Overview

overview

10

Static

static

10

270b6d276c...18.apk

android-9-x86

8

270b6d276c...18.apk

android-13-x64

8

alipay_msp.apk

android-9-x86

8

Analysis

  • max time kernel
    103s
  • max time network
    171s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240508.1-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240508.1-enlocale:en-usos:android-13-x64system
  • submitted
    08/05/2024, 22:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    270b6d276c28e32c3c6954e119bcce53_JaffaCakes118.apk
  • Size 22.5MB
  • Sample240508-2jb9sabb9z
  • SHA256 2724b826d5c45c80734ca77f2432bf31d2073e219663a87a40d4e6f34ae4c4e7
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
bankercollectiondiscoveryevasionimpact

Malware Config

Signatures

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Requests cell location 2 TTPs 1 IoCs

    Uses Android APIs to to get current cell location.

    collectiondiscoveryevasion
  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

    evasiondiscovery
  • Queries information about running processes on the device 1 TTPs 7 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Acquires the wake lock 1 IoCs
  • Checks if the internet connection is available 1 TTPs 2 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 7 IoCs
    evasion
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
    impact

Processes

  • com.leho.manicure
    1⤵
    • Requests cell location
    • Checks CPU information
    • Queries information about running processes on the device
    • Checks if the internet connection is available
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4248
  • io.rong.push
    1⤵
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Checks if the internet connection is available
    • Listens for changes in the sensor environment (might be used to detect emulation)
    PID:4305
  • com.leho.manicure:ipc
    1⤵
    • Queries information about running processes on the device
    • Listens for changes in the sensor environment (might be used to detect emulation)
    PID:4283
  • com.leho.manicure:ipc
    1⤵
    • Queries information about running processes on the device
    • Listens for changes in the sensor environment (might be used to detect emulation)
    PID:4523
  • com.leho.manicure:ipc
    1⤵
    • Queries information about running processes on the device
    • Listens for changes in the sensor environment (might be used to detect emulation)
    PID:4672
  • com.leho.manicure:ipc
    1⤵
    • Queries information about running processes on the device
    • Listens for changes in the sensor environment (might be used to detect emulation)
    PID:4901
  • com.leho.manicure:ipc
    1⤵
    • Queries information about running processes on the device
    • Listens for changes in the sensor environment (might be used to detect emulation)
    PID:5326

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        dynamicamapfile.db
        • Path /data/user/0/com.leho.manicure/databases/dynamicamapfile.db
        • Size 20KB
        • SHA256 e41cb5b265ff54a10fa45918b45d979daedf4c2d310150f6fcd5efb418c22d59
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        dynamicamapfile.db-journal
        • Path /data/user/0/com.leho.manicure/databases/dynamicamapfile.db-journal
        • Size 512B
        • SHA256 5aceb4a1480548a0dcd7375c96632f5b752fdaaf8a48eabefd959ca5bc8c16c9
        • MD5 SHA1 SHA512
        Submit Download

        dynamicamapfile.db-journal
        • Path /data/user/0/com.leho.manicure/databases/dynamicamapfile.db-journal
        • Size 8KB
        • SHA256 b33d1314cd58751ef7b80d8ebe4867323659fa3f2ccc55ab7720ec4a160ec350
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        dynamicamapfile.db-journal
        • Path /data/user/0/com.leho.manicure/databases/dynamicamapfile.db-journal
        • Size 8KB
        • SHA256 27cf1e990085917ee943b0f1aa8d703c25b4480e354eae8b59cf2f34918c62ea
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        hmdb
        • Path /data/user/0/com.leho.manicure/databases/hmdb
        • Size 12KB
        • SHA256 bb9e45aad35b43e895393e7a66e4ead6a5f728f90b7627e3c741d391bf65d4f9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        hmdb-journal
        • Path /data/user/0/com.leho.manicure/databases/hmdb-journal
        • Size 512B
        • SHA256 87d60c44345140a521f14b942f2178b188e7d86d77df347a43109ac9204b3b7e
        • MD5 SHA1 SHA512
        Submit Download

        hmdb-journal
        • Path /data/user/0/com.leho.manicure/databases/hmdb-journal
        • Size 8KB
        • SHA256 7f1ff52666d24d25acd93758cb44465972fc942497f9cd0880f77c92de00afc1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        leho_xiumeijia.db
        • Path /data/user/0/com.leho.manicure/databases/leho_xiumeijia.db
        • Size 20KB
        • SHA256 963940135f4a9ca006c7011ee66554b689a67adb8667a7db6ddc0260ce2d13b1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        leho_xiumeijia.db-journal
        • Path /data/user/0/com.leho.manicure/databases/leho_xiumeijia.db-journal
        • Size 512B
        • SHA256 ca8a12b6f526419fa58c3990e133b1c6d7d0d3d10a8c7c9e3649a41e13cd1834
        • MD5 SHA1 SHA512
        Submit Download

        leho_xiumeijia.db-journal
        • Path /data/user/0/com.leho.manicure/databases/leho_xiumeijia.db-journal
        • Size 8KB
        • SHA256 c7e8cffd457d58695bb9f693c5620341b36235e59b332b0cf71acc54e8379860
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        leho_xiumeijia.db-journal
        • Path /data/user/0/com.leho.manicure/databases/leho_xiumeijia.db-journal
        • Size 4KB
        • SHA256 3d5ad95a4c411b2b037dff04f286deec8dd62751fd6a353e0a5064c433d84524
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        leho_xiumeijia.db-journal
        • Path /data/user/0/com.leho.manicure/databases/leho_xiumeijia.db-journal
        • Size 8KB
        • SHA256 45104630476234cd71d115a2f5fbbb72d890356b06644abadecf2d4d83daa54b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        leho_xiumeijia.db-journal
        • Path /data/user/0/com.leho.manicure/databases/leho_xiumeijia.db-journal
        • Size 8KB
        • SHA256 8d1e8e16765550cb6980673b12766cc9018793c28dc02bedfa447eeb8a226e24
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        rong_version.db-journal
        • Path /data/user/0/com.leho.manicure/databases/rong_version.db-journal
        • Size 512B
        • SHA256 2ec0d188ad0fb0848c713db304b60f0a78b5e193966f4bfcd6018e673d570098
        • MD5 SHA1 SHA512
        Submit Download

        rong_version.db-journal
        • Path /data/user/0/com.leho.manicure/databases/rong_version.db-journal
        • Size 8KB
        • SHA256 f84cb9f3122d307db1fb45f088f240fc77406b3ba222890fa68dc3039d882158
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        rong_version.db-journal
        • Path /data/user/0/com.leho.manicure/databases/rong_version.db-journal
        • Size 20KB
        • SHA256 9bd34cc2905ba3fb42d976ce3fdcfcf344955fa7b876da641027fe27580774f0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        .imprint
        • Path /data/user/0/com.leho.manicure/files/.imprint
        • Size 783B
        • SHA256 d1d673a498de30ec695f3da9f54a9148ba4fe5d2524fcd9381c1c9914a541f00
        • MD5 SHA1 SHA512
        Submit Download

        TDtcagent.db
        • Path /data/user/0/com.leho.manicure/files/TDtcagent.db
        • Size 20KB
        • SHA256 1622ff7a4d6a50e835aaeae45449facea6f48b81d6ce0a20af36faf917678760
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        TDtcagent.db
        • Path /data/user/0/com.leho.manicure/files/TDtcagent.db
        • Size 24KB
        • SHA256 7e4e49a5b8cbe56b84ad44227672db3cabbd0a892fb8bdd6bbab3af235e005be
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        TDtcagent.db
        • Path /data/user/0/com.leho.manicure/files/TDtcagent.db
        • Size 28KB
        • SHA256 172df8eb98780909aa6fe28aa7446b9e8dae70f74f3bfe377df954dfba8dc139
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        TDtcagent.db
        • Path /data/user/0/com.leho.manicure/files/TDtcagent.db
        • Size 32KB
        • SHA256 7ff0ce442a7275b9a5281470d8f7916bbab121acbd1e0988cef2d2908dce7b48
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        TDtcagent.db-journal
        • Path /data/user/0/com.leho.manicure/files/TDtcagent.db-journal
        • Size 8KB
        • SHA256 74a4940dbdcfb6dfa79dc1549922f5b7db7d4a65c645739e22472fe0610f4adf
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        TDtcagent.db-journal
        • Path /data/user/0/com.leho.manicure/files/TDtcagent.db-journal
        • Size 8KB
        • SHA256 bb0839d4dc81c106a024b59f09fafd3d2975545f03e56cbfd26082d775a31ed1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        TDtcagent.db-journal
        • Path /data/user/0/com.leho.manicure/files/TDtcagent.db-journal
        • Size 12KB
        • SHA256 6641d84e862f1c4cb977ea16c895c6bc68e44cd3f79ea9a2b2830689493bd6ef
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        TDtcagent.db-journal
        • Path /data/user/0/com.leho.manicure/files/TDtcagent.db-journal
        • Size 512B
        • SHA256 2b3199785ed8be73c3c5d67c97d433a97625475a4480a1f545542ae7424d708e
        • MD5 SHA1 SHA512
        Submit Download

        TDtcagent.db-journal
        • Path /data/user/0/com.leho.manicure/files/TDtcagent.db-journal
        • Size 8KB
        • SHA256 1ba2c9977f2954921882650b26d932d9823823f9e6a50014d8d5f1017c24b10b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        TDtcagent.db-journal
        • Path /data/user/0/com.leho.manicure/files/TDtcagent.db-journal
        • Size 4KB
        • SHA256 3d10ce9301e39625c77d483e083e04d8366088fdd970f93bb9197315ad28a173
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        journal.tmp (deleted)
        • Path /storage/emulated/0/Android/data/com.leho.manicure/cache/kit/journal.tmp (deleted)
        • Size 28KB
        • SHA256 9fa79b0428b6e1fc6a5590d5f590da648c6d16dc7c3b6d2b252d06933a8eb087
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        journal.tmp (deleted)
        • Path /storage/emulated/0/Android/data/com.leho.manicure/cache/uil-images/journal.tmp (deleted)
        • Size 8KB
        • SHA256 808e60ec0945abe1022c067365f26202a814ff9f905dd38f910431aead9f7018
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        1715207809
        • Path /storage/emulated/0/Android/data/com.leho.manicure/files/carrierdata/1715207809
        • Size 1KB
        • SHA256 e521fdd5f420f82dbf18f2838f792ec131414a0eacd89b6a6eeee4d4be5df37b
        • MD5 SHA1 SHA512
        Submit Download