Analysis
-
max time kernel
64s -
max time network
163s -
platform
android_x64 -
resource
android-x64-arm64-20240221-en -
resource tags
-
submitted
18-04-2024 01:36
General
-
Target
f70239e7e7c7559e313c009f31702125_JaffaCakes118.apk
-
Size
8.2MB
-
MD5
f70239e7e7c7559e313c009f31702125
-
SHA1
fe7e7cce84f1fe9237d7a2e947b3f100e0ef7dd5
-
SHA256
94cf641f1400820ff6bfb46664a67b534bc1eaff2ab39b122f0bda905f9cd67d
-
SHA512
2dcc0c94839a816b8276cf62364903d14004d4295b9d7bc03c2ffff778b56fed1dc83326a6fb5300910d6f393747304c9e54eb6fc522cd04803e13391f72d764
-
SSDEEP
196608:5za45ORGg4ysB1P5nKeyvnVm3LY9lhVaMQ0FJ4m:Fa45gGesB1PgvnVWLY9X34m
Malware Config
Signatures
-
Requests cell location 1 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Queries information about the current Wi-Fi connection. 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries information about the current nearby Wi-Fi networks. 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
-
Reads information about phone network operator. 1 TTPs
Processes
-
com.zhiqupk.root1⤵
- Requests cell location
- Checks CPU information
- Loads dropped Dex/Jar
- Queries information about the current Wi-Fi connection.
- Queries information about the current nearby Wi-Fi networks.
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/user/0/com.zhiqupk.root/files/.um/um_cache_1713404307345.envFilesize
551B
MD55fe3d8d55394338412bbd542f439105f
SHA1a8037119a695de3d9c91751a187b4eafdac06558
SHA256a2b9e73b31eef8992c36f4a87009106e8d1aec3b9b2547bc844aa2325bd2d5e4
SHA5121e446778a64126c190dfe935368c81e94fbce918f854aa82542e1828065f92ab2f83b8be82256f856561b37c88498711a1e876dc4c49915f2d79670bcf47eebf
-
/data/user/0/com.zhiqupk.root/files/__pasys_remote_banner.jarFilesize
231KB
MD5c601107d24f96646ae86f74b0fea880c
SHA18a8ce84fe5b6e186ddcd69c8757de4fb1aae7ed1
SHA256939120d702d97dc47c6963d98dc1d2694e0fae5f5d5199c0755f54741a3c2a16
SHA512b573a0d74ea8c6e99c3ebad4ac7b42ce46940231f8a90c9b19c887c6c20356235241068d187aab2bae9914c3df84cbe80bca13b5b6d070247353f5e5eb282f33
-
/data/user/0/com.zhiqupk.root/files/__pasys_remote_banner.tmp.jarFilesize
114KB
MD52ad9fb4b2d9b333883b7e38f61c2fd2f
SHA15b85041452d173ed0d81d25b9ca78608a998e328
SHA256b9310a99f1b60959f6b725eea74623dc491adec55da740c17e8c7e02f35818f5
SHA5126fc04e1e22ebf8920b4928a8086cf3e0814d155f79f80d71622916f6a0911262382710e5ee2acea653db4b387730e201134592cb9992b14f3aef8b09d83bda90
-
/data/user/0/com.zhiqupk.root/files/umeng_it.cacheFilesize
245B
MD5390af5e673ff33c61ce98ff6267c0cc2
SHA1b658a902e0d814a9c82df95dbc72b5c33ca6d737
SHA256bcdf167943ee70645a09a12e857335c0161e1a9eab9ef42511321500f0f97ce8
SHA512d0d69cea6e1113e7690c62162552d78bce7c4ffaff9e35de6bce909a01f88f7b30f394fca4c30b42449f58734b85da794c4b999cd3da7968c7b4e0cd5804db82