Analysis
-
max time kernel
179s -
max time network
156s -
platform
android_x64 -
resource
android-x64-20240624-en -
resource tags
-
submitted
02-07-2024 05:26
General
-
Target
1e23a853a7d8694fd4d7d5b752a5f200_JaffaCakes118.apk
-
Size
276KB
-
MD5
1e23a853a7d8694fd4d7d5b752a5f200
-
SHA1
b9fda9610f6b11616d7834a7f6a28447a603c8a2
-
SHA256
f25766c3780d9b757a02e44678eec92aaa9e19f1b49980472ad3cd2a7fda87e6
-
SHA512
243d555623ba5b4ccd3f4bd00450ed25adf7e5c2c14f79408112819e40bc4efae711fec9bbc2c9514452841cd5a93b356934a3933c144a08a61c47ff3675e954
-
SSDEEP
6144:WiuKlMUzrxVBLc1YAlaXUI/igAdgzey7FDNaw4IzEsS/ZXBc2UA5fN4:duYMs7ucdigAdgRlNa/IvcRgE4
Malware Config
Signatures
-
Removes its main activity from the application launcher 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries account information for other applications stored on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries information about active data network 1 TTPs 1 IoCs
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Schedules tasks to execute at a specified time 1 TTPs 2 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.lima.iiuvk.sprylqiq1⤵
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries account information for other applications stored on the device
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
-
com.lima.iiuvk.sprylqiq:RemoteProcess1⤵
-
com.lima.iiuvk.sprylqiq:guard1⤵
- Schedules tasks to execute at a specified time
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.lima.iiuvk.sprylqiq/app_tfile/fields.jarFilesize
151KB
MD507f164db880c1b6691b5c54862e9a3c4
SHA16dd9102eff0b0134fb9bbafd0122bfae719565fd
SHA2562e6db810857d45da5ea6f084812401401f0f7a2bd6e7c3a7a96c7d46995551fe
SHA51246bec2510d5ed27d54248f32556d2b7969d0e2557f17fe2f1f6f18177e2dbfc42598cfe555d44b38a2bc2480212aec036f4a4df392ca39dafe09a830b03f93f9
-
/data/data/com.lima.iiuvk.sprylqiq/app_tfile/oat/fields.jar.cur.profFilesize
405B
MD555a4a53784369c527cafb31ca5fa625d
SHA18e7dbf092ab840d6365b76faa57d04e9272174e9
SHA25620872e83b6189b0545fb4b2a317c8adecc0a57474d04fd03e6e35eb52fc2d36f
SHA51216cf958a4016a0e3eab6f4feb153a3517b9295f13497dc0a04a753c7af3959452197d63495d488800b5ee6afe7a85ba69cb035ae804259b665953ce872b24b48
-
/data/data/com.lima.iiuvk.sprylqiq/databases/tbcom.lima.iiuvk.sprylqiqFilesize
36KB
MD5ae8aa93151da27ce1348c21d6ea98a45
SHA1d187ce29f387717ea0c7d2919a77945a6f04a954
SHA256b5023c1c2354845e52c945166be1111d7565a000e57ea18d8ce2943c73580e81
SHA5127bc212292c6dd5192e2d714d1e06c3109f133bf0f5bddb4dd4113a4b9ab3a8db3ba7e1cab4a7da44724361b8d7d53cdde3d50506cf7264fb00d7b4521014c85a
-
/data/data/com.lima.iiuvk.sprylqiq/databases/tbcom.lima.iiuvk.sprylqiq-journalFilesize
512B
MD54bf7b2edb3e3fafa8f4ff2108362ae69
SHA1f40692bf7dd0930b96769b00180a15113321c6f5
SHA256a189aa86f76463a69b5a6fdbf79025ca9572ad6798af17288e31344ea3e81cb8
SHA512ca8e0096fbfb8d1203e0da1200275e793cd981ff2970dfa4838d3e0d5531851418d080de891d62a264d65eba042533beec9729085a4bcf5b060591772d85f4cd
-
/data/data/com.lima.iiuvk.sprylqiq/databases/tbcom.lima.iiuvk.sprylqiq-journalFilesize
8KB
MD57fa8a62348bd9b599e838104f5b7cae7
SHA11d423a88b87d81ea25255dd2fb0ef098463af837
SHA256c8198755f5baab87bdfdefd7ae1f5f8466059115c50d4007d1045e2826b5a35f
SHA512f74e2e4656ef947b92d0593582a981b0659030bff5056278b8f42bab3539e38d260070ca2076d5323033b36abad857a09ae7605c96272b7f51f9356caea6d51f
-
/data/data/com.lima.iiuvk.sprylqiq/databases/tbcom.lima.iiuvk.sprylqiq-journalFilesize
8KB
MD5fee08f7f408642a6e9f2920c113e78ab
SHA16a39d308217e6a45c4fe6685c181fcc125835b13
SHA2560169721881bd394c6cdde64566cbd50460586935a292b5e42fb6cd1420976307
SHA512be3688d157090f87c54e3a8b86dfb54141d1824463da4dd969a74ea9ded18bb52ee85b843970bf2f2e725e0010629aa94f13cd27b702c6ff0c95ef230b3d7823
-
/data/user/0/com.lima.iiuvk.sprylqiq/app_tfile/fields.jarFilesize
306KB
MD535926f0158766813027fbfe1ab5b1125
SHA18f166af95ff940dc45b933462ee7ffdf30dd5d06
SHA25647a1ed442aa97ce2a6c313cbd64547cd506b809593745707d3fc9585f6a6c3f4
SHA512b0fb1d19eedb27b3efda5354ac947db9ec89901d0f5c5b9a64325f2d74f4e11f5330f984bb9a9e5ad1c2d3abcd62e1516d94e7778d273ed5df51993dc9573ba3
-
/storage/emulated/0/Download/sdsidFilesize
4B
MD5b8c37e33defde51cf91e1e03e51657da
SHA1dd01903921ea24941c26a48f2cec24e0bb0e8cc7
SHA256fe675fe7aaee830b6fed09b64e034f84dcbdaeb429d9cccd4ebb90e15af8dd71
SHA512e3d0e2ef3cab0dab2c12f297e3bc618f6b976aced29b3a301828c6f9f1e1aabbe6dab06e1f899c9c2ae2ca86caa330115218817f4ce36d333733cb2b4c7afde7