ae7af9201ea72feb3f5de4e362648556c47500a9b60efac2eab16ee5e12a5c32 | Triage

Analysis

max time kernel
47s
max time network
157s
platform
android_x86
resource
android-x86-arm-20240221-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240221-enlocale:en-usos:android-9-x86system
submitted
30/04/2024, 01:42

Sharing

Report Analysis Logs

General

Target

08bd824aac098a189d61be5374992e25_JaffaCakes118.apk
Size

12.1MB
MD5

08bd824aac098a189d61be5374992e25
SHA1

dbb8be38ab4f4a14551eb28f7210379faa7e3b63
SHA256

ae7af9201ea72feb3f5de4e362648556c47500a9b60efac2eab16ee5e12a5c32
SHA512

5916529a3db53bff99b2fc6925053ef8a5318bf6e4b5770c1faf7182377673b85e597e3c6ef9c403c83358bdbeea3828062012525579bd20ea8e3e89951793ba
SSDEEP

393216:qu835C7Pzp1a0gYB0zNjmw4eB8QD1Or0nYT:qu835C7PF1a/ceuQD1Ad

Score

8^/10

banker discovery impact

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

Process Discovery

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.sogou.activity.src

Checks if the internet connection is available 1 TTPs 1 IoCs

System Network Connections Discovery

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.sogou.activity.src

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Data Encrypted for Impact

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.sogou.activity.src

com.sogou.activity.src
1⤵
- Queries information about running processes on the device
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4183

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

Software Discovery

Security Software Discovery

System Network Connections Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.sogou.activity.src/databases/sogousearch.db

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.sogou.activity.src/databases/sogousearch.db-journal

Filesize
512B

MD5
8bc9ef2710f9ee84229659978739dfa2

SHA1
520bf3b73befcf8266cd796dab2ea1ed82cbdd96

SHA256
3bd57cca85eed82662cc090e04614abfad58113609250af547acc5f4e874aa5e

SHA512
c2169f9671e61987feb3d678439db4a1157ca4082269dc17ff01113cd1556312e1b9ae0623e462be1dd89f3c4b051d7dd48904504fec475bf5cb7691a084c142

Download Submit
/data/data/com.sogou.activity.src/databases/sogousearch.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.sogou.activity.src/databases/sogousearch.db-wal

Filesize
241KB

MD5
8554fd7d2e88d3061f4f536d9e90dfe0

SHA1
1942009dd67ea43be481deb04f659d2cb76a2deb

SHA256
31369b9c94077e6b321f776db23643e0bc6d48a7f43b87420042e7dd532f85a5

SHA512
2cbfd94ed206b9a01fe600acd6dfd778024b3d6e84074b8e45ca55f7ea487c1e949abf95582333ec19bc46721124ee1d2df40e566aa6348b0be023ff60f63998

Download Submit
/data/data/com.sogou.activity.src/files/.8a388bbbec3f4ba84ca33aac30be8894

Filesize
36B

MD5
1460fcd6b35396656ccfbdb259bcb650

SHA1
19ec3c0b8d72c413de9b0eec6d99d592125284a4

SHA256
8883778ccf67a50b26395002e3d691b4dc7b80ddb055861b15bce6deb56ab646

SHA512
aae7e0e5562c79f37a5031c2162bfefc5e6e674f84886a0cbe219abe0a8d25c4faa35d17e3c668cb898a322a92b0ba69ca8d438542a180a306270967836c3c1e

Download Submit
/data/data/com.sogou.activity.src/files/834f358240051014041_1

Filesize
354B

MD5
fad46f71d49015bdc627a526d2dd2c3f

SHA1
20cb6491a75522f0d3c381d7d60bcae20b93a784

SHA256
64e8ba3fefad35b8906dbf9ee90e5d6c6d8e2c80d0138a1af09fab9c06fe67db

SHA512
404ef3b348c6ae78f67d621dd44d7f44f0ca13c26b1a9b5777f69860214c9f8a89af04155acf5ef3cbdd780d6541db84748f92da144b0e5c13b288596811faf8

Download Submit
/data/data/com.sogou.activity.src/files/slow_conf

Filesize
320B

MD5
9eabe77bef32b32cdc168b87e24903ec

SHA1
54704cb458ed3ebc4d4c9aebd68c5d9e251a190e

SHA256
51e43a6c19994afa225826916a2ff0469794d6a1464dd1f64bd300c6c8ba1991

SHA512
9c69065e3b03ddfda29d314bea61691b47f8e508623cce3ff522511a9c8bde22ff9c53dfc0b34ec69f988db16fd478d025472ef5660a10dcf20a20a9769e21cf

Download Submit
/storage/emulated/0/SogouSearch/imgCache/journal.tmp

Filesize
31B

MD5
8c92de9ce46d41a22f3b20f77404cc1d

SHA1
8671a6dca00edb72be47363a7071be65cf270373

SHA256
68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274

SHA512
30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

Download Submit