cdc65e4f71e8f4ca094bd2da188b274e254c65da18d36e67ff220bc0ef4fbdf1

Analysis

max time kernel
151s
max time network
157s
platform
android_x86
resource
android-x86-arm-20240506-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240506-enlocale:en-usos:android-9-x86system
submitted
11-05-2024 11:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

346aa2fff72cfae8208771c4d3154066_JaffaCakes118.apk
Size

30.2MB
MD5

346aa2fff72cfae8208771c4d3154066
SHA1

182963b5880c7552cd8b2aac20a68e404da2db89
SHA256

cdc65e4f71e8f4ca094bd2da188b274e254c65da18d36e67ff220bc0ef4fbdf1
SHA512

b6f351a95119265600c6317061401ad331a2041ba586d4949f87382a4a79eb5dd5963a8ac3502f35ac658b2fa6e16437200c3db088aeb332f267964541c42ea1
SSDEEP

786432:RkQv81FIC7bKFMPfw1Yf4afPsE+9n9MvWYIqLQTvX3S:Rk1GC7bKS+Yf4afPsLx9MuYIrS

Score

7^/10

discovery evasion execution impact persistence

Malware Config

Signatures

Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
evasion discovery

T1633.001

T1426

Processes:

com.yxxinglin.xzid9444

description ioc process

File opened for read /proc/cpuinfo com.yxxinglin.xzid9444
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
evasion discovery

T1633.001

T1426

Processes:

com.yxxinglin.xzid9444

description ioc process

File opened for read /proc/meminfo com.yxxinglin.xzid9444

description	ioc	process
File opened for read	/proc/cpuinfo	com.yxxinglin.xzid9444

description	ioc	process
File opened for read	/proc/meminfo	com.yxxinglin.xzid9444

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

T1424

Processes:

com.yxxinglin.xzid9444com.yxxinglin.xzid9444:channel

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.yxxinglin.xzid9444
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.yxxinglin.xzid9444:channel

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

T1421

Processes:

com.yxxinglin.xzid9444

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.yxxinglin.xzid9444

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.yxxinglin.xzid9444

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs

persistence

T1624.001

Processes:

com.yxxinglin.xzid9444com.yxxinglin.xzid9444:channel

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.yxxinglin.xzid9444
Framework service call	android.app.IActivityManager.registerReceiver	com.yxxinglin.xzid9444:channel

Checks if the internet connection is available 1 TTPs 2 IoCs

discovery

T1421

Processes:

com.yxxinglin.xzid9444com.yxxinglin.xzid9444:channel

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.yxxinglin.xzid9444
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.yxxinglin.xzid9444:channel

Reads information about phone network operator. 1 TTPs
discovery

T1422
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
execution persistence

T1603

Processes:

com.yxxinglin.xzid9444:channel

description ioc process

Framework service call android.app.job.IJobScheduler.schedule com.yxxinglin.xzid9444:channel
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

T1471

Processes:

com.yxxinglin.xzid9444

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.yxxinglin.xzid9444

description	ioc	process
Framework service call	android.app.job.IJobScheduler.schedule	com.yxxinglin.xzid9444:channel

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.yxxinglin.xzid9444

com.yxxinglin.xzid9444
1⤵
- Checks CPU information
- Checks memory information
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4252

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
2⤵
PID:4378

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
2⤵
PID:4400

com.yxxinglin.xzid9444:channel
1⤵
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Schedules tasks to execute at a specified time
PID:4491

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.yxxinglin.xzid9444/app_crashrecord/1004
Filesize
240B

MD5
7ba4067d1e6ddf997d65d6b8e6e79e49

SHA1
f800d1b56424ec8ef79e53f666c190ff2768bc7a

SHA256
d2dd7746c62cbe3fd61252e0d1f0244723252df3cbfc71417ab8e8620671cc9b

SHA512
f46d8f9e791fb1f5775fa946662f7bdbed54e8b1e3d0383f019ec7e6f1eee0286055690d81005b7fa2e572de5f54275dc99d34bdc7677795b058afeeebcc863f

Download Submit
/data/data/com.yxxinglin.xzid9444/app_crashrecord/1004
Filesize
58B

MD5
0d210bfb2a0e1f1b4c082a6a0f79de07

SHA1
bb8ed9e364db79d1d9f2fcde3f15091893222faa

SHA256
988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d

SHA512
536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1

Download Submit
/data/data/com.yxxinglin.xzid9444/databases/MessageStore.db
Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.yxxinglin.xzid9444/databases/MessageStore.db-journal
Filesize
512B

MD5
c73ac9ecdfccf39b91c3b7f2995dac98

SHA1
d89ddde8cf005dad693d7cbffe4a3c3dcfccc198

SHA256
9ef8690452531dacccd51e3b115dc918200d57d22c0ad7fde5c80c2fe5bd25e8

SHA512
42da8a1fea848b57d86111a3b5124afd23d6f2b036ca15428f1461d500c7eab4a3de3c68e9697321c112161fb63d9f3926450bcffd4460af11d914bb3fc7c0ec

Download Submit
/data/data/com.yxxinglin.xzid9444/databases/MessageStore.db-shm
Filesize
32KB

MD5
cdedd5955ab76470343d29354713ead8

SHA1
1bc86aa6b771196487f1813e66ef01d0dd9b824b

SHA256
00c23e5b8e0ac2668daf4181b2a4d4b428cc43d489e2a455bdcb018c66676283

SHA512
3bc4b4d69e6473d114cd49af8dfdb0d184bc521e59a03d9553b32728695ada6ea8c8011d68e90f91226267c2eab3a96b95b277af108f66faa583296731a57993

Download Submit
/data/data/com.yxxinglin.xzid9444/databases/MessageStore.db-wal
Filesize
48KB

MD5
8fb99e998a425964dc58560ea5a40ca7

SHA1
f1376d42c3716de5350e813b33ad6d8ca035e63c

SHA256
7889e1454cc878a022f08f921262983297283ad7d4d610c1510c28dd75a59a6d

SHA512
2598a730ef28771ca6a6a02bdb6db43141256d6951c3ad3d3526f226b769a291ad4a9fb7b35f38f38b31d6a41ee90fd2211005fbf657e3f5d7b41388dfc93478

Download Submit
/data/data/com.yxxinglin.xzid9444/databases/MsgLogStore.db
Filesize
4KB

MD5
da82bf1a410414b8444b5b429c2d33ea

SHA1
34230ee6e035fc88e5b3d2b1d8d3db9e8cae0166

SHA256
010d5ea866bd2d3e1a59060a73e5a4754c0176266389b3878073a39db24f0711

SHA512
3410ac5ddefb83b8758abbf3234093606c1666c7c8e3c8a24e12c5f7c552f2cdff4c4e717e9fd2b5b34701e8bec9f44133574c7b6e938b7203530c5536ff2d30

Download Submit
/data/data/com.yxxinglin.xzid9444/databases/MsgLogStore.db-journal
Filesize
512B

MD5
2f2d077c54a0fefc55352f2654735dd7

SHA1
4e016b8e03f4f8a05c8170dff81129db432459ac

SHA256
ff01c3b78490c91c66b88c6c4e85ab27e7311f6c43ea3c6c997e9d79572e08e0

SHA512
4f8651933a0a96f046ecb3a26459232e371a0f06bf163ff206e2e0292b96d81d965b05d1aadbb05c1f73766641718e10ff19034b14f3c32f65e8608b53bb6c1b

Download Submit
/data/data/com.yxxinglin.xzid9444/databases/MsgLogStore.db-shm
Filesize
32KB

MD5
dc4236b774a9bb51b5c945a8f3480f84

SHA1
2f7b53362406bb2c7321dce39b85e6a040efd4be

SHA256
a857f55c0b58759296939eb275dbf3b01a03f8c6050cd235d24e02ab554a1c9f

SHA512
88520f1ad37ab450be6c9f070c091b4c1ce8b1ffe6c8473cd644d35cca64ce43f8dfa34c3a0eec9b7cbb75cede762800819357914a776029c89d796f7ecc6588

Download Submit
/data/data/com.yxxinglin.xzid9444/databases/MsgLogStore.db-wal
Filesize
68KB

MD5
9a6c50ad6ae80ac331029ea2ed5b6c66

SHA1
4922f91cba02648a9366a02d74cdd8c936f47c7c

SHA256
81a99850696f3908f3ba54c88637fa0b52bc73014af9b021ca88ff2656982a57

SHA512
578a1bca04b63678a393d4c0d9d1c3edd47fccc832119b1494df2dc17389ad55f59545f4e4ff93e60a2ea4728c2fe5ac7d8af3109693948c0cb9113d60c7fbde

Download Submit
/data/data/com.yxxinglin.xzid9444/databases/accs.db
Filesize
36KB

MD5
486e2bac2b3e9e1cb411d2838a4854bd

SHA1
81dd0a7537f4af319b830ae834908986be85da8b

SHA256
5644a250fa6cef16c2c802b98275656a5fc39dcf89bcc22193742d85c7313f57

SHA512
c146789563dae163e373489b3df53f22efebd32b69643992969241eb5ad5eec668de67e7cd2aaf5c3a8af57b0842115d00183825734f57643d3fdb09835fe681

Download Submit
/data/data/com.yxxinglin.xzid9444/databases/accs.db-journal
Filesize
512B

MD5
5ffc355df7492b34b7da78e34033eb3b

SHA1
0d3ee787f7904eca0fa0811248815af4f5e90112

SHA256
e111f482b88d90b2858b18de7893e92e79280aa29d66f7ed1782a17af0a94367

SHA512
df6b0f1ddaf8c4bf117641c57ef5a87cee77c86c032f92e72ed9df622abb69ee1dd90fffba4ae1d4d46471c6e40c6770ddddcc157e8a6fb49ac8bab4495750b1

Download Submit
/data/data/com.yxxinglin.xzid9444/databases/accs.db-shm
Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.yxxinglin.xzid9444/databases/accs.db-wal
Filesize
48KB

MD5
79bb74e6ce778530c6591de50dbf95a2

SHA1
08aa0e31bc830809291eb252562562662db73013

SHA256
81dceb47eace1930d874642e583ec36e663dc0757fc1be96f2ddb013d388b20d

SHA512
cd142e47c1f52ef7be19e7d8635d43f1e28cabb577e193f6ee49dfde40f6d59ace1f45d8e0f35e33d68621ca632abb724366cd88fe15493cbaa99627df6dc3ae

Download Submit
/data/data/com.yxxinglin.xzid9444/databases/bugly_db_-journal
Filesize
512B

MD5
ed4c48c5dada511ff229bfca929b6fda

SHA1
f12c5c5136871b9e8a92177192b7c33e09c48102

SHA256
d7e692804a9541c97c0acaee8048896c8465b8a835adacd982d91b72e5655589

SHA512
114dc69cd3c0c976b721ea7255ed806ff896e6e74c34197587bfc94cfb4cae2ea4e94ff48d9a9bc361fdd3a6d788ceccb0812e798c2786bdbc4ef06c0df3132a

Download Submit
/data/data/com.yxxinglin.xzid9444/databases/bugly_db_-wal
Filesize
68KB

MD5
fcd8ef370968ddb8ec6ed0a6e8150ce6

SHA1
c6b8218f1566ce9a89e9e98dca901a58d9cfab40

SHA256
dc2d0c71e1dc7e42b90b27b1e5cc95910ec39765be6f7e78ac2492d36f6579cf

SHA512
dc78e251ae1575c2184891ab5f72b2075c28b8b82e13f615ac14b1b94062cbd554c52ed94c38cc342ced271761dd6a40fa1135b18b695231e4a97dd3ba1b40e9

Download Submit
/data/data/com.yxxinglin.xzid9444/databases/tencent_analysis.db-journal
Filesize
512B

MD5
0be14d3be007d565251cfb7760fe5d13

SHA1
df8f34d8aa8b381676fb1f4d5f9ca5725e7b8187

SHA256
a60859e8230d61b6e994cdec833f4f16cd0143afc480f74efd1eb14864cc685f

SHA512
8d3951be133126b15de54eb9946586b4bfb8c33f0f87b14aec70c77a4ec1a97949024abc71bef97bd4e2a799e70e175245ca897ecc8539098d3280b0b05fea98

Download Submit
/data/data/com.yxxinglin.xzid9444/databases/tencent_analysis.db-wal
Filesize
76KB

MD5
c368f0db55e5366b49e86a48413f5865

SHA1
da2cfc73dce6291882f6dd95190c00479300d2f2

SHA256
0688a3ebf1eac5fb8954ad877fe058f2af0480117311966f928cfaa49eae3569

SHA512
5fef3aaaa195d22aa1c523afd42d138afd32d0a8d5146013695877d0b14c0f52e2a1248d2edd90d1bad1146ed444420417786618a8f3ca911a77727324ca57e9

Download Submit
/data/data/com.yxxinglin.xzid9444/files/cclogs/2024-05-11 114153.log
Filesize
1KB

MD5
326bbd362f4bb1770c6dd46b7386eade

SHA1
9e0e349b771e6a3f05928fb5d6c404687b1e7420

SHA256
e99e0bff164c52d06fe302e59fd3cb2ef5d64b7804b709f4261b35a2a3a0f60b

SHA512
0a7b95464946fc136a84fa9ca3e0661e02652e211e77f7d000839125974d59aa23c739923711053e2892fe45cb9a5ba6e41de3e7ffa63c72247f5ba8e34934e7

Download Submit
/data/data/com.yxxinglin.xzid9444/files/com.tencent.open.config.json.101400326
Filesize
1KB

MD5
f526172de1566b34fdcea744710d9559

SHA1
000cb54d9a008a807a1c5a3fd2b2e7cb41e7939d

SHA256
8572be02b59f4d514000939ec04a9b4e2380c55265256b724a617d8d0f4c6940

SHA512
dc81f0fe345b18c96b1638c67b9ef4c5e60059dfc4a02f3c30a23645d4847abeef46cf467d044c42597115c48052ce0e8ea24328382114a544c5dfd039a95e7d

Download Submit
/storage/emulated/0/.DataStorage/ContextData.xml
Filesize
111B

MD5
90b3a83b037ea203345f9b97e0641f26

SHA1
313039f012178c66d831da1c3caf979f305b0334

SHA256
70e81d685320e0660d8665871dc22de71024cec2d82a35a7a13eae3ccaa41ee0

SHA512
e56689553d43adfbe6b2a7ddd6cb5f59c5645ea42c6d297a32aa50241f177a81b29fbcd617e8378357b9349f68c105989491c5ede47c424cb5c476c9cb2d9c48

Download Submit
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Filesize
65B

MD5
9781ca003f10f8d0c9c1945b63fdca7f

SHA1
4156cf5dc8d71dbab734d25e5e1598b37a5456f4

SHA256
3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793

SHA512
25a9877e274e0e9df29811825bd4f680fa0bf0ae6219527e4f1dcd17d0995d28b2926192d961a06ee5bef2eed73b3f38ec4ffdd0a1cda7ff2a10dc5711ffdf03

Download Submit
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Filesize
111B

MD5
98992098af177f691f3f501bb3a52131

SHA1
7c90e008e6c6022c0313e7c8fda9b25fcaf90ca3

SHA256
ef6facd04dcca94884a1b81124ea9a1f943bb94f1e91633045fd6af63e7a2364

SHA512
d45e79ce05a83d5f8daf61bfecc6f045c6dd60fcd6430a6d0f813d7199e68f567ac07a50156ff879043ce17cf5b04237209b39f217891b6eb6f9c51e6f7b44f6

Download Submit
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Filesize
381B

MD5
3e72e9a300b504164689dcb813ba515b

SHA1
2f63c5e1a2abc73aa881f2e7ffabaa38a26fa52f

SHA256
1a3a331f4978e33519185ccacae82fc1fce316e57e20e3502def33b91b929744

SHA512
79a1650b943c8eafe0eed8f912dd5dfbc5be6aac3368ea40857eb05da2a0f9abb8a4df8238b24eafada99278b65b449fd5d05c1c9c385bed874e2322f612ccb1

Download Submit