Analysis

  • max time kernel
    14s
  • max time network
    137s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    13/12/2024, 06:01

General

  • Target

    ea3a33cdd084eea796816fbf477f533f_JaffaCakes118.apk

  • Size

    1.4MB

  • MD5

    ea3a33cdd084eea796816fbf477f533f

  • SHA1

    08bc369c7de4ea4732226797bba80fb1b5842e2c

  • SHA256

    704b3669bf3eb8c365702cddb66d9c10688f1d8115f98dc0e5d16396c33b6b6c

  • SHA512

    37382465e1273421781065d4d7bb075a91d98cd962eb2e426fb2907eeebe93659c813e8bb6b8dc1443ebc298be8b2fec10ace572daf2556308c1dad4da4b01e3

  • SSDEEP

    24576:/awgIRKrKr9F+tjq/qKld+EMphtlFZOPt6VcayYGJUTuTqCUsQQDO5SNxqZ:/awhQp9q/jldPMphtlFY16VikooQC5Sc

Malware Config

Signatures

  • Checks Android system properties for emulator presence. 1 TTPs 2 IoCs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Reads the content of SMS inbox messages. 1 TTPs 1 IoCs
  • Queries information about active data network 1 TTPs 1 IoCs
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • me.zuischu.mmvsideo.kksssly.oxeaxsss.xisggebxx
    1⤵
    • Checks Android system properties for emulator presence.
    • Reads the content of SMS inbox messages.
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks memory information
    PID:4249

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/me.zuischu.mmvsideo.kksssly.oxeaxsss.xisggebxx/databases/DD.db

    Filesize

    20KB

    MD5

    4c1be56405bd88342fb3cbc495d40b52

    SHA1

    d38d27622d0f4d471394e8387317c51f5ee4e899

    SHA256

    90327265374536e5aef98e69ce88ace27d421c8c589c47b386ed1b05aeddfebf

    SHA512

    12404a53f4313e0d7d4bdeea35e4252579bb12ad622bc648daba05bbe542b04ab28ad4262eaa7d65e59162a6774e653b7f86db7dfda16d416e0fc097f30650fa

  • /data/data/me.zuischu.mmvsideo.kksssly.oxeaxsss.xisggebxx/databases/DD.db-journal

    Filesize

    512B

    MD5

    0b9d1775ebf64cb3253df843b2b54e4a

    SHA1

    cbb9ccbcdf85b09634731296d79f60f2b444eb79

    SHA256

    d03bb29da966a37c9c2280e8d1cbca0675be5771902e0ff685a9b881b7b60356

    SHA512

    93efb2f62746b83823502f2378ddab2a7d5de251305c22a4100ad4cea3aaa8783adc538fa320b15686b9b9ed3bfa269156e2103fab834f3a9f8571bdfc307583

  • /data/data/me.zuischu.mmvsideo.kksssly.oxeaxsss.xisggebxx/databases/DD.db-shm

    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/me.zuischu.mmvsideo.kksssly.oxeaxsss.xisggebxx/databases/DD.db-wal

    Filesize

    40KB

    MD5

    d42b6ca1598734106d9acf76c7ce0790

    SHA1

    ac29a6ceac0d55797eb9b12466ab320dde73768f

    SHA256

    cf42687d20bb84942a526968d60873c7f6acd6a6e71e18e32dc1e82fe5541cae

    SHA512

    5c9bf55603090c1bc64eb6162d3419a6c0e8195e76800b2c503cee415cac833557ae38ec4019f7d478b22939a2aa4b23db545d0275eb8d5de3c2ca41420f8b16

  • /data/data/me.zuischu.mmvsideo.kksssly.oxeaxsss.xisggebxx/files/.deviceid

    Filesize

    32B

    MD5

    11e938cabca741a77416232a636b0efe

    SHA1

    b19fd2ec6a28a08d0811d0c8d1f703d7937be773

    SHA256

    c7cf0e91ddc3cdad2f1280ead66018fb0c0655f48a592c236fef50b27ed113cf

    SHA512

    a862ae4f2f386806a0e04fdb0fd2fceb8465ceab17c3b9f7a82de3a6b69a8ef88477622894d990752ce377935ed3b828adad275bcd1e08edd06157e696df7dd8

  • /data/data/me.zuischu.mmvsideo.kksssly.oxeaxsss.xisggebxx/files/qdbh

    Filesize

    5B

    MD5

    573572e4e9a8486a02fbc7eeeaffba7b

    SHA1

    d46200e567be9da16d39391214042cc8d94cb051

    SHA256

    c291fe829d40dc63fc4fa578f6208f425064945d31ca8251d2821d2b4855380f

    SHA512

    50a1accc336d13524561e4c843e77e57a474cab00fd5456b476ed8f4879a5dc995cebc3e018dabf435210fad9959fc0159e63ec0457e1bb0c51d34ab625c2ed8

  • /storage/emulated/0/me.zuischu.mmvsideo.kksssly.oxeaxsss.xisggebxx.start.times/me.zuischu.mmvsideo.kksssly.oxeaxsss.xisggebxx

    Filesize

    63B

    MD5

    7b17ff3e999973ee2ac4fe48a7d6eaed

    SHA1

    31a8791e665eea831904c8d6e1b8370fbc7534d8

    SHA256

    7fac003a9e87d7bebcfc1c3d97fb30fe6cb2ddef881cf86e0a7e500ce1eba479

    SHA512

    8c42e57bf82c8884b9e9f1240842d07195c711556ef391874158d78e36bc25444a6b1d31fbcc8658285e691bfdd8302816f64327290ddef9b504865bc52e92d0