76bf18f16e9c88871a51b741e5d2d527670ea12acc80a0c8f71cb0b631f76b3e

Analysis

max time kernel
18s
max time network
139s
platform
android_x86
resource
android-x86-arm-20240506-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240506-enlocale:en-usos:android-9-x86system
submitted
12/05/2024, 02:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

37c49d5f869b365387c292e62026b53f_JaffaCakes118.apk
Size

21.2MB
MD5

37c49d5f869b365387c292e62026b53f
SHA1

b56dc19dbfe30de623fb957cff998cd55102a1cb
SHA256

76bf18f16e9c88871a51b741e5d2d527670ea12acc80a0c8f71cb0b631f76b3e
SHA512

8383b63b6301008cf1bba3f31f1368615b5914e90e359125eb66dab445b1cc27d2f9847696b9e2a3e62b96b6b78ea7a6ae30a36e90d04aa33b612ba5fcdb8b1c
SSDEEP

393216:l/7sd7GkqQuH5zDIiJnSRtcIZq45vDdcrAL045qxAFcZGMxvTgXhn6bfWqNdLrKN:tsd7bsH5tJnSRXZqMDd2A4qcZGMxsXAE

Score

7^/10

discovery evasion impact persistence

Malware Config

Signatures

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	cc.fedtech.rugaoapp

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	cc.fedtech.rugaoapp

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	cc.fedtech.rugaoapp

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	cc.fedtech.rugaoapp

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	cc.fedtech.rugaoapp

cc.fedtech.rugaoapp
1⤵
- Checks memory information
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4200
- /system/bin/sh -c getprop ro.board.platform
  2⤵
  PID:4230
- chmod 700 /data/user/0/cc.fedtech.rugaoapp/tx_shell/libshellx-2.9.1.2.so
  2⤵
  PID:4251
- getprop ro.board.platform
  2⤵
  PID:4230
- /system/bin/sh -c type su
  2⤵
  PID:4278
- logcat -d -v threadtime
  2⤵
  PID:4306
- logcat -d -v threadtime
  2⤵
  PID:4324
- /system/bin/sh -c getprop ro.miui.ui.version.name
  2⤵
  PID:4345
- getprop ro.miui.ui.version.name
  2⤵
  PID:4345
- /system/bin/sh -c getprop ro.build.version.emui
  2⤵
  PID:4370
- getprop ro.build.version.emui
  2⤵
  PID:4370
- /system/bin/sh -c getprop ro.lenovo.series
  2⤵
  PID:4397
- getprop ro.lenovo.series
  2⤵
  PID:4397
- /system/bin/sh -c getprop ro.build.nubia.rom.name
  2⤵
  PID:4423
- getprop ro.build.nubia.rom.name
  2⤵
  PID:4423
- /system/bin/sh -c getprop ro.meizu.product.model
  2⤵
  PID:4447
- getprop ro.meizu.product.model
  2⤵
  PID:4447
- /system/bin/sh -c getprop ro.build.version.opporom
  2⤵
  PID:4473
- getprop ro.build.version.opporom
  2⤵
  PID:4473
- /system/bin/sh -c getprop ro.vivo.os.build.display.id
  2⤵
  PID:4498
- getprop ro.vivo.os.build.display.id
  2⤵
  PID:4498
- /system/bin/sh -c getprop ro.aa.romver
  2⤵
  PID:4523
- getprop ro.aa.romver
  2⤵
  PID:4523
- /system/bin/sh -c getprop ro.lewa.version
  2⤵
  PID:4548
- getprop ro.lewa.version
  2⤵
  PID:4548
- /system/bin/sh -c getprop ro.gn.gnromvernumber
  2⤵
  PID:4572
- getprop ro.gn.gnromvernumber
  2⤵
  PID:4572
- /system/bin/sh -c getprop ro.build.tyd.kbstyle_version
  2⤵
  PID:4601
- getprop ro.build.tyd.kbstyle_version
  2⤵
  PID:4601
- /system/bin/sh -c getprop ro.build.fingerprint
  2⤵
  PID:4625
- getprop ro.build.fingerprint
  2⤵
  PID:4625
- /system/bin/sh -c getprop ro.build.rom.id
  2⤵
  PID:4650
- getprop ro.build.rom.id
  2⤵
  PID:4650

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/cc.fedtech.rugaoapp/databases/bugly_db_legu

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/cc.fedtech.rugaoapp/databases/bugly_db_legu-journal

Filesize
512B

MD5
6eecc1d8d84d031db8928171fe27f8f0

SHA1
28bca1a2ce07e6eca0610d8a07c8e04ae03ca74e

SHA256
6b88173bca530bd219fae31f6d3073e1e5ebeee2d9085081e83807564ae96ab4

SHA512
6013084bc92f491d80f723077b527b917770ae054e2ad02355620471411b74e38f4dfb6da6b7422e59088847a96e297ee3601fdcca08b03bc5ac8c8c076c04ee

Download Submit
/data/data/cc.fedtech.rugaoapp/databases/bugly_db_legu-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/cc.fedtech.rugaoapp/databases/bugly_db_legu-wal

Filesize
245KB

MD5
c66dff415ac2d3046247df9ab0fe6ab4

SHA1
494d7b48e0c8fe910d1e6bee9b1abbd75e8da278

SHA256
ddae7e62a793cea47e6a1ffce54a3ec367d77f920eaa4ea5963725912ee0bf49

SHA512
12367a425a20e7c7e0994bd043ccab99dd2bcbd5808c191e5862134d5660bab7803c7443dfb2128b86ea8caf19f23b2d7e5377de3d9a68905bb65e58fc27238f

Download Submit
/data/data/cc.fedtech.rugaoapp/tx_shell/libshellx-2.9.1.2.so

Filesize
113KB

MD5
4094c5a94b5af8f844e7d1dc13e52432

SHA1
95af46988df8cbbcc50bf6ebe12f5ff65e2c0fd8

SHA256
8c3b75952dd7bd2584e930a05d7c4c07079fff2ceb0dc95891a6ccef50c1554f

SHA512
bfeef3ba42bf63a147a9363d485dbd64224ac5add0ae24471ef7df97639a3c4bac2080ee184f7a23e9f1afb7f88d2f03ae7102b72a54445bde97e6b7e8beb5e0

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads