Analysis
-
max time kernel
130s -
max time network
157s -
platform
android_x86 -
resource
android-x86-arm-20240506-en -
resource tags
-
submitted
09-05-2024 00:30
General
-
Target
277197d06a08fc30d53cb2ae4d104a65_JaffaCakes118.apk
-
Size
4.9MB
-
MD5
277197d06a08fc30d53cb2ae4d104a65
-
SHA1
112d458d90bd4a376e8703e05dde99478238f6e0
-
SHA256
ffc5fec63d4ba736708db32aa2494449cf0a61c1f8025b99b361e4a7539806bc
-
SHA512
5e91e8a6a925b7d666f088de2219821e009c6f5651bab9a733c1dec0bd952f713033a2a0c33f0f8894964a2290a051bf2ea5eea18a5b323f63c6fb338b76b51d
-
SSDEEP
98304:axpzhCz/He0AqP3x+HT1lRTWKca9A9eNVsb/ryO:WVmHekPCxDaK7A9e0b/N
Malware Config
Signatures
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
-
Checks memory information 2 TTPs 2 IoCs
Checks memory information which indicate if the system is an emulator.
-
Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
-
Queries information about running processes on the device 1 TTPs 3 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 3 IoCs
-
Checks if the internet connection is available 1 TTPs 3 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Requests cell location 1 TTPs 1 IoCs
Uses Android APIs to to get current cell information.
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 3 IoCs
Processes
-
com.wta.NewCloudApp.jiuwei2424491⤵
- Checks CPU information
- Checks memory information
- Queries information about running processes on the device
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Listens for changes in the sensor environment (might be used to detect emulation)
- Uses Crypto APIs (Might try to encrypt user data)
-
com.wta.NewCloudApp.jiuwei242449:pushservice1⤵
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
-
com.wta.NewCloudApp.jiuwei242449:remote1⤵
- Checks memory information
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Requests cell location
- Uses Crypto APIs (Might try to encrypt user data)
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.wta.NewCloudApp.jiuwei242449/files/tongji.jar --output-vdex-fd=49 --oat-fd=50 --oat-location=/data/user/0/com.wta.NewCloudApp.jiuwei242449/files/oat/x86/tongji.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
1User Evasion
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
101B
MD5cf9e937a10cc46e671bd409b5dd7112d
SHA1c0cdca92be2388e839cf6a46f642cab4b7fa8b1e
SHA256adda59582dce031929aad488f1869d2de0b9a7e99769a7e8d6e5b97c0e68538d
SHA51275a3d207a8704eb937d4b67c8cc5b16e2e323aade84e7d94c03c4b16cf4a069c1596d1e056cdd2a81eef373c583d4c492779125359d860de1b9f407948402566
-
Filesize
8KB
MD5d75b715fafd6816afdc96b6225361e6d
SHA181f26c9e576275c9fb6d8eb7e2a70c04cc784624
SHA256e54005a1c014c3660538257b66bea4ad3176dcbb3ba3ffea58b1024995c2eec7
SHA5122baad6a7bc0341cfd94f3cadca4a9c969ea3f77f87d3b0487fa37637065b2d8e7c5d21e2d4152467044cf091b67e18cfaecb0e32f84328488d6aaf952b99d5cb
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
173KB
MD5e7c1d43d68d2ba0aa149354261997fb7
SHA17cdd57cae7047c3f496c91bc77e95122e6ba5530
SHA25647960d54657a93016be48f9381283fe511649adb12f786e565f26c48d5fa86ca
SHA5124670c7dadc660295754c0f565505b660309915573f0533f460f01ffda9c1618954e6cd5c70d37d51f9ae05d4c0681bfd586f95e1d8f01ad68fa912d092524936
-
Filesize
104KB
MD5afd39b62efb3acf4741735a2163357fa
SHA1ba9a589c9c01d5697ee27eb398938d6f91bc1686
SHA25600a3fb2a27743467f5dcd98245c4fa3dc0fabdd81d699f41c1b120c5e1d233a2
SHA5120ceac5cdd9f2214019f8d9c98c49435c482e21fdbcb67c6a2e16440ef3dad7e9b09fd4e268edb69b20301153129fa8a19aa6a3734c7372f72a9f67876f196327
-
Filesize
32KB
MD514442c728c9291baa0fc9076f6de1a79
SHA1b906df383ef40611b121da632baaced8568a77c2
SHA256e72dec90b335d812d1102edeeade5934d5ecf38e8e6f3f51d753291aab7f9a89
SHA51269e2009462b72354dc069d0eb12c9dc91c1a9adbbdcfebc44c2192f06a278a86bda49ca2f57ad85cd002ca683e6bd05cb863034dd3d75b521744c7f29bab54e3
-
Filesize
40KB
MD5a1e298c1f01c6436d60bee01bc5abdf9
SHA14b6a3ea99b39b21140a42a9d6c3256ce1f62dd94
SHA256d958453e7b3b22ed2e6420f60ddf86e457fb903496f42d1dff104876c81cde49
SHA5120422f11875145b2d61ab8f0cbc24827d0ea32dc3e2b9419c00d196fd5fe7dd2ba768348386568bdd1eba54f090f3ea619e92a28fd907ac9e2a83259e1beae99f
-
Filesize
44KB
MD5104f92932925257891ab764bdbe10133
SHA1d509265974a582291bdec4caa63b79a992fa788c
SHA256d087eb2c13fa1a5ff366163574309b86d28b6ea562205ea2de28e52cbf198a59
SHA51218260487381203a6ee879fe07083fef8f1c1792f5020345a96b00868038faf2e9b83f8270b93abee247e0c118c05b51b1556eeb7ddf31c5d1c485d57680b7d76
-
Filesize
52KB
MD5a23804962d62fe8b6b24c7cf04941524
SHA14ddd1356102f139fccd19c00bc285d15afb252cb
SHA256640ece61477462ae6794d4490ae2202c89bba496e147ab5a5a729661246dc4d8
SHA512f6b9a56d5b9d14e6e1ed787428f88f4acd953695f4bb106bddccf3f8db81b251ba96e4524f2bf25757353c5383190d3b9c2f238a0f97486016db5cd3dc93bd4c
-
Filesize
60KB
MD534740c329b49ef63d5ba0ee1634e247f
SHA1bb8dc2d7fe1286bc2a1bbce82e2b1351a211cd57
SHA2567c2353c84e871576116f8ac7584ae1bd98db42f737c2871eb171c041f0e578a4
SHA51255d42895b5a218ba55fae20ac8020620d4dce703d6ee0ac26672dd66d41945026c0444228b517349d46717edebf99577a59e50474bc94ed09aec4092c1ae69b4
-
Filesize
3KB
MD55fe43c1e85ba74c2fe53a479d77b1133
SHA13136a8510781359f534276b87a1e7c667ab7eb9e
SHA25688b12dbbee27e3b780aebd53555f82648b33771ad3cb97bd540d834f07adf5a2
SHA512bd4db54701e4ef68787d5b07218bac874ea1789ccfca32cbfbaf5fef014b675394a20720f6b18314c7fe63806543534dbe3d3a7af9bef158a8d129a6f037343f
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
193KB
MD59e2ab6ec89a49701ee6d8529f53af1ce
SHA11bfbf6296199d82df65ca2f23cac21ac6e28ff38
SHA2569c4e37281f9fae792084acc2b14d92b33cd8797888cbbae9a938ff28bee831a3
SHA51294affd5989b8d8b9e0c23be4d2938858840dc69f61cff60d473225100ad49cd92ab6d4ad5800da9cc20638484fba5b808345299c53b181152d32daeb6b7658b6
-
Filesize
18KB
MD5b51f5cb9b5512fe1a22832bbc0efac5d
SHA1a8584950ae7c8130bc08c469aa50b79d63b4f977
SHA256c96c7901717a2b7d68871031bc4f16bcc514f4e23c28b99b3a09e8619100cca6
SHA512f9788282e9720093850df834766de0424fc0ce8fb1769d11f8b4ebf8bf54eccf6daeeec93a0a600776aec6ff95ba6dbfcb2b464e0aa0396e1a099d95902df91b
-
Filesize
76B
MD5cec220ac5aee70ca90000046168096cc
SHA1f7aa6fdb24e955371b7c629de9a388f6107db5fd
SHA25617f51e279917f9994609b701a7413b8386e430d87c57e465167f4f8f154aaa60
SHA5123fb8643891a1392410c4740d62f6f95858093c6e575c6078027af4f12a40ebec9b72849993d27e6bc8613183ce2a972a6897b1c63b371cd57f228b5103027d1b