Analysis
-
max time kernel
76s -
max time network
158s -
platform
android_x86 -
resource
android-x86-arm-20240506-en -
resource tags
-
submitted
10-05-2024 22:36
General
-
Target
316104fce3b13aa8cc8ace57feba2379_JaffaCakes118.apk
-
Size
14.8MB
-
MD5
316104fce3b13aa8cc8ace57feba2379
-
SHA1
5d5d98074dcecb9b1fc1338a7f05da769c6dfec0
-
SHA256
5e57bdd1bcd4da9a76316252e28d745d3663bb8c2f37ae5af5721edcac3d4989
-
SHA512
a9b3384734bedb19ed1350b59bf5432d6f4dd8d94598ecfac235e43e709308245ff04af656629e0a892223dd3b2121a4c1f44b5c577b06c61b75339dd5156686
-
SSDEEP
393216:p+2fFOOxtKenryjD6NVD8vamZnp19Cm6l5E65hJc:pTjKPjD6NV+awpijrRO
Malware Config
Signatures
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
-
Checks memory information 2 TTPs 2 IoCs
Checks memory information which indicate if the system is an emulator.
-
Loads dropped Dex/Jar 1 TTPs 5 IoCs
Runs executable file dropped to the device during analysis.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 3 IoCs
-
Checks if the internet connection is available 1 TTPs 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.fanshucancer.www1⤵
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
-
sh -c getprop ro.yunos.version2⤵
-
-
getprop ro.yunos.version2⤵
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.fanshucancer.www/mix.dex --output-vdex-fd=57 --oat-fd=58 --oat-location=/data/data/com.fanshucancer.www/oat/x86/mix.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
/system/bin/sh -c getprop ro.miui.ui.version.name2⤵
-
-
getprop ro.miui.ui.version.name2⤵
-
-
com.fanshucancer.www:pushservice1⤵
- Registers a broadcast receiver at runtime (usually for listening for system events)
-
com.fanshucancer.www:pushservice1⤵
- Checks memory information
- Loads dropped Dex/Jar
- Registers a broadcast receiver at runtime (usually for listening for system events)
-
sh -c getprop ro.yunos.version2⤵
-
-
getprop ro.yunos.version2⤵
-
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
148KB
MD52a9786a76a46b16a19b51484f24d4207
SHA14d994ab7b5c87baf7a05697561418daa69008030
SHA2565f25c4bf173aeddb8565f561c0b0d0ac1c493b35614e017768e338a0209a5aeb
SHA5125de3adea248b9531df52d576fd0f9278448609e5c6bc2e1abf16aea794ca0a7fd9c0f7fc9b9a65111e90a09ebb38fe16892a5066b3cee018ed3e3c0b21ffd37f
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
92KB
MD5a2859ef04771fe0ccc2a8d5db9ce5fb1
SHA1cefb10e5620fc4a2d30bd5e867d3bbf9ba2ddf55
SHA256d233472c6f1bc02d20cb7a9e77ab6c29feec9037c3d28fa8cf528177dedc8343
SHA512bc43fc1dd054c01b6222db64d5777a0e71d1ebf5297355707f4d3d8025589822983587ef11e7742529feadf97990ab3d367ab9cb640fba1379cb6c53fad00be1
-
Filesize
335B
MD5585839d66722cfd02e40cb740cccb633
SHA1374c19200fee201b26d0153487a281a934615884
SHA25686a9bb4985cca6c9636c4fd071bef4b70ba7b3a5eb51af869a1299dc2b1574a8
SHA51209bbe1bf1455861fd4732f2d1945c84bac34090906ac2fab75d144c22ffcf6bc585c8209e94a2b1919c8402df53966081a1af2993e12261ae4c4ac5568667d88
-
Filesize
129B
MD597abbf1ee956ba73e7df5fbe8b84adfe
SHA1ba6d262f6a95e0b8a72a099c0b1e58c3789a3eb2
SHA2567f61100064df971cbdbb900a5ff7630d06caff2bb32dd23280c549f6c5c01efb
SHA512e4911d1e32eb1362da3c8cd3ae9efddd852128c07f064c24ebf0b37507873355ae9f85fe41be76b3928b472269183291ccec375efe4912cfb330c5b8802f6ea3
-
Filesize
292B
MD563f77f99bd2c2b772a479923bde11974
SHA1c7632e7d301e4463fafce85f84e9c3d7da3fdbbe
SHA2564c76a3af64cdd2f8713ffe2733dea50dbe714d0ca41c17d1847ee5b62a7ca615
SHA5123aae4a89d1ed51fdd911cb367eb10afe3c2264e4222085891b18a60d5412f85d10bf5c8f3c6642db70abb9aa42732bac5c42c42ee32d587100f53c21b5beb16c
-
Filesize
24B
MD5e78db71835e63f92e954e095c3b37ab8
SHA1a15d0bdb2271b49f2cb80b3f450ea875e351eff4
SHA256914eec37fddc3a770777f51beff2b11ed8df3cc5c652ad98fe3c4aed92944db1
SHA5122fd36ead682b73899ae329733804a967f583f9f85a7ba524c748cdb4c69f1c04966ba652b7f3cd78a3b3af3452d5ee28838183107c65728be4f6ee073db344f1
-
Filesize
32B
MD508b88b1086228effd366124c3601efd4
SHA1a9bdebfc0f0ed392fa447deba897ed0dc1ac8306
SHA256d274b066bf288b1a1d980d26507976f7622ce7385a7825306aa7e16901fa44bd
SHA5128d6f03401475a595d72f4542e10198f06856edcb3834593a13319386d0bf0bd6e9797ec44ed488cb8e725d1086f7d1b65ff6dfd19535aad82232d58a6ba446e1
-
Filesize
89B
MD59430e21aa2df3f01c9d0d64e869dd296
SHA185485097c3d5f8f832623d5a0e60ab1637628152
SHA256fb0667696480a35b24d882b924e46caeff575986ad798b9bbbc01db15db614c8
SHA51261381bd17a5ef2c926901da8f08277177df4f8ab142bd43c880e81a7767c1f0b718e04dbf7f053681e620d438cbdb3211178b8da484b3461e35f8631091ec4f2