94cf641f1400820ff6bfb46664a67b534bc1eaff2ab39b122f0bda905f9cd67d

Analysis

max time kernel
64s
max time network
163s
platform
android_x64
resource
android-x64-arm64-20240221-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
submitted
18-04-2024 01:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f70239e7e7c7559e313c009f31702125_JaffaCakes118.apk
Size

8.2MB
MD5

f70239e7e7c7559e313c009f31702125
SHA1

fe7e7cce84f1fe9237d7a2e947b3f100e0ef7dd5
SHA256

94cf641f1400820ff6bfb46664a67b534bc1eaff2ab39b122f0bda905f9cd67d
SHA512

2dcc0c94839a816b8276cf62364903d14004d4295b9d7bc03c2ffff778b56fed1dc83326a6fb5300910d6f393747304c9e54eb6fc522cd04803e13391f72d764
SSDEEP

196608:5za45ORGg4ysB1P5nKeyvnVm3LY9lhVaMQ0FJ4m:Fa45gGesB1PgvnVWLY9X34m

Score

8^/10

collection discovery evasion

Malware Config

Signatures

Requests cell location 1 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
collection discovery

Location Tracking
T1430

Processes:

com.zhiqupk.root

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.zhiqupk.root
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.zhiqupk.root

description ioc process

File opened for read /proc/cpuinfo com.zhiqupk.root
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
evasion

Download New Code at Runtime
T1407

Processes:

com.zhiqupk.root

ioc pid process

/data/user/0/com.zhiqupk.root/files/__pasys_remote_banner.jar 4589 com.zhiqupk.root
Queries information about the current Wi-Fi connection. 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

System Network Connections Discovery
T1421

Processes:

com.zhiqupk.root

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.zhiqupk.root
Queries information about the current nearby Wi-Fi networks. 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
discovery

System Network Connections Discovery
T1421

Processes:

com.zhiqupk.root

description ioc process

Framework service call android.net.wifi.IWifiManager.getScanResults com.zhiqupk.root
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.zhiqupk.root

description	ioc	process
File opened for read	/proc/cpuinfo	com.zhiqupk.root

ioc	pid	process
/data/user/0/com.zhiqupk.root/files/__pasys_remote_banner.jar	4589	com.zhiqupk.root

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.zhiqupk.root

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.zhiqupk.root

com.zhiqupk.root
1⤵
- Requests cell location
- Checks CPU information
- Loads dropped Dex/Jar
- Queries information about the current Wi-Fi connection.
- Queries information about the current nearby Wi-Fi networks.
PID:4589

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.zhiqupk.root/files/.um/um_cache_1713404307345.env

Filesize
551B

MD5
5fe3d8d55394338412bbd542f439105f

SHA1
a8037119a695de3d9c91751a187b4eafdac06558

SHA256
a2b9e73b31eef8992c36f4a87009106e8d1aec3b9b2547bc844aa2325bd2d5e4

SHA512
1e446778a64126c190dfe935368c81e94fbce918f854aa82542e1828065f92ab2f83b8be82256f856561b37c88498711a1e876dc4c49915f2d79670bcf47eebf

Download Submit
/data/user/0/com.zhiqupk.root/files/__pasys_remote_banner.jar

Filesize
231KB

MD5
c601107d24f96646ae86f74b0fea880c

SHA1
8a8ce84fe5b6e186ddcd69c8757de4fb1aae7ed1

SHA256
939120d702d97dc47c6963d98dc1d2694e0fae5f5d5199c0755f54741a3c2a16

SHA512
b573a0d74ea8c6e99c3ebad4ac7b42ce46940231f8a90c9b19c887c6c20356235241068d187aab2bae9914c3df84cbe80bca13b5b6d070247353f5e5eb282f33

Download Submit
/data/user/0/com.zhiqupk.root/files/__pasys_remote_banner.tmp.jar

Filesize
114KB

MD5
2ad9fb4b2d9b333883b7e38f61c2fd2f

SHA1
5b85041452d173ed0d81d25b9ca78608a998e328

SHA256
b9310a99f1b60959f6b725eea74623dc491adec55da740c17e8c7e02f35818f5

SHA512
6fc04e1e22ebf8920b4928a8086cf3e0814d155f79f80d71622916f6a0911262382710e5ee2acea653db4b387730e201134592cb9992b14f3aef8b09d83bda90

Download Submit
/data/user/0/com.zhiqupk.root/files/umeng_it.cache

Filesize
245B

MD5
390af5e673ff33c61ce98ff6267c0cc2

SHA1
b658a902e0d814a9c82df95dbc72b5c33ca6d737

SHA256
bcdf167943ee70645a09a12e857335c0161e1a9eab9ef42511321500f0f97ce8

SHA512
d0d69cea6e1113e7690c62162552d78bce7c4ffaff9e35de6bce909a01f88f7b30f394fca4c30b42449f58734b85da794c4b999cd3da7968c7b4e0cd5804db82

Download Submit