Analysis
-
max time kernel
129s -
max time network
159s -
platform
android_x86 -
resource
android-x86-arm-20240221-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system -
submitted
18-04-2024 21:13
Static task
static1
Behavioral task
behavioral1
Sample
f8c29f4ca46c282780e660d968bbf520_JaffaCakes118.apk
Resource
android-x86-arm-20240221-en
Behavioral task
behavioral2
Sample
f8c29f4ca46c282780e660d968bbf520_JaffaCakes118.apk
Resource
android-x64-20240221-en
General
-
Target
f8c29f4ca46c282780e660d968bbf520_JaffaCakes118.apk
-
Size
15.4MB
-
MD5
f8c29f4ca46c282780e660d968bbf520
-
SHA1
a47817f2338e2c7a26702b77fffcb8f1faf0f029
-
SHA256
a998555789ea41c5abff509bca2d8a55c9061bdf4117ada90315abe88a37989d
-
SHA512
5461d5fffd34083b557d45dbe48d61e453ee7f9c52ea1a19cda597a476edfff72cafb5e687498228efa0ccde31c35811cdf8ad382f149f61f24f41ae43ff60b5
-
SSDEEP
393216:QxZJYdOCFLJF6DOOzeNWt8fq4wnfXI/SXAlXwzj6tFuE2yuyg:s3qzOzekKqJfXDXAliU0z1
Malware Config
Signatures
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Requests cell location 1 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
Processes:
com.yueren.pyyxdescription ioc process Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.yueren.pyyx -
Queries information about running processes on the device. 1 TTPs 3 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
Processes:
com.yueren.pyyx:corecom.yueren.pyyx:corecom.yueren.pyyxdescription ioc process Framework service call android.app.IActivityManager.getRunningAppProcesses com.yueren.pyyx:core Framework service call android.app.IActivityManager.getRunningAppProcesses com.yueren.pyyx:core Framework service call android.app.IActivityManager.getRunningAppProcesses com.yueren.pyyx -
Queries information about the current Wi-Fi connection. 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
Processes:
com.yueren.pyyxdescription ioc process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.yueren.pyyx -
Queries information about the current nearby Wi-Fi networks. 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
Processes:
com.yueren.pyyxdescription ioc process Framework service call android.net.wifi.IWifiManager.getScanResults com.yueren.pyyx -
Reads the contacts stored on the device. 1 TTPs 1 IoCs
Processes:
com.yueren.pyyxdescription ioc process URI accessed for read content://com.android.contacts/raw_contacts com.yueren.pyyx -
Reads information about phone network operator. 1 TTPs
-
Uses Crypto APIs (Might try to encrypt user data) 1 IoCs
Processes:
com.yueren.pyyxdescription ioc process Framework API call javax.crypto.Cipher.doFinal com.yueren.pyyx
Processes
-
com.yueren.pyyx1⤵
- Requests cell location
- Queries information about running processes on the device.
- Queries information about the current Wi-Fi connection.
- Queries information about the current nearby Wi-Fi networks.
- Reads the contacts stored on the device.
- Uses Crypto APIs (Might try to encrypt user data)
-
com.yueren.pyyx:core1⤵
- Queries information about running processes on the device.
-
com.yueren.pyyx:core1⤵
- Queries information about running processes on the device.
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.yueren.pyyx/databases/dynamicamapfile.dbFilesize
20KB
MD5d5950b4302984c62ae015c70f8359000
SHA144de2b51c2942afc6706cfd591bd17e0b22732a2
SHA256b25855280d949ff775756116e72d78ac73561352dfa33866835ccd355d037f9d
SHA51239c732e681ba5913a12d78056a128a2f7a2cf3b78f5735727e629b15bd5f498ea22ca1bee6bd0c7580c2443cc08e4416c454679bf52ca34fb91366f6374b334c
-
/data/data/com.yueren.pyyx/databases/dynamicamapfile.db-journalFilesize
512B
MD548890d71f497e77766d87909be28acb4
SHA1fc129a1296f08babc5ee8512be1e9c4453db6048
SHA25638fe6eb91c863e86d98965fd50ab8d92f18b85bf00653ed4fd5e158090bf00cb
SHA5120d7c5e2b96ff394c43949071f652959b7b2644be3780016557c28939e1751bcd7a93f2fd6625ce9a235f6c6339105aba89e8fcecb58a3f31a3ca7f4930d7ed9b
-
/data/data/com.yueren.pyyx/databases/dynamicamapfile.db-walFilesize
32KB
MD55def54c218374de244cc8899431c7ccd
SHA118570b8c449aabcc708fd13e3380c0bf37b087f8
SHA256ee3092a89cf0b6024b304cce2f6b2e32006453d7ecb8d08a3f007e5905f0ee7b
SHA5121d0b62c6254e607bf0a9e78bee4fda4dfc62c165364fe5bddb200d37c748b4b030d8491fb9f3c6e42cdba2e38ccfcabb2d8365a8d7ddf2c717fd42abd54f07dd
-
/data/data/com.yueren.pyyx/databases/hmdbFilesize
12KB
MD53fe30614d7e0d11db870b4624f6c50e0
SHA1053ff0fc621ab40f2afeddb3e7b4a73ee41ec533
SHA25667c532f0324228dd33b445cd399c1426e3a0e0cdc7b9358c66b402c5d40a838d
SHA512c7c09e97a408e88aacaf8099ad4d1fa604d58113393500a384eb3c2eb7c3c105af41314934b86eca2f088045cbab5a20d768bbb295448dc1ae6cb6c3f59821ae
-
/data/data/com.yueren.pyyx/databases/hmdb-journalFilesize
512B
MD5d896f0c4f9f48a30e81f0a91be406488
SHA11a6c29047284af88417e79911e167ffb56c4cbad
SHA256e5f5cc4f191fe0cc4641d22c649a81a0014653d422494cc7bfa8c5033113bfe2
SHA512ac817279556a60381ecc9170fbc1c68af3f1c46d9ed99b0c2feb7685f0a9cd877ad8cb4bd254eab25147246ac7441bdc924c0c959ce7e81dc3651c4340973445
-
/data/data/com.yueren.pyyx/databases/hmdb-walFilesize
16KB
MD50676a30d64237d170b58f0e354b892ab
SHA17a5b47977f8e79ab5ebb1e514977e4a27ada6c3c
SHA25625dbab4401b460d04e04a8fd694364676f71539b354a559e93143ed5fe34ab21
SHA5128fb5342afa07915ee690125495cd3367a8c329655dbbf5088d12221b7fbdc635f353546457ada0cd68b5dccc795316ac60117bdbac841285e4b421b1aeed669c
-
/data/data/com.yueren.pyyx/databases/pyyx-dbFilesize
4KB
MD58645ef970ff4a2f465a0df7112deafc2
SHA1e34ed1f3ac1e4d349dce3ebe3710c4a410d66a7b
SHA25677f3b700f6d39209f340af2e7d9010397bc4dcf0fb3d87b366535c3ef6e466bf
SHA5122363aae80738d1917719e39ac2aaec23d2084a8667f3a042423de43c5461976a94210969655083794c232f3039eb509cb92978bcd7abc14da9d5d0a865a76813
-
/data/data/com.yueren.pyyx/databases/pyyx-db-journalFilesize
512B
MD5214bfbce7fc117e87c52387adbd1700b
SHA1f5e50adab55b3b9bdb0ed1bddbeefa0e6acd1886
SHA256bf87783db5a88c6d3512812f3766562042468e31d1732b0e81630fa4d4ac5600
SHA512b3863ab325377b1a3d905d5bd5582f70bac9f0565b89f55f8d3c9595e8facf1a0d56a498fab87d6cf419cc05922c60073dde8495137056d7705a6e0196a67dd6
-
/data/data/com.yueren.pyyx/databases/pyyx-db-shmFilesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
/data/data/com.yueren.pyyx/databases/pyyx-db-walFilesize
201KB
MD58b6fab371d392d85f09825bd3ceb6c6a
SHA12525dc1dacc16d59bfa17124098065ac981377b5
SHA256d46ebafae961c253d569a213c66beaac51a74124e3f3c90f72d926aa83e86fff
SHA5120d42974643e2f1a2509ae7d29b20ec8ae75103a162edeb08bc75ee3abf21580a0e1954b8cfd2ccc3396847fd4f6ec06c8580b5e398d0de4caa0b5261907aff29
-
/data/data/com.yueren.pyyx/databases/zhugeFilesize
24KB
MD5fb614251d47d412248fc0cf093f1462f
SHA11023a65b176c4345559a7d03dd0184aefbf72e28
SHA256935fb602b8db3a622a41c706f7c410c2ad41f9105eafef76b8bb7c53828bae58
SHA5126d62de8d12c2dc0627e8801e4eef3c9e17843e5d11bff77c998591137eea289fe5d7fc841f74bb2a046b031053e72b48d5488d1bd9b0409958b821913b1ee823
-
/data/data/com.yueren.pyyx/databases/zhugeFilesize
24KB
MD517712e618ad36e916aaa205155a063d7
SHA12ba4b4c26c9b7aa867eb0a45c3c2da8e373ebbdd
SHA25600fec29495532f0e4b3f33e3880007297815d5354d6bb5650fe8a54d8648186c
SHA512b1fb00ebea54b4409b7547bc99febfffa6bff71a1f47f0ed831a2b9a09be76efc49f67b20036530b8d425f4923b306d3710a73778297fd0e0595e8d7f5b4b899
-
/data/data/com.yueren.pyyx/databases/zhugeFilesize
24KB
MD5ec5e9223c7d8859ce29db41d6c935e30
SHA1fc6bea724e0035fa908cff735ecab1e0acd69d53
SHA256d4741368d795e128665b876508a39fa18800b7b7a7f5819447443d17ca240e68
SHA5125b3a1cf729515577a545a0d9a8edb9babb557b02c4c505a084b4128174c3ef1c8e704618f17e8d67ffdca9711def53d40dce30479a38e12394cef62cefd2525e
-
/data/data/com.yueren.pyyx/databases/zhugeFilesize
24KB
MD512cc918d67d5e458e92898724a921b77
SHA1a568e98cdc717b570a95807407ffbf4e06398fc1
SHA256881dd8ad0de739cdab69d1e49b66bf6b5454f6e2531e0c09679177ec56bdd4d6
SHA51288e97ff4909496b07a10606a514aea9c208eadaac389a87b537f1a14e1a9fc6cde71ce1bef5809d592e11c2936c0fe3fdd38bbd8e3637a590d12ad802c13f172
-
/data/data/com.yueren.pyyx/databases/zhuge-journalFilesize
512B
MD5da84b42eea774e38ab3a0d98d6340460
SHA13e14d24e1e890f56c79ea4037b9f6171c2f2b684
SHA256e4bacc3176c412766f6865619eb3da5b3d359e45f6c4260d2b4ce1d92170dba9
SHA51288c1f8b218a785b6bac1d21c75d28589dab8118e55e33b5b0ff28eaa105512433918b362130f39213e5c9a033e44314156c7c540d2871b5960e8854f51891a2c
-
/data/data/com.yueren.pyyx/databases/zhuge-walFilesize
48KB
MD53f70397c11ec6fca6dba7652254c671b
SHA1dd44bab7a82990a23cf41b7c583f4c703361e55f
SHA2567d0c68d6744ecabf676457e334a90fdaffb998cf475aba62a6b52a2cf511f469
SHA51230c5cff508046adc37a5a9fb7bc56b9bfda1c736ac7749686370bfaacf16df7bbd32933d5fee45a7765ca7aae8047397ecee6dc9bb3c40e5803a1def0d53185b
-
/data/data/com.yueren.pyyx/databases/zhuge-walFilesize
12KB
MD55bdac6aa2f731a81cf47b8d568e0dd0b
SHA135ed2d699ad1a283d05e68d31369bb25d9407dfc
SHA25696aac8edd128090b51143361ad7f995d6d17f72f2feb82fa5cb48da9ea157f83
SHA5128904482ab1126e60f1d7d14dbcc8453976128fc25a036fcd9bd14da622caeaefb875f1392cbc6fc25d42df9aa3e092c92998150edf4e595b48e8211e347c4e17
-
/data/data/com.yueren.pyyx/databases/zhuge-walFilesize
12KB
MD525dbb3bae97a474cdad9dee595afe44a
SHA1c878252096e7b8c2a78ddb559fe388205a4dcceb
SHA256a36e2b29351e323fbf0db6c966d20dd3caf642bc785257187800223f936b9777
SHA5127ac29b0c7a59f5e31980ab2d80fe1862be035085cb8fb653ecdeee7d35f499372eb4f652dd34fc20bba5974f0e849e4ab003f755450787ef2d0a208a1cb75120
-
/data/data/com.yueren.pyyx/databases/zhuge-walFilesize
12KB
MD5797e80268d1c8544a6dbb50a98c38efc
SHA1412c4d17ac96387f4d9ada16c60065696cae68e1
SHA2567ea1a4409253a18898608a277cd41cc8b7cccfb71c301f2b5594df92039ac972
SHA512957ff2c35b259f3fdc1ba70efbbc77db1ecf462247a18cc77fca688ce3b30cc918bd015f9014ae5f0b63dede8ac02a8104e3f50e5f7b87c108112e39d3f94cd6
-
/storage/emulated/0/Android/data/com.yueren.pyyx/cache/uil-images/journal.tmpFilesize
31B
MD58c92de9ce46d41a22f3b20f77404cc1d
SHA18671a6dca00edb72be47363a7071be65cf270373
SHA25668bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
SHA51230f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56
-
/storage/emulated/0/com.yueren.pyyx/nim/log/nim_sdk.logFilesize
135B
MD5089ca2ad4f8bed34b4f241f82682561a
SHA1c7e541fa626038a36994753086d39b924063b727
SHA2560b8aac7272adbeb1c631678f9865f03f68a7fede5faad4c8943604b98dcea5d3
SHA5120c5e7232d7f71c43fee1cc48150d9cac99c8497d14b154dcc5443f97364336620cb35d5998884df3f76bb086f2363e219a469c83e9e0464e7331dd2137f70c9b
-
/storage/emulated/0/com.yueren.pyyx/nim/log/nim_sdk.logFilesize
130B
MD5e83a05acbac50fe6cfd3ea56d176696b
SHA125bf8fa9c3bcc81dd3865e8b47140f96b61dd7d4
SHA25626b78ea87d64669c4adfd434a1faef22825430d9ba49fdb4d3144dbe7dc28ca3
SHA512693d4842216cc24d1130afa29ea267490d8aeb5e41d855428ce79685aba861b96ee84e57079e93250a91d948f5df9d30fb03b766a357c06ba48722fe7d2d7ef2
-
/storage/emulated/0/com.yueren.pyyx/nim/log/nim_sdk.logFilesize
79B
MD5bd43dd0ecd787d5fcf041d9785fe1c99
SHA12538b5df6a9e3164f047c35a483ee6f18b9634d8
SHA256e9e34fde4d66439711581830663cb6228e25c09c831c78e54d2d383de9a51c00
SHA5125eb095e4d1e776fdf089f424e63dca2b0ee3bc5d28985fb9d44f22433645c71c03ea232bbe3af9fca65f7dbf9d8e7ef541611b75a4649aab54b97109c5732beb
-
/storage/emulated/0/com.yueren.pyyx/nim/log/nim_sdk.logFilesize
93B
MD569d0db70d4570dd1fb7769c7b8521713
SHA1297b8c4f820e88366906ec7900d501853b1253fe
SHA256c19fad821f117979fb7d0f53b6d858536fa81df4860f63c54b4ab2664017c8fd
SHA512d40859ad70bdab6d2f19ebbc8d343d510f43e933d6390a21ec4ad08c1ab84b3b78d955131ea08adce7b7a142957bf8e026ce7aa03a58d6c3677ad3b0a871959d
-
/storage/emulated/0/com.yueren.pyyx/nim/log/nim_sdk.logFilesize
133B
MD53c2e584d4ab329a3e5014da75b88606d
SHA13f19246f108a3a4e109826da742a213f492e71b9
SHA256321b25cc8117a26e485fc5a3b3f5e9afb27ac43ca0272385b129ed88d8121fb2
SHA512e3be56deef51398457e7148c4b2de825860aa879fca7b7fedb8a42d5fc5a990b1c02cc4c61be22c12a4c8dba0fc12201fe3669e50962ca1012efe49f4d4bbaf2
-
/storage/emulated/0/com.yueren.pyyx/nim/log/nim_sdk.logFilesize
136B
MD5e66b993579e295edafa55ccf28d11bef
SHA1a4bed869111e805200758f35c011f5ea361000f3
SHA2563161493f7686a637182fa49a8396ea641a98a55847bc01867d46939c52c08f7d
SHA5121e34655e12bcb614697943ef190682eaab0b8b2bc0bf1b2d082c0877e4ec032605b24131857c27b052f68ddb74aafce58f69052342972803fb1d55ec5857667d
-
/storage/emulated/0/com.yueren.pyyx/nim/log/nim_sdk.logFilesize
118B
MD5e032d56214d8b25ffed7616104635e44
SHA1611cc7ef7fb18059f49fc2e17f2f701166b64bf1
SHA2561e946bc90260aafabae3b4268ee443421ae9989af1ad0c04f2f7acd9311cd941
SHA512c365ecac18d551ef31ad6479b74c2a229114410b38f11d8d60e34a0be87bec24126109b87656cd2bdf5f661b2abbdc4cb1c53cf7b95688e54dfe4f1d5749e8cb