b1762ed0158ac5d41434c9e184435c83aff2dd4290391147165f7669f32a208c

Analysis

max time kernel
144s
max time network
159s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
18-04-2024 21:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f8c7149da8e39c4e6970b0929184e923_JaffaCakes118.apk
Size

15.8MB
MD5

f8c7149da8e39c4e6970b0929184e923
SHA1

a3be4aada45073610de689033038b693a8dc6bd5
SHA256

b1762ed0158ac5d41434c9e184435c83aff2dd4290391147165f7669f32a208c
SHA512

06528d7cba1c0881d48aad65908f63d368d00c39cfe56ae2f6b11543c3502fd7979ed07e134514d5fce7a44f1476de9a9159f3176079554211c207ff37e77c51
SSDEEP

393216:JA96780t9wLNBrIPT8HB/frRvmB/OkwLlZuzuH1:6SPtSLPETYBJo/OkazuiV

Score

8^/10

banker collection discovery

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

T1418.001

Requests cell location 1 TTPs 2 IoCs

Uses Android APIs to to get current cell location.

collection discovery

T1430

Processes:

com.edate.appointmentcom.edate.appointment:pushservice

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.edate.appointment
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.edate.appointment:pushservice

Queries information about running processes on the device. 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

T1424

Processes:

com.edate.appointmentcom.edate.appointment:pushservice

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.edate.appointment
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.edate.appointment:pushservice

Queries information about the current Wi-Fi connection. 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

T1421

Processes:

com.edate.appointment

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.edate.appointment
Acquires the wake lock 1 IoCs

Processes:

com.edate.appointment:pushservice

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.edate.appointment:pushservice
Reads information about phone network operator. 1 TTPs
discovery

T1422

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.edate.appointment

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.edate.appointment:pushservice

Uses Crypto APIs (Might try to encrypt user data) 2 IoCs

Processes:

com.edate.appointmentcom.edate.appointment:pushservice

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.edate.appointment
Framework API call	javax.crypto.Cipher.doFinal	com.edate.appointment:pushservice

com.edate.appointment
1⤵
- Requests cell location
- Queries information about running processes on the device.
- Queries information about the current Wi-Fi connection.
- Uses Crypto APIs (Might try to encrypt user data)
PID:4190

com.edate.appointment:pushservice
1⤵
- Requests cell location
- Queries information about running processes on the device.
- Acquires the wake lock
- Uses Crypto APIs (Might try to encrypt user data)
PID:4225

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.edate.appointment/databases/appointment_account.db
Filesize
20KB

MD5
2567c75623ca0d68b1fc93b4701c2d03

SHA1
84b6adf43d863c0c3f95214472849a71570736b6

SHA256
f3f4d804f8546fb69069392c7dc64db9e52aa62537a82f8c2825ad2935e73285

SHA512
8a419136d7916eea176ee81747c0ff560454b346f36f340de714ae2d94ba7dc25667aae4cd59324694a4f6d3af85f118598496337dd18c98dc4542a561edccc8

Download Submit
/data/data/com.edate.appointment/databases/appointment_account.db-journal
Filesize
512B

MD5
22d861ca15e491f5fb5e055f5d6b756a

SHA1
ae65c3ceca877e68d9c9c810d95d5c75cb30a1f7

SHA256
24258c4abdd7ee117c77970bbd1c62295fa509bc7a6dcbc641dd1e013bad113a

SHA512
99e7842ba4d0a7030b33293d4328b77b312f71685cddca16b224041da63a3c89782ee411b1a62e286c3b4449064f8e760d694a9141ca8d45376a194891ff2e4b

Download Submit
/data/data/com.edate.appointment/databases/appointment_account.db-shm
Filesize
32KB

MD5
38317bb61bdf3fe01c1c0569ac35835c

SHA1
aae56e8f54117fcceea1ca4c1196c43a526c2f4a

SHA256
67a0c0ec4c0f21f14cc7515e15695794f55b436a8929f138d4a78ae7c0a3cd25

SHA512
5503da5334132faeafba2ee0bebc5b7ecae73b4148cf0bde5ddf4a7429fd21dd6bef0c440851796109dcda9ce4fbec8119c6c34e7a7a56fad7b93713f907a69a

Download Submit
/data/data/com.edate.appointment/databases/appointment_account.db-wal
Filesize
32KB

MD5
4c6b5c7de8239fab7a03b73392bfe3e8

SHA1
79d7d572137f03c02b5fa709e5ac5e2691acc0a1

SHA256
6c3754cdfa4f74246db43806258559aea65a4be37e244f32c527f78e2d5f5251

SHA512
73e9f94224c5f59666b854d841cccaaafafac262f9edd9cbf95b28e6175069a5ec7db9c1d831a9be93ca7555c6c4bd29b7c4d96bed340d114fc902b693699326

Download Submit
/data/data/com.edate.appointment/databases/com_xiaotian_framework_model_ContentProvider_UncatchedException.db
Filesize
4KB

MD5
6b138aeac6b3183b5edb02344c982e48

SHA1
305f6ef3b8d786be2ce0bf3d35b1526029c209cc

SHA256
150179402fb266aabce07f268cc21deee793423579ec1d054140333b1926de45

SHA512
a4c482c95cc45fb1c29d21bf9ecddedfd0869f821ab277cc7ca7ecd3ed999986a928a1711d62940a9bbb1f4e755cf464f9c25b177c10ab3163d3b302a6642da1

Download Submit
/data/data/com.edate.appointment/databases/com_xiaotian_framework_model_ContentProvider_UncatchedException.db-journal
Filesize
512B

MD5
b2ef10205298a0f009e6ec0e712a4346

SHA1
e015a66471f17c6afcdaf2fc46ac99d638c113af

SHA256
d59a01f52d3aec24cc5b847eeee4c824c491d882d06b6b8f0b2e840f8a33e843

SHA512
95b19e03d12ee5c9d10902e2ed4739af9af039aba0b566398e6179c3e9ca8ad2c6c8037bd32530eb9a664a459bcbddd069bbbeaea9748336f9ee16da7ee040a4

Download Submit
/data/data/com.edate.appointment/databases/com_xiaotian_framework_model_ContentProvider_UncatchedException.db-shm
Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.edate.appointment/databases/com_xiaotian_framework_model_ContentProvider_UncatchedException.db-wal
Filesize
32KB

MD5
1ed323e93cff80e3d1ebedbca1d41d4d

SHA1
f07b6b1c16a96b37b043bc4c06159a275c426123

SHA256
988495f96178e1a15fc1e2664f9bcca1f11a52b35cdd4da2ed46c6112728e872

SHA512
0005563e432ca48662994062fe8c5cf9cc6a3e9b78b44fd9ed863a4a2bdb9c821de1607fc71e8b0e48b5d88fdd0376a30fe6041327781ba8bdbb4ebdc43ebd0a

Download Submit
/data/data/com.edate.appointment/databases/pushsdk.db
Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.edate.appointment/databases/pushsdk.db-shm
Filesize
32KB

MD5
3be3fa867cc57e4fa2f521e6870db989

SHA1
5aefedea563ead726486a5335dc7e81d1da59311

SHA256
7587dec3362dd9ff4d3eddc8f74f5ff349c0432afdc0437d86cd73d5c755c693

SHA512
b663759f4596fc09325734080febd27965f44161d2dd62d27e925270f61c40487b5035fe76d156a26413115c1d9fb0690735de17a11470a3a37d4974afbd11b9

Download Submit
/data/data/com.edate.appointment/databases/pushsdk.db-wal
Filesize
92KB

MD5
d3f14b7603405afcb82841676667632e

SHA1
b04f6d31a92398d087ea77741e2af4c599c1c561

SHA256
fc2e3b7b79743faf3d98fdd1be35627832144e252e44c194c4b2f6c3350f7725

SHA512
89cfb86c38436f7b543d06d9157fc262ba5876e26fe3df9c7f5faea41c98394cfc7f041583ee188fac2d40e695fa860fe0704b3d0ee1f123e3a64c5f1a3fcf70

Download Submit
/storage/emulated/0/baidu/.cuid
Filesize
512B

MD5
9fa2a59174b2ce11a87d185cfba98921

SHA1
6a2cedb333432e946899d7d4d342351a8ffcf713

SHA256
738535992a99d6e273b255e61c1aa63192f631743f62cc5365f899e1f555de3d

SHA512
c9388f205d10f7b2ecdbcc10ccd4c99b636025db5f27072890fece28c6b80eb0ff164fac46d2bd4064d6b2f79b52715ff4e507e9a63df82d21a231a06e97fb61

Download Submit