b2ddd144adc0b3cc4449e7ab6974f0ebab258b89797b8955ef19ed59d680e235

Analysis

max time kernel
145s
max time network
153s
platform
android_x86
resource
android-x86-arm-20240624-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
submitted
02/12/2024, 05:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b6f2fbdd5df903874ae719224bf759f3_JaffaCakes118.apk
Size

254KB
MD5

b6f2fbdd5df903874ae719224bf759f3
SHA1

cba65e30830ee3f4693180bd74c3d6521e73f8ea
SHA256

b2ddd144adc0b3cc4449e7ab6974f0ebab258b89797b8955ef19ed59d680e235
SHA512

f1a8ae2534d7e96b944402d93baf2f81e0f365558e3e5fcf7f92990283ed82217f7e0bada2fc36dc83fdf6ff6abddfa64e9975ca9c96f0857cba671a71979cfe
SSDEEP

6144:LlySS49NM6mrITccV88vwYF34p0mfFROjfIaTSOvN:LU0I6mrQVDw434JFROjfTRl

Score

8^/10

discovery evasion persistence stealth trojan

Malware Config

Signatures

Removes its main activity from the application launcher 1 TTPs 1 IoCs

stealth trojan evasion

Suppress Application Icon

T1628.001

pid	Process
4255	net.droidjack.server

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	net.droidjack.server

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	net.droidjack.server

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	net.droidjack.server

net.droidjack.server
1⤵
- Removes its main activity from the application launcher
- Acquires the wake lock
- Queries information about active data network
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4255

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

Suppress Application Icon

T1628.001

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/net.droidjack.server/databases/SandroRat_Configuration_Database

Filesize
16KB

MD5
f553d76d0e3fd64242b0834f349ef2fe

SHA1
26ebf0fbe2ee1bc0e6ee3b3f3381a2bf4b90144d

SHA256
2e41ce5542acec52b8e568ffb9bbce1dbc00ef5c3d2acddf2a316072fca59985

SHA512
af168732def9efd1c5323cb8b8fb869ef90f5718bced01f04c9bf86d581f06880d5ffb4d89c26092f3c250aeb81ac3dc6c60a445e6bbc7215160da2d30088f58

Download Submit
/data/data/net.droidjack.server/databases/SandroRat_Configuration_Database

Filesize
16KB

MD5
28a193874f622d11c8eadcbee38d0386

SHA1
282c6eea616fa250842eeb58ffa461a3b0a36253

SHA256
0ce73a5aae29cf2c91961a8fd6bc1ddd4543fdc5a34c4bd21312d1f991fe82b7

SHA512
e0fc5c75328a6351293555af0c537d7a674763f5ce4fe1687b9cbe371f35e44f2dc6b70f5828cea76771c3a8f12405920053b14a6c772ac149090d1b014f9899

Download Submit
/data/data/net.droidjack.server/databases/SandroRat_Configuration_Database

Filesize
16KB

MD5
76bb6065960608aad5253be29f825a4f

SHA1
c7c9df556bb530c768abaccb0198a32b0ef9e1b8

SHA256
25cef601e5a8d723db05eaed373f932498936c5b5d1806e9953c0c620a3b5366

SHA512
42727988c3ba1a3758001520cc9969f9e00e51423a4dfe1eb3b3b3405a61405ce26dd98a8f00b9530f9bc85021f0e86544dab608edc72e66a2989f2edc11021d

Download Submit
/data/data/net.droidjack.server/databases/SandroRat_Configuration_Database-journal

Filesize
512B

MD5
ddd4a7b2fc62130accc0852b1c1bee7e

SHA1
8540fe7493f519e27e7c113b85f191e2d860f220

SHA256
fa0333d803e9c3d195b1921f31417cc150cbf8065560eb6ff7b6485a8d77b3cd

SHA512
88ca9468f4a5f0f6cfce98306d4eaf8ae504a8e4c1f589f4249ede7a390d8437842176683bf6a203b63aefd28efe14d8e2eabedff819cfe62d6c9966a5ad2bb9

Download Submit
/data/data/net.droidjack.server/databases/SandroRat_Configuration_Database-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/net.droidjack.server/databases/SandroRat_Configuration_Database-wal

Filesize
28KB

MD5
f611e122d00e53fd2ac4f006dacc9dc4

SHA1
011422fcc49e676e702f3f02d549828fb55ed9d5

SHA256
c02867b39b1d2be5d05b852d081824acf414c09ec9627fd4d05873d57a126f71

SHA512
8d027f797db470d1c346ffd68ffa7d9505d2457baf57c8fb39d51e93dc31aa0525b7e51a0cdc5fff834eaf02e6742e770c201ff6360ea0b5163df137f10f54c8

Download Submit
/data/data/net.droidjack.server/databases/SandroRat_Configuration_Database-wal

Filesize
4KB

MD5
0ab7e3e2050239c7c0dee46e9f1d4229

SHA1
ef1fe1869ebca0c8ac983af1663a2ff3e268d0c2

SHA256
1dbf13fa9c70e60bc1a0589f1959e49b0c4f5238b5a69e1e625462cdc0a9e87b

SHA512
023086c4e93ac6c27af9728a0b8ba0bb05f84f35aa1c4fec250cbcb3d0c8067a545148238a8848098b62eb5e23ebaa7ecf87b98ed31ae2898bd0a87eb9378854

Download Submit
/data/data/net.droidjack.server/databases/SandroRat_Configuration_Database-wal

Filesize
4KB

MD5
0beb61c508f124ffb3c2e191c8a053cd

SHA1
e6a4df2d94b66e9b6d087d16293d55d6f125f291

SHA256
0fddcd6fbe65203006d5638ec6fb62004c615acfb6d8f8f5151e7021c59f2ce3

SHA512
676a21792e00c0a889d86970a88c6bdf1ae912726aa1803b54e9cbe2ba042c514feb5a8c80af29c209c692fed047bd0608820c59857df53a66888478477cd039

Download Submit