9fd5ed7806f3b54725644a59e24d2d17109f513312d85b8317f479065bf03e9f

Analysis

max time kernel
130s
max time network
160s
platform
android_x64
resource
android-x64-arm64-20240221-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240221-enlocale:en-usos:android-11-x64system
submitted
02/05/2024, 05:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d9743ac20f19e0f7bc9758e098e84e7_JaffaCakes118.apk
Size

6.3MB
MD5

0d9743ac20f19e0f7bc9758e098e84e7
SHA1

a0dcc88867182a3e797ae79f2bc23ac8b404dda1
SHA256

9fd5ed7806f3b54725644a59e24d2d17109f513312d85b8317f479065bf03e9f
SHA512

24f21fa91b120e9d803d537c0670f0f2d9614526fe6944aedc9b88ef6e08438cdf99539f1df4af9119e6872e3713d41a35aacab4f0af12e32f17819eca653be3
SSDEEP

196608:VbJIeGGrCetOl3t09MepmBdD1aUhdaOtZSceGDv/cw2spbQb2bRfh3:Vbfw3wMepmBdD1aUhdaOLrj/sgsibRf1

Score

7^/10

discovery evasion impact

Malware Config

Signatures

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.wenhua.dingjintouzi

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.wenhua.dingjintouzi

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.wenhua.dingjintouzi

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.wenhua.dingjintouzi

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.wenhua.dingjintouzi

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.wenhua.dingjintouzi

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.wenhua.dingjintouzi

com.wenhua.dingjintouzi
1⤵
- Checks CPU information
- Checks memory information
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4596

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.wenhua.dingjintouzi/files/New_Fszsex.json

Filesize
649KB

MD5
4ba7c1a2581b5aa38fc4696909951ee3

SHA1
ec511ce50dca418b3db6aa24cdcbc4ce7960c853

SHA256
91291b0df43c41ed2d35b5842f9b4fb479c21285a9d8e31e37b2a9a304e9e0c8

SHA512
db89467f661c9d10a5f41a4017a6cc7d6371271efbf960c3134285d8b3d73110320d98cc074f5ea7d6af5788509fd5e3abe5cac7d0ff36b521a9654c5eb499be

Download Submit
/data/data/com.wenhua.dingjintouzi/files/SeriesToTradeCon.json

Filesize
40KB

MD5
b2a64ea9f2ad3820754b435603745b70

SHA1
f04a7ee8ecdb7e78fd9952bd8ef9a35f1e952890

SHA256
68d616afe4280db2f4a3d5f0982bc0b772bca75d5594ae5fa5c9d2e49af434e2

SHA512
f07a35f048abda72466ea7a13b9104a31ad354b80957eb4dfc468f79eec7649b59e6b1de48d13b96bebccc9c324e13adf256391e19ebb66bcda639f13a46dc0f

Download Submit
/data/user/0/com.wenhua.dingjintouzi/databases/bugly_db_

Filesize
60KB

MD5
d85f6f2c684c57f40edd789f10841f92

SHA1
331d627e9778893fe7fa4b013cc381488c95b822

SHA256
eb66783a2d80557d30f4f66651453a4fa2bfd0a88b3ba5d8dea97e0393757253

SHA512
f08f03bd6436c26f076f4ca04acb4877c99c8aeac164b3a3cb9721b7f45c7cefb7fa39e43964b66915b569500a4225a923b8c111eeb5ea54cd3d9257e8c00ad3

Download Submit
/data/user/0/com.wenhua.dingjintouzi/databases/bugly_db_-journal

Filesize
512B

MD5
ebd6f8b5ffff612bb55b31a7b099679a

SHA1
816435742293ba82c19056b7923883b8535e5887

SHA256
72258a303222bc512988afb426fb423493783d131d5d9c7c7e1d20a3aa5eb24d

SHA512
aca37f658f854b2a19f1b641bc9b4e317829354da907b7201da62676b57b2fbe8383996a95e631d87f48c73bb929a43d2b7a25b9504f1a2524d529b19caa7c9f

Download Submit
/data/user/0/com.wenhua.dingjintouzi/databases/bugly_db_-journal

Filesize
8KB

MD5
3b4a86cf89741b1e57622d5b88b86822

SHA1
523bf5e7a4294a76c2ddb7a2d88ff83f80ae8152

SHA256
5a55bc8117d8b710d4c6f93a91052cc0db664602e358507d3c759983676e00b2

SHA512
9a17537744ea1db7c7fabe7f518f2a3c5b28e2933b0b6ceb5ca01454e27ff8cafb19bf3f3104474a853c9dae269de48c05f4092a1f4c226c1e142ec835a29d81

Download Submit
/data/user/0/com.wenhua.dingjintouzi/databases/bugly_db_-journal

Filesize
8KB

MD5
6e2b0aa12babd36bea2bf92096c6b3a4

SHA1
99435f0d2da7c240c97cbf7b27fc696085d41147

SHA256
6da2ef31ee038caac63425e03ae2d026149b750c80ebc8eb5a7a999ce05f975a

SHA512
c5c567fd2d4d896a3fdfba121c5bbc62d9275d6c917a230e25ad895c20d0d09b070bfcfc845f378e8514b2e0bf45f7c85f30d80433b8b62e08a783d1fe7be8e1

Download Submit
/data/user/0/com.wenhua.dingjintouzi/databases/bugly_db_-journal

Filesize
8KB

MD5
5dd61b8e140d28c24a6bd0791961fc5d

SHA1
28000fb91b7136c0adc82b91c34c7f3f9f82381d

SHA256
6b03d0f5f0c9b5d2b5c5793683a48426c5029b409fbc1c095619f995857af148

SHA512
c9e2aaafbf16da54680549490cc5d65a914a0230ba13ca68c751230c8d9454e72c7f5712cf8235ae3b0d20908b1d5e9934bee579e8b9618add12ca947fa46840

Download Submit
/data/user/0/com.wenhua.dingjintouzi/databases/bugly_db_-journal

Filesize
12KB

MD5
5da2a806c2abe6ad07c71c8de4752c0e

SHA1
de52c8b8592600b46bdc371f9d7470e080fe6bd7

SHA256
d57fa5ff58567c5bb40bd125eabc46b766f8d097da4b65b2d74ea58a95be4dbe

SHA512
02fec40a892043df5ed429e9339d2b519991dda796294332ccc86f927725288808d9d756130e69b7a7cdd40f03d424daac8e18dfc37ac96b97e34235e81edba5

Download Submit
/data/user/0/com.wenhua.dingjintouzi/databases/bugly_db_-journal

Filesize
12KB

MD5
104a0fc797e6b6e5ee12d310e72e4fc6

SHA1
18e89f32820136a225fd25b1d59bb7200b2ebd1b

SHA256
b151331f448754a980d5dc700dfbf075b38d2c813a3a3349e3d17452d4af1c69

SHA512
4ade80b66f79ded0e90c34cd9520b8d8708d29364fb122269649ef02a746d118074981d530b1cc1f3a4183ad3950447230e8316cd5e436e1cfea2fc435fd70be

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads