1d3068a40a80975002c5afad5f3fa8ba5d768e20a85884cc213d89531085e9b2

Analysis

max time kernel
143s
max time network
163s
platform
android_x86
resource
android-x86-arm-20240506-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240506-enlocale:en-usos:android-9-x86system
submitted
11/05/2024, 09:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

33f7444f5f2cca13946642a0326ff320_JaffaCakes118.apk
Size

14.9MB
MD5

33f7444f5f2cca13946642a0326ff320
SHA1

124872e8a34e93ce530935f82dd6739dc56d7791
SHA256

1d3068a40a80975002c5afad5f3fa8ba5d768e20a85884cc213d89531085e9b2
SHA512

7eacd129b067673361d7fa3453a3f9824ff06bb5a8bc0b566554bd9583d58e02b0b54d35a08b28ccee8259719b6b25726a64c430a5b133fe156554c9560c9b3b
SSDEEP

393216:TREl+JjKwmMnjrtugryBNpdWbYehgzyUNw8wzaZa8rQlJ:Til+J+wmMjrtugW3WkeqOFzao8r0J

Score

8^/10

banker discovery evasion impact persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.wufan.test2018031397553721

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.wufan.test2018031397553721
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.wufan.test2018031397553721:lebian.base

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.wufan.test2018031397553721

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.wufan.test2018031397553721

Checks if the internet connection is available 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.wufan.test2018031397553721:lebian.base
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.wufan.test2018031397553721

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.wufan.test2018031397553721

com.wufan.test2018031397553721
1⤵
- Checks CPU information
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4496
- cat /sys/class/net/wlan0/address
  2⤵
  PID:4753
- cat /sys/class/net/wlan0/address
  2⤵
  PID:4776

com.wufan.test2018031397553721:lebian.base
1⤵
- Queries information about running processes on the device
- Checks if the internet connection is available
PID:4528

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.wufan.test2018031397553721/databases/ThrowalbeLog.db-journal

Filesize
512B

MD5
726a2cd33e10cc3a6724332986503e7d

SHA1
4747d8d0a44c202344aa0fcd504e28e49c5e54c5

SHA256
f2e7fc39b347883ab1c4cc5448697b1a2dd4f7c9f358917a7f0de693c3c9a456

SHA512
02e2bd7a919a2c4a0141ad0e69f454d72682852b250a2da93ff6b2249bf29ce5cc6f6da19e1acd17aced822c503763baaff1290de460dbd21027c58dedfddafd

Download Submit
/data/data/com.wufan.test2018031397553721/databases/ThrowalbeLog.db-wal

Filesize
32KB

MD5
c8bc72caf54296d32bbb6bbb6100dbd8

SHA1
fe832791e1eb67fe9c0bbdac5d7dafc52ef9c495

SHA256
7651ca75b647f477e8e72b6807054985799049d4b14730712f838a304c8afc11

SHA512
7266677f3206a521ff440cb4a4e26d38d0da27e4fa94a5e3b9f71bd10d5a853519017a3ee18efff910e4b05e019cefaa467c33e47450413d5b3ce4d6c9e77a50

Download Submit
/data/data/com.wufan.test2018031397553721/databases/mgdb

Filesize
260KB

MD5
f19ad37702199ffbe9ea075d2e1f4418

SHA1
bdb621263c6319b387602e9f758832f02d7e49b2

SHA256
456d1dd37a67a3ec9c9373078b4a05a50dc0efff725da5ea9c8e24ff9cc0ee80

SHA512
ecc51c5b72c235899de2a3e3648b5c5de8c6c4ee78a9214c938a2a60baca39b8f8256f53a975a10208abecfc6b37454f2eddacbe1389f1e7d4328ca31877e8c8

Download Submit
/data/data/com.wufan.test2018031397553721/databases/mgdb-journal

Filesize
512B

MD5
93dee70056deed521c3144fddee018ce

SHA1
007ef032fd0a99034e56fec9d65f621e0e60a7bf

SHA256
9ecea00373e5df4a4400b2aff8ea4c1d1a8a43a3d3c895c918c70fc29fc6bdcd

SHA512
cd67f026dd22c0a28f60b8a074005d18fb33e7eec4d107d42f04acd4361428b87833600c438727e4e669d79e37b044227bb55266649b0ad0eae0e95bb42c8184

Download Submit
/data/data/com.wufan.test2018031397553721/databases/mgdb-wal

Filesize
402KB

MD5
c44c346c171f871dcd3cf9535ffd7cdb

SHA1
cac06f21afe9713020f02e21ad0c9a03fc8c0963

SHA256
bba48fd070ca4759e53e555e6a0b49ed6d45daa918e435e09108bfecf4770afa

SHA512
0ac858ae8ff2fca57a115c40b38a3cddfbb5cf57b51232856007128405752f630a93580bce144a0cbbf5c10d43f68aca801ce815e7351b846b41e74b7fbe293a

Download Submit
/data/data/com.wufan.test2018031397553721/databases/papa_stat.db

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.wufan.test2018031397553721/databases/papa_stat.db-journal

Filesize
512B

MD5
012a8e294b2281c9fa3881ba4b782e3b

SHA1
1536c73a812a457ccc1bc3852bf7251657281493

SHA256
0e5cc4362a866e99867f28b25684e8c87bb4cca045174f9097a367cc0ad404af

SHA512
d95c8e381905f510d88c9ebd844fcb5d708d2b9c4bb50ee0f71bbe8fff668fc617838c4366871ac733e517f6c3a951dee551f245e28d53679a549d73985b2049

Download Submit
/data/data/com.wufan.test2018031397553721/databases/papa_stat.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.wufan.test2018031397553721/databases/papa_stat.db-wal

Filesize
390KB

MD5
2b1b0d498dc30063f405d83c05ae688f

SHA1
107d4ccde1c376957951f4aee6b16677a107385f

SHA256
982e0cd90d886c11f61dd55c53341b711aad683a7939931b7cbbb767c86cac69

SHA512
9e87ef6d14ab60ac1d9db984623c527a21274e6d4f1a72f12fcf6c02bf12d2b4ae93174617b86b1c1187f80fe667abec74ea2968b1ae0f3c55c5fe4f11c09c4c

Download Submit
/data/data/com.wufan.test2018031397553721/files/.imprint

Filesize
1KB

MD5
6e5001284f7cc7a27ce8ab8bb8366dbc

SHA1
5f034b09319c08c024bf1d6342dc135696760bf6

SHA256
5be3468f4c9d16c5a7fd63cf9954e453dd549a6b2758382a1542c90856c6f226

SHA512
61c5e083c154fd5806fdc0e5dba8423959306cf715a31dfe36acb8796abe413dc7f2a8fa7ba440cd5462023d0a5706e8a564b5f2a59d3a760a1bf4048ec90dc7

Download Submit
/data/data/com.wufan.test2018031397553721/files/Mob/share_sdk_1

Filesize
40B

MD5
6a695f097e4c2572b690248c48689746

SHA1
d9c638d8b5d3b9ee749333259322131abba4ce8a

SHA256
c8481cb53fa31625f10b40ce4278aec7192a7dfd19afc1b7cabfa16db783670c

SHA512
0e7896e3b099be59ab54cb9b32be511fb98cd3ba7603dc7f38c56a8819d9e72dea8fa5d41a3945773bb060f2f13bedaae58c4921b3986015b50762f022c9e55b

Download Submit
/data/data/com.wufan.test2018031397553721/files/Mob/share_sdk_1

Filesize
64B

MD5
2c1dea2e668818c7147bbd644a4dfa88

SHA1
c975f82bdb37af1b9110ab92d26c3e435bf647ab

SHA256
6ce13b0a7f6b4700ba9fde2346f70bfaf079e04834d0c37ba75b6c44caef4c3c

SHA512
d1f76561954e3876250a59d9d19d3632565e86a9f12d5a01b9d233793ffb49ed7cbafb495f41a4a50d96e1715a419802205a8f92c489b0c0ab3d849a3d52b62e

Download Submit
/data/data/com.wufan.test2018031397553721/files/umeng_it.cache

Filesize
310B

MD5
623c19c53875f29b078d47fd84f835b6

SHA1
049b99531730531ab72be5bcfb8851699336e901

SHA256
6e1dd09830bec826482a73a1a35cc7240e5b16479582567f89661cc5460ac8df

SHA512
0335358209ccb452a3ce44be9e44346992d3f4118c4d8c3259dede29d14e77d5b9146459c79a554500849266e2eeab00beadbf4b0530c14348ee3eb6f180233f

Download Submit
/data/data/com.wufan.test2018031397553721/files/umeng_it.cache

Filesize
158B

MD5
2a666920bcb5e0968bb2c05830940a38

SHA1
3428437c98eaa1e9b7022f2139b36a3a2a2eb8d6

SHA256
719721a758c35907ce011c841f3b940fce1b087bbc6108fa5b2e344aabb5eb9f

SHA512
7669b4d279753bb59a9acfaef44f612e9f09e663cf517ea1f6198852f9bdbbde9de9120d1fc5fd6b4987a9fabc1c5c24a67a10d7c9158e84b12af6b6ec326cfd

Download Submit
/storage/emulated/0/.papakey

Filesize
36B

MD5
e2185b207d1c3998e502e2cb586d6c1a

SHA1
aa3d87d694e9070705bfd6ddffb24b3403983585

SHA256
a0fea9bc2096b390099bb9fa5b9c73a427b689c12f4090b83077a15dae04093e

SHA512
da64df4edd540dde2bbbfa64df6d64b0caeea0076f2c43f600c60acca09154cba5691b5be4a7a716fc3fff9806ba00bf6d491ae0dc411955b717548b1b3608b2

Download Submit
/storage/emulated/0/Android/obb/com.wufan.test2018031397553721/sdkinfo.txt

Filesize
6B

MD5
c7c8d45e0fc1a2ac188f9b0a62f1a797

SHA1
ffe2c07fa6f7f6b99e9be07d89c766dc029b846b

SHA256
91bf44d0a10bdb192c372abd8362e5089b7da61c9dbb2dffc0d936b0f33b5caf

SHA512
6abc5570f847c76a8f091301c26679321be9e27ea4fd07d067227937b3ee7d1a4c6e0020e4bffa769ea0d9355604e390ca29d2c998c2ca49a9341cec57a54755

Download Submit
/storage/emulated/0/Mob/.iew

Filesize
64B

MD5
d62b25791b9f8972176645601373ffbf

SHA1
03bb840c1867ffda55c486a53fc36a9ad95ef4fc

SHA256
2050f5a0e4bce2cc95fedb74e8438f87814131057ba93f8b5e175be144bd5ae9

SHA512
21de1d2fced190df5709a7444cc2300c850537aa91a26a2ddb6d87fe59321f54e1b96e616ad1462f41a1d73db837beaa36333bcd6b7e2be29dd25c261e29c112

Download Submit
/storage/emulated/0/Mob/.slw

Filesize
66B

MD5
19402718bfb1c685a726b4e1d846ad98

SHA1
02a7e30044a67085f2f1da24e16e4ecfede65b72

SHA256
079f790e6a1934a94542559f53a89a824aafd3173d956b6019291955aeeb33d0

SHA512
25254318c22cfd301c8bcd479f45797d502b6ab5f14265dadfa3d87b4dd1942a629d3cbc2f0b600cf73b4fe910e3773432f56a0a7b4343e280e20c5a6af0320b

Download Submit
/storage/emulated/0/Mob/com.wufan.test2018031397553721/cache/comm/.mps

Filesize
26B

MD5
840eaa01e5d03fffee257ed5ce4fba9e

SHA1
886bd732b29f6dbdd94b890a2b203c5a276ae773

SHA256
7648e772307acf936c331c4ea9d92872b1af6367cbf83f33f569ac204df65595

SHA512
b0a4f9238c4b60bec0cca9c72e551a702a95210a735bd8176c1d5ba741e264d2f1e885d65ed07a88086afd74f69c5e02a92db8068b222a62c6f56762a26b7d4d

Download Submit
/storage/emulated/0/Mob/comm/.di

Filesize
57B

MD5
70a42cba408700f9a6c01c7941a8829e

SHA1
eab01cc2c0671538795fb0b1146017dc099d0984

SHA256
499576707ce2623293166979e59c832be5b8636c64ad39aa63ebcf961910c35f

SHA512
8900d4dc8eed0430babbacb72942401bd22ef7fe5430cad90d3ce0c2c53010220d666aa0e2eb1026f3ec81d574c7fa12585b49222a5f15b01637f6ba134fe70c

Download Submit
/storage/emulated/0/aray/cache/devices/.DEVICES

Filesize
32B

MD5
1a2f8e6dee195add920fd9e5f9c3ad0a

SHA1
e50ea22d83a663f5a4fc6835b177f4ce514e0f84

SHA256
233df8cd10d4be9feb4cc7948516042899fd5897bcdcd39f845c0219fe3f1d6f

SHA512
d25f1ee4b306b39bd3a51a118b2a208a6f0ff725b39523e902da664a546bd0a47071a85111b546a874931eef5153b3ba6d5ae4ea884ca6213216cc394108ce73

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads