31887151bfa0364eeee63c08368ae4a5d6d57bfadda6cb8ef66b9272b678bdae

Analysis

max time kernel
87s
max time network
156s
platform
android_x64
resource
android-x64-20240221-en
resource tags

androidarch:x64arch:x86image:android-x64-20240221-enlocale:en-usos:android-10-x64system
submitted
20/04/2024, 17:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd45eb3ef38e6ac904d1bf70e143b2de_JaffaCakes118.apk
Size

4.4MB
MD5

fd45eb3ef38e6ac904d1bf70e143b2de
SHA1

aa1041e379581405d5f8cb5d29b89d479d7f6786
SHA256

31887151bfa0364eeee63c08368ae4a5d6d57bfadda6cb8ef66b9272b678bdae
SHA512

51527f2367a2bc5da43f609de48d2ba7ee291cb6221fb87d27622029ee2296a3a57935881b1b8289a7760479c667ce99cf1a1f08c39f472948d222110165e876
SSDEEP

98304:flH+PXIKbgD8y0Um2yjnAUrDkjYWgWqz0qxmTddhDfOhqsOD3M:NH+/AD8ULKADHK0qxmnYhqsV

Score

7^/10

discovery evasion persistence

Malware Config

Signatures

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.cutt.zhiyue.android.app220006

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.cutt.zhiyue.android.app220006

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.cutt.zhiyue.android.app220006

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.cutt.zhiyue.android.app220006

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.cutt.zhiyue.android.app220006
1⤵
- Checks CPU information
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:5023

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.cutt.zhiyue.android.app220006/files/mobclick_agent_cached_com.cutt.zhiyue.android.app220006

Filesize
674B

MD5
22b188103aeca844d70e689d385ead16

SHA1
c92c496db2bb1149510311841726e92a09aa6342

SHA256
2c0e6bae7984014d1e9c43e0cf01edae785a4b4e669376cf02d06accb44844d3

SHA512
60d8a3fa84f599d1e5bca1da3ec31ca68af643a34cd0a565c57905d967fef84244abceb76f393f78dce09b8729b4891ace91eb95187897b1ab539135e7b8a77c

Download Submit
/storage/emulated/0/cutt/com.cutt.zhiyue.android.app220006/log/1713634821991

Filesize
7B

MD5
c0cad13d8864ce1dffa4bf456bbd8277

SHA1
e28e8cb382e7f3abf845af812f5d8746bf069df6

SHA256
f3160fb34a985e4808ba283833a0bf69be404d2d94dadb06aff997709e42dbcf

SHA512
19cac13e590d1bd84fb8bb138cd0f7459e8064a569cb9b133be684660525906045308082e2e759f2a115cecc8c07519c8c1434df3fba941be66bfdb79724b971

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads