8035eb6d8a4d83dade028b555c1f7acfa4f4ee427d8b8ce8b8fdb45c2e23c66e

General

Target

256c1ea25286cb08df8d3ec811c37031_JaffaCakes118.apk
Size

24.7MB
MD5

256c1ea25286cb08df8d3ec811c37031
SHA1

ef9914ba70494eeb3df053867be926a7ba39fbd2
SHA256

8035eb6d8a4d83dade028b555c1f7acfa4f4ee427d8b8ce8b8fdb45c2e23c66e
SHA512

e4824ef711aa8026aaa738a083feee5642c29eebf23b5df63de38c47b88540a339b2be3620b13a8a1dc5d4670b6da58574f0a1882d245f8e4bb2df6ad5971b48
SSDEEP

393216:R6ZL4IAN8DRqMkW/skgI91k/b5C7OBfVKG5jizbNFsWi0but8adI2fd/IzxDyR1P:R6ZneXkgX/b5XKGibNFat8aie8xyx8fa

Score

7^/10

discovery evasion persistence

Malware Config

Signatures

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.lemon.faceu

Queries information about running processes on the device 1 TTPs 3 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.lemon.faceu
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.lemon.faceu:ipc
Framework service call	android.app.IActivityManager.getRunningAppProcesses	io.rong.push

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.lemon.faceu

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.lemon.faceu:ipc
Framework service call	android.app.IActivityManager.registerReceiver	com.lemon.faceu

Acquires the wake lock 2 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.lemon.faceu
Framework service call	android.os.IPowerManager.acquireWakeLock	io.rong.push

Checks if the internet connection is available 1 TTPs 3 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.lemon.faceu
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.lemon.faceu:ipc
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	io.rong.push

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.lemon.faceu
1⤵
- Checks CPU information
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
PID:4185

io.rong.push
1⤵
- Queries information about running processes on the device
- Acquires the wake lock
- Checks if the internet connection is available
PID:4234

com.lemon.faceu:ipc
1⤵
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:4219

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1633

System Checks

1

T1633.001

Credential Access

Discovery

Process Discovery

1

T1424

System Information Discovery

1

T1426

System Network Configuration Discovery

1

T1422

System Network Connections Discovery

2

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.lemon.faceu/databases/common.db

Filesize
4KB

MD5
e4e94d2e559b6f2ee5f4b9a5fb975c0e

SHA1
15f5323897f47f9c5d74056cb1dc8f026d42385c

SHA256
2f96e6cc272106bcd0635b7261ef4a33365772049d11422287033079900432d7

SHA512
58c0fc5b271200e41707fd865cae2f5184cd157f08d9138890c1cb2f2c1c854fc6269f07ed6e31bbb3d1f101e51fab3187fd20b5b6b5a7e80d2801b23e86b72b

Download Submit
/data/data/com.lemon.faceu/databases/common.db-journal

Filesize
56KB

MD5
ee01ea21539946caefc67e0b03988793

SHA1
73dcc97836a3f1c1a0c2cf62231f1b86880160ee

SHA256
a2bf801b8e1ce86c6d8bdafdded94ea266d699768b1350d6a247e17c625d3bc9

SHA512
ff5fdb03190b351d7671e7edb765e95703842d4d689ff32c55ad39de543776130734b5cc8fdf6eb1a07e172f8962cc5521b44b1bc3a7009fab96dfabb918495a

Download Submit
/data/data/com.lemon.faceu/databases/common.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.lemon.faceu/databases/common.db-wal

Filesize
40KB

MD5
8318ff213bdaf94967ef4cc5837fc3df

SHA1
517000572720984ed9583fc09cb30e90dbe90d66

SHA256
6d7803b0f055c4cc7ceca80116ea4775a3812fa7b299aad896074086ff5293b3

SHA512
ce588bab6068b0b80d9bbe1d337e094993bcb2f03dd9dc2cad343a18d0a0b15f6c16363dfa4b39a14dacf7b0acadfff3e7c40a4a19faf88ef471656eb3f9a727

Download Submit
/data/data/com.lemon.faceu/databases/rong_version.db

Filesize
28KB

MD5
268d5e8d5b13ddd7868a0c7ecc5361f1

SHA1
48013f9e8b93da77898e9b77f4d5d933e56d83fc

SHA256
cb3b10258ec306a6bfde4a9e8e8cc8b41b871063ff5bdbc697f830a44da69a54

SHA512
be1415d691a6b1604151b8652bac023da21cdae1c7260423a960159c30a105b032c051b86502996d7dcfc0b5872e69cd07af2a3ca649ac1a0101eab825fc8022

Download Submit
/data/data/com.lemon.faceu/files/.um/um_cache_1715181051959.env

Filesize
665B

MD5
2ecfca72872a8cca3b34c1dabe613f37

SHA1
3dfeafae5244fb130bc60b49e1d45f5df37ecfa4

SHA256
11e0d5396f206911daa2e4bef4e1c759bbec2c9d04f7cfc54727948a969ca583

SHA512
b2ae3017ad236fba330613c094db2a45d40f316ff5f588236405dbf6f5f592a26fedb478c8c886eac69d68aa4d2b6725cead2e020a565fab293224872c492f3f

Download Submit
/data/data/com.lemon.faceu/files/umeng_it.cache

Filesize
310B

MD5
9a2288cd8924f9acf73675752228b265

SHA1
82cac0a90d05b76e343e9c25b0e120d3de949ef9

SHA256
6e25e164c4c8462d66b9aae88552dcb4e998ffb3c96e1db5181c18a13af229a7

SHA512
180071dacf87779b9d1012a1ae33a5546d449602fb2ee0c4d201180f6755e45c0365cd484337040b411379eaf266ad9eecc493885b01fea9212fa8d1c73d6011

Download Submit
/storage/emulated/0/FaceU/oneoff_limit/journal.tmp

Filesize
31B

MD5
8c92de9ce46d41a22f3b20f77404cc1d

SHA1
8671a6dca00edb72be47363a7071be65cf270373

SHA256
68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274

SHA512
30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads