96df7effc5e18bfefb8897a7edc76bfab907b58b15591ba16c29d2bf92e52b9c

Analysis

max time kernel
146s
max time network
155s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
29-11-2024 20:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b35dc72b278271b0c003ef8c335c267d_JaffaCakes118.apk
Size

254KB
MD5

b35dc72b278271b0c003ef8c335c267d
SHA1

495b38e10dcf1a5a63f3f4e930c7815d226bd9c8
SHA256

96df7effc5e18bfefb8897a7edc76bfab907b58b15591ba16c29d2bf92e52b9c
SHA512

502c74dd86c0d57d1993c36368182501ab100056c1357ded7dd05e1182ba9d49a90565a82e0b340aec7ea48f799a64bac2c083698c48a6a175e3310b98708e70
SSDEEP

6144:ty+F4lXdj+rfJzrtGXPHjlvwIzwaivPhtMZSHjbeWlA/BNeH:8DJ6pYHjhH+v5t6SHjbZcBMH

Score

8^/10

discovery evasion persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4994	net.droidjack.server

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	net.droidjack.server

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	net.droidjack.server

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	net.droidjack.server

net.droidjack.server
1⤵
- Removes its main activity from the application launcher
- Acquires the wake lock
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4994

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/net.droidjack.server/databases/SandroRat_Configuration_Database

Filesize
16KB

MD5
ab9b76032f3671e636504f620ed4d205

SHA1
21e1e3ef5f95af48acdd224ef1f40ff12467521d

SHA256
4da0f7c511a540be366bd92014b6279194cf5da3c47ddb8acb48526f1ad967ab

SHA512
9e133dfb122855076eec7967f0e73fef6f8cdd655b32f9ee5d8cc7de1114212d10764839359b38b63e73772517910662109d87336a8507a99ca1085758841725

Download Submit
/data/data/net.droidjack.server/databases/SandroRat_Configuration_Database

Filesize
16KB

MD5
d42c01762baf25605e7281100df1724a

SHA1
7135263567443136971094610256b7f48efc091e

SHA256
ca69e32567af9079329d7e3817a64daffc213ac6f5889b5262c72b197d5dc435

SHA512
8b6bbddb791c64dc13f5186d18cd6e353d7dfed762b7acf940e419c0fbf565919832994c26bb88173b14de6cf0df2d289209226d7e66e1a196b4d06be66fdf6e

Download Submit
/data/data/net.droidjack.server/databases/SandroRat_Configuration_Database

Filesize
16KB

MD5
9c78b662992e19f5d37b438b597005dd

SHA1
c899bef2ce9640596954b2a9882e9f1c37eeb635

SHA256
97a619632c7580b6ae58147ee8f261f7aef474aee12d1623f69a3f831c1caa6e

SHA512
56630c370df77ab180dd758c30ec0fe98d2948831ab3b1672f28d1a097dca97eb38b3537e0814776b756155222ef2a6a4d0e3765caa89cadcc31bccd119dded4

Download Submit
/data/data/net.droidjack.server/databases/SandroRat_Configuration_Database-journal

Filesize
512B

MD5
3cdc8c79529a2d93c7a13a21575ab2bc

SHA1
262c21cb023b6324cdd4a1cb72492618c3c4bf51

SHA256
10b495c43f48eb0a0330e5f4a51c2ef93d5b22808aa59585467a597a98905eb5

SHA512
91e12fcadc41f8f8fb1c4e51f7c0954ce61e8bdf022a292a37c04edd0e918524ffcd51f5bdb96db8fac1a61cd0fd18d303a8c7ede2a7edc4e90f9db8c19f0df4

Download Submit
/data/data/net.droidjack.server/databases/SandroRat_Configuration_Database-journal

Filesize
8KB

MD5
913cf6ef58f8e4436f836b76a83186ac

SHA1
79f0cf05d151bf9bd147eda0ae425d90b0e06895

SHA256
1cdc3e7fcc2019fbcae553b01455be30ef16890d741dc4f7f551191d4ebfde90

SHA512
a4b7b4d292f4bfb26bb6448af95bd03f3790bdb81b602b38b0f91dc2107717f90c848ac19cf1f0173ea2d0f481b9c8bb11f84e1f9f9d2d2507214569b2409ad1

Download Submit
/data/data/net.droidjack.server/databases/SandroRat_Configuration_Database-journal

Filesize
8KB

MD5
5bda20d9315ea345649360f910ac49e7

SHA1
c145e9a32cbe7b5fa80b1a0302088b63d062ba20

SHA256
7b10785359c6131e0f72723ee41e8504a4051efe363fdcd2a80f0af3c112ff80

SHA512
6a3f643a4c284ce568c2869180ce889e92e69fc3243a08f94a43dfc79cfa8705f1559b75b52868c5e94516fbc3d1b952641ad0f0f02be8accdb2e8c98b5a5713

Download Submit
/data/data/net.droidjack.server/databases/SandroRat_Configuration_Database-journal

Filesize
8KB

MD5
b5ec2df7b5b1676096d6ccb4bd47a45e

SHA1
6001a0366e0dfa47826629da052702bc7b39acf7

SHA256
89b8c864a33b7c682dee721791f36c4025d13a82f68d96a4ebf968bd6ec322c3

SHA512
6092c1a1502d1835a55c72e4d0d661ffdf5c49dd9729eb8e2d2e5554d11f3c1fd73bb4632b9d2d72b8c65577494403ec644ac6386a13b1d8d91ab96608efa6db

Download Submit
/data/data/net.droidjack.server/databases/SandroRat_Configuration_Database-journal

Filesize
8KB

MD5
00f5c1a73fb7dd1e43738704e799a909

SHA1
e8da7f47f67f309403aac25741124f586416e870

SHA256
70a071ef3a5a556c4ce8435691135fea44ff97ed0dc5e93e330eb7c7f1c751f0

SHA512
6255f9eef6c1963bfcffc940cb707d051f7661f4e5b8a07e216c3ad7bb5d9a6e0773073c6ddf604f7e25e73b5d008947f21c16e0d32b2cdbf6308da01fc47498

Download Submit