14edd2dc62f2297e929131231b02535c0e23c18150477a4e81e3a201ee66fde6

Analysis

max time kernel
141s
max time network
154s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
08/04/2024, 19:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e82e33751fdb09ecee512b721d24d97f_JaffaCakes118.apk
Size

5.6MB
MD5

e82e33751fdb09ecee512b721d24d97f
SHA1

8ffcc16d5684b8a439f3a1b8fdfcdf3d82dee7f7
SHA256

14edd2dc62f2297e929131231b02535c0e23c18150477a4e81e3a201ee66fde6
SHA512

5055e8e4c899494c9dda659e2597f72b90a3db5756d498df576dcb12219991f7e91926dd241fdb523a00de75d7d391cb77a3507521aa9065a1ee693050154f5e
SSDEEP

98304:hvAKN4bK9G5Buix2sTgcwEYWsO606mnU1kOVmCc4gnXUY+L2YKaccL0wmh4:ytg/02gBwEYWRT6mn4v+4cUY3Zan0wmy

Score

8^/10

collection discovery evasion

Malware Config

Signatures

Requests cell location 1 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery

Location Tracking

T1430

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.erciyuan.clock

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.erciyuan.clock

Checks memory information 2 TTPs 2 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.erciyuan.clock
File opened for read	/proc/meminfo	com.erciyuan.clock:pushservice

Queries information about running processes on the device. 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.erciyuan.clock
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.erciyuan.clock:pushservice

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.erciyuan.clock

Uses Crypto APIs (Might try to encrypt user data) 1 IoCs

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.erciyuan.clock:pushservice

com.erciyuan.clock
1⤵
- Requests cell location
- Checks CPU information
- Checks memory information
- Queries information about running processes on the device.
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:4474

com.erciyuan.clock:pushservice
1⤵
- Checks memory information
- Queries information about running processes on the device.
- Uses Crypto APIs (Might try to encrypt user data)
PID:4518

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

User Evasion

T1628.002

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

Process Discovery

T1424

System Information Discovery

T1426

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.erciyuan.clock/databases/pushsdk.db

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.erciyuan.clock/databases/pushsdk.db-journal

Filesize
512B

MD5
154b35fbd81a92f55ad3176386b29bac

SHA1
1cadbcdb451949ef43935ce43764705cab3b6f71

SHA256
da189a2e8577bbcb8662d5b1e41fbf291f23bce2348e1a602da833563c5bb89d

SHA512
feadeb7ad5e6aa5b116d29a090c3799373d2bb320a4d1bdde99e3143827e847ca426fa0b4fed1da91cf2c92d12034d0488fbf219c383b33a13d7a5f1dcac60fc

Download Submit
/data/data/com.erciyuan.clock/databases/pushsdk.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.erciyuan.clock/databases/pushsdk.db-wal

Filesize
193KB

MD5
f45aa61e84d3af71fbe959d87243f3fe

SHA1
4448caeda18cddaf9f6f5dd4e5e698a684be47fe

SHA256
5ee95569e520460a48e9484548c92c2a0588eb38db20d9e47c8c6cba2a142239

SHA512
b47fda0969b49701ab3c3505f5effb7faae2ca4fbfedf6b2dbe648f669606eba4886005a1e90866f7d9a07ffe47ac7d282d47325686a4b9fc61069301494c8b9

Download Submit
/data/data/com.erciyuan.clock/files/init_c1.pid

Filesize
14B

MD5
7b41190324ac1eb57a1a70ba6c9203f5

SHA1
781c89c7b6790883bcdf6755210792d1b7f700ae

SHA256
e2e95e28ef45c3f7e5f60c584e473c2fb34353520f36f549edcce0759357cb49

SHA512
d092bd8ec1278436131b025257be6987d67c65808af627b6c2b905f473f0d7c48b562570211e9a5e92e22dcd48b7e1d88b4453454890c887c5dfabd2c201fee6

Download Submit
/data/data/com.erciyuan.clock/files/init_c1.pid

Filesize
14B

MD5
aa517e3b37897ea00a913198f6f53118

SHA1
b95fa80bb44051244179fe44c116e16f7fc7d128

SHA256
f4c3a3b29265db0c4c934be25518c5ce91b987d8c7ca0a1d8b26cfa748d81bc8

SHA512
6cc2c4e1fa89a4d8dd29e77a21d3c98ae90149e20d9910d6a81ed1e66bb382ae907fc96c5b7d89276215cac9501b22682e97126832073007710042225f0d703f

Download Submit
/data/data/com.erciyuan.clock/files/init_c1.pid

Filesize
14B

MD5
e1f7757e1e64fa2f13e8dd228fc97a54

SHA1
6de8591b448919b8e08c5c04772893184b453c63

SHA256
ce5e8d1bc93acd815a2e7adca71957e9140c6cafa2da362b25b1e8cd50a5490f

SHA512
2735382c4870702506429111a40b6d41cb5f131e07a0fc61a322b0af635ba3c483ae71c0a9d5c666e66d38a3261dcc79b11f7c4d6ca7059ec746cb6f5ef75cb3

Download Submit
/storage/emulated/0/libs/com.erciyuan.clock.bin

Filesize
68B

MD5
899e9cdd89702ac94132f4714178af8c

SHA1
a95b35ac65757688e41e62ec86fc56f13e0aa95f

SHA256
81d63a147265f25153ebd73a447ede4147ba02358b16504fd3a2bcda775a8c52

SHA512
1869ea4fa12b6eb1dde16dfe9ae2b6a563d6412d3408b771dd71aeb6b1e6ba83059eb492b7e634d1e52c87f7608a0366d59ac35fc007183cbb2c9e6c830a2c36

Download Submit
/storage/emulated/0/libs/com.erciyuan.clock.bin

Filesize
68B

MD5
272524dc9a579541e35831638641eb16

SHA1
35cf4ef056f05815b1ba8fe99d49a4b1e652710c

SHA256
16e493ef88256a349dfe079b28c8d08f9be381d55d1a19784db33753bf076e39

SHA512
cfd563a500dc504c01b11f4c7267ce26067c81bb990c57723f08816da1f31df9aef4e47cbe214ec8b39926cd953b4661b9490a56d05b155ece8f47f1da41671b

Download Submit
/storage/emulated/0/libs/com.erciyuan.clock.bin

Filesize
68B

MD5
a54859d1b6181d9d4543c371205b6452

SHA1
c9d92e402c6a2caaca9dcae81f9b28b5673d9e94

SHA256
f23e8cae5cdf4daf3d41f323f7872b2f6deef12113ec2835efe17a5e6ecdbb9e

SHA512
39e7c57e5316cbcf8f9f6143f02ed494994abdfe9a408afb0f1e4a09fd2f44fd7364b87a40018ff52c406f8f10b57812e992da5d4ba7c33090dbfa634022f6cc

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads