355281548ff600d8e87ed5d5d0c256260518efc9a0e

SHA512
676ea2bbc7e360d1d18d848ebb8f83b0b18d40a27bdc55f2f6f62d53545b1d96f650738fe534b15877f365063e3b12c3fa54ac74944d815c5501eb15ef409d72

Download Submit
/storage/emulated/0/wss1.dat

Filesize
128B

MD5
4d5f6fe8314d57fe7055c17a8d36b459

SHA1
19322a871b01ab7c572c1d150ca6049a36cfef55

SHA256
c0d633da15d44eb67f970cd4ac1488f324fd805c08919cf62f48cf37fbcca2e5

SHA512
aa98deed035e6de51d83bb8844a5ca90dc50f33cfb2938e806126439cfc2e80cb193cf42e62bb7f9f65b24076d051715115169ddaaec052795a39ed7708bad80

Download Submit
/storage/emulated/0/wss1.dat

Filesize
192B

MD5
936a5fc09ac1831c217b69cf8141e30a

SHA1
4509eb427d014ce953744f371b710dceb22b7270

SHA256
f796a1620e45c767a4937085b2384fbd9b2511e45b241e3c404636f7f9cb6928

SHA512
539d7dd49ac37b0fb21dcb455ec18a67eaea7d18cebda837210b00e0b1ba7a9465f0b7f716cfdc8305726acc8a63f8ddf111a82d85b44492e4d7665c5c46ec3a

Download Submit
/storage/emulated/0/wss1.dat

Filesize
256B

MD5
96486291bf6f1bc053ae7db14057dad0

SHA1
1d60671cd4553c06649472f3858b2aae05e80757

SHA256
f892acf687f7997048df7bb4ad7c4efcaa0c75606b6b8a67f3f6e89d30bd2c73

SHA512
2fbb54f72740ec8037d31bfdad22f0b92429644b68a1a0010d869e53b4079fe6e1618f7bfc5ff533c637af51300b2bacadc626c5d4bbb3b4835cd2f0e0a337a0

Download Submit