Analysis

  • max time kernel
    149s
  • max time network
    157s
  • platform
    android_x86
  • resource
    android-x86-arm-20240506-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240506-enlocale:en-usos:android-9-x86system
  • submitted
    10/05/2024, 10:00

General

  • Target

    2e9403c1a87c56bbe07f0d4bb0867692_JaffaCakes118.apk

  • Size

    21.4MB

  • MD5

    2e9403c1a87c56bbe07f0d4bb0867692

  • SHA1

    db56d988c72205ed60e2dd40f49c051d20c5e177

  • SHA256

    fed5e6e1b525479a50b2b01f4d0eb4cb6749eda60840786f6b1af271beb20e22

  • SHA512

    f356ba2b6bedf4d6ea0fd6d0da932b22f88a9524057c060c60d2f18301f6cf1f5599d3a0578832458035d89d91c986bf42f6741b9e2ab14c499a1c2e2934fada

  • SSDEEP

    393216:6XAP1g+a/9Fr5GmBNba4jklcVd0lM0BlY8jCjN8sejWemckQvIzBnh4HPP5seuz:6wP5alx3S+kmV2l0esejWezch4HH54z

Malware Config

Signatures

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Checks if the internet connection is available 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • cc.md.questionnairesystems
    1⤵
    • Queries information about running processes on the device
    • Queries information about the current Wi-Fi connection
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4285

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/cc.md.questionnairesystems/databases/dbquestionsys

    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

  • /data/data/cc.md.questionnairesystems/databases/dbquestionsys-journal

    Filesize

    512B

    MD5

    33ac53f5544c0211104ea8eddb09c317

    SHA1

    4836e6fafc7f8e048dfb93c69f8dac266cbcb03b

    SHA256

    7f65cfa0c1cb2688e9250fc174e102318a7ba495f2e9ca0cf09dc3bfc3e59a87

    SHA512

    77b30971402aae914a99ca24bb828d5a4e20c9edce8096bebd8ef8bfcf14c439305ab024186fa397ecfffd956778e44fb48931c7d2e841f0b2b1598625ee6b44

  • /data/data/cc.md.questionnairesystems/databases/dbquestionsys-shm

    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/cc.md.questionnairesystems/databases/dbquestionsys-wal

    Filesize

    44KB

    MD5

    a3c84ecd77efa4e59e5a7cd280b8b485

    SHA1

    fba3b5c38a1221532b938037341694dc0f23329c

    SHA256

    904fb9ae042ba1f561ee3ce660d3dc1a47edee703ad5e214d582ef5a16b7c782

    SHA512

    2f1ef1826c7eedca10649ca3881c3dc5e82ff9304f0c5f423c33596f71f447597ec84728b945ff2a4f00e77089dc6808802d6b9014d0f9de846178df88f75597

  • /data/data/cc.md.questionnairesystems/files/jpush_stat_cache.json

    Filesize

    140B

    MD5

    bb99565be1f42ef764736cf4b2c31d88

    SHA1

    2f8506afd238e7db2a1022383ce447313b0a8d6a

    SHA256

    87c767a6662edce614d51ea8043d65e34c002e0164312e2730d5f3ea11cff3bd

    SHA512

    3ebfccb55442eb73393a7569f11f1ef2af44c4039dd725d33ad3de99a322a9a8fc5379edacd8a3b3194f823738035b3ed88dafa0e0a8cd208859a67d50f26252

  • /data/data/cc.md.questionnairesystems/files/libcuid.so

    Filesize

    129B

    MD5

    37616aaa8a62d57bdcf1892b5c98e0e0

    SHA1

    5869eaa487fa88db720ed6c95da1ff94d0770306

    SHA256

    77c1a61c3a96a343e981f03f7fd6f2ba20196cb235ac414e2280f678733270c4

    SHA512

    b113ec34423311b338379b9e0ec68025e092932427da88f8f60a053e0ae937d878562b61ad321dcc394300f360f6faa04985bf38ae6d1f1e84c7c0a4c26b09e1

  • /storage/emulated/0/backups/.SystemConfig/.cuid

    Filesize

    89B

    MD5

    928320d1a6d83ca8a98c83ee258c4e65

    SHA1

    8998e851e17ecf4dd6d9bafe0bfea0c3db0ad819

    SHA256

    641fd88dd179c7a7b5110649af3a3a04ebfbe50b891e13d948b0d8c03e8ff4d7

    SHA512

    90fc5006b3f4cd8c17c190bb03a1d3e9d1c049908f4b94883f4478406e1063a3b4ae3b461760cd42a2af91ab47224ed1c5f9e89c5816d23bc9ded0ae356a69af