Analysis
- max time kernel
70s - max time network
94s - platform
android_x64 - resource
android-x64-arm64-20240624-en - resource tags
- submitted
16/12/2024, 06:29
General
- Target f7a01a72056b791898c75c6de13a15c6_JaffaCakes118.apk
- Size 13.6MB
- Sample241216-g87f1aykez
- SHA256 93ca4d53d68b38627ce7c629f189d500ebe5f43240ae9a4cd1b1c02c68990359
Malware Config
Signatures
- Checks if the Android device is rooted. 1 TTPs 2 IoCs
- Removes its main activity from the application launcher 1 TTPs 1 IoCs
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
- Queries the phone number (MSISDN for GSM devices) 1 TTPs
- Acquires the wake lock 1 IoCs
- Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 2 IoCs
- Queries information about active data network 1 TTPs 1 IoCs
- Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
- Reads information about phone network operator. 1 TTPs
- Requests accessing notifications (often used to intercept notifications before users become aware). 1 TTPs 1 IoCs
- Tries to add a device administrator. 2 TTPs 1 IoCs
- Checks the presence of a debugger
- Checks memory information 2 TTPs 1 IoCs
Processes
-
com.andmon1⤵
- Checks if the Android device is rooted.
- Removes its main activity from the application launcher
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Requests accessing notifications (often used to intercept notifications before users become aware).
- Tries to add a device administrator.
- Checks memory information
Network
MITRE ATT&CK Mobile v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Device Administrator Permissions
1Defense Evasion
Hide Artifacts
1Suppress Application Icon
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
SettingsDB
SettingsDB
SettingsDB
SettingsDB-journal
SettingsDB-journal
SettingsDB-journal
SettingsDB-journal
SettingsDB-journal
SettingsDB-journal
675FC8E60204-0001-11A5-82514F0D77CFBeginSession.cls_temp
675FC8E60204-0001-11A5-82514F0D77CFSessionApp.cls_temp
675FC8E60204-0001-11A5-82514F0D77CFSessionDevice.cls_temp
675FC8E60204-0001-11A5-82514F0D77CFSessionOS.cls_temp
675FC8E60204-0001-11A5-82514F0D77CFuser.meta
675FC8E60204-0001-11A5-82514F0D77CFuser.meta
crashlytics-userlog-675FC8E60204-0001-11A5-82514F0D77CF.temp
session_analytics.tap
session_analytics.tap
session_analytics.tap.tmp
sa_4831adec-507e-4846-9b2a-3676098a6b69_1734330599342.tap
sa_919f99dd-97b8-459f-858d-7ca184df536a_1734330610620.tap
log.txt
log.txt
log.txt
log.txt
log.txt
log.txt
log.txt
log_.txt