afd8e031340cad1ef228ae96146a909f36c134bdfd700c8462ea26122e7aed3e

Analysis

max time kernel
150s
max time network
156s
platform
android_x86
resource
android-x86-arm-20240506-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240506-enlocale:en-usos:android-9-x86system
submitted
12/05/2024, 07:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

390c038c2d2fc5b59f0be63fb54be3de_JaffaCakes118.apk
Size

6.4MB
MD5

390c038c2d2fc5b59f0be63fb54be3de
SHA1

831500e654e74b6323be3a4747f0af7f4c82c412
SHA256

afd8e031340cad1ef228ae96146a909f36c134bdfd700c8462ea26122e7aed3e
SHA512

c5408cc57e7455d4d7b5fa31bd0e33dd988538b1d5b00544c04e16c5beaca1e2de16439037c9bc5020298614c0432b52e13d9fb9a390bef82d62f7b139634651
SSDEEP

196608:2pdE5YQH/VEHVyyig/96yo4P97sHSqc6XO:cdvQH9yVyyj96yhT

Score

7^/10

discovery evasion impact persistence

Malware Config

Signatures

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	ldow.hum.ck.qylc

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/ldow.hum.ck.qylc/app_pgzcr/classes.jar	4295	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/ldow.hum.ck.qylc/app_pgzcr/classes.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/ldow.hum.ck.qylc/app_pgzcr/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/ldow.hum.ck.qylc/app_pgzcr/classes.jar	4235	ldow.hum.ck.qylc
/data/user/0/ldow.hum.ck.qylc/app_pgzcr/classes.jar	4235	ldow.hum.ck.qylc

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	ldow.hum.ck.qylc

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	ldow.hum.ck.qylc

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	ldow.hum.ck.qylc

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	ldow.hum.ck.qylc

ldow.hum.ck.qylc
1⤵
- Checks CPU information
- Loads dropped Dex/Jar
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4235
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/ldow.hum.ck.qylc/app_pgzcr/classes.jar --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/ldow.hum.ck.qylc/app_pgzcr/oat/x86/classes.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4295

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/ldow.hum.ck.qylc/app_pgzcr/classes.jar

Filesize
71KB

MD5
77cc5a5aa67291b28a3245a5b004c17e

SHA1
6b23901bcb8d5fb1c4efb961f9ca3f4f6c300cc4

SHA256
a3ce9ea2c646b692e9ecd4e923bd5e22cdd6fe2fb82fec2e48b321eee180f4ea

SHA512
02947b6d0fe3343d658b63126d710b57d3970042e7b38ced7970b83662349c8b8e042358957e8c9115426119f94018cd55f54d3b1b96e3825a798a214a041d94

Download Submit
/data/data/ldow.hum.ck.qylc/databases/dbubgmj

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/ldow.hum.ck.qylc/databases/dbubgmj-journal

Filesize
512B

MD5
7adefc3332ed8d858d9db387ad6c7032

SHA1
d373c85ce05860bf2df75b46f447c5154c01498e

SHA256
afaaa57b02460c64f3d4d73a420e92dad593a664414e2e8470ded65bc9cc9e44

SHA512
866c6b108f2cec5c0162cc53bf9de43f862dc6b933d2ab496359d2931cdf8994edadb8d19f94c4f4bf527dd822f29a0cd4bccdc2e7706ce2c5a435a65197cc2f

Download Submit
/data/data/ldow.hum.ck.qylc/databases/dbubgmj-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/ldow.hum.ck.qylc/databases/dbubgmj-wal

Filesize
221KB

MD5
bf4de87b8831d29777facd2b73688978

SHA1
729f11b48079306623d0f99068cf1d3e62a0f034

SHA256
8a6c42e937b7c9a32a88ba492a51a75980a81db9f790cc7672de037e25ee1c55

SHA512
3cd0327c1f6c3b531482a01fad97006fe461fe20a4e3f4ea67bf292957abf44b7a464523c77cd4a3ac96af2c5736f854337fcc76ff1e5a172e2a6a41b8a6f13d

Download Submit
/data/data/ldow.hum.ck.qylc/files/.um/um_cache_1715500462101.env

Filesize
600B

MD5
8e3098b811993d62187cc152255eb3c0

SHA1
afde61fa1a0018fd3508648da7df6df80b96cf3f

SHA256
c3c76950bbc2fb7aec1122081c835ef97b94185d07bd7d7d1eab35d68d8ecdc1

SHA512
c4c65578c4cb3e9d69e31e042a747be428cc439b7a9a753253a8fa013a2b04d28155d9ad4704e2bb99843cd5abd7174b0bb007fb9b2f8e76e5e2b8def66088ba

Download Submit
/data/data/ldow.hum.ck.qylc/files/umeng_it.cache

Filesize
310B

MD5
60594e6e0f2e019234662327e5d136b0

SHA1
ffb8df801f167d1fd3bc7c3d0d1a8d7c848c9015

SHA256
0847fb1598b675a6743f4273e5f13715527a3cca00864d1e2cfd149e71ce3d62

SHA512
87eecbd0f9aad2440e6dc92aaf8be593ebfc48b60ffa20a15a5b6e3f835e129c9d868b5e7afd1168ba9ce7fe4d9d29d8b6425f9c7b51efceac18ab8bc63a5459

Download Submit
/data/user/0/ldow.hum.ck.qylc/app_pgzcr/classes.jar

Filesize
167KB

MD5
ff2625c682a27b7c33c4edcee1edf2c5

SHA1
8213dbe9c0989cc081e7b8cbccd37c83bd351268

SHA256
82946ad2f7ea57d2f45f57ec5ff1a3234aad29163d7505fdcf64612981564d39

SHA512
e4f4fc0f1212f41630ee2a4089b29ff9c1ae45fe708dd56eaa8d5a59937f6d4eb2f736c6a893020d6348b49c6d5f24ab129eb3981507ef2da215eb20ec467566

Download Submit
/data/user/0/ldow.hum.ck.qylc/app_pgzcr/classes.jar

Filesize
167KB

MD5
91eba06c541f35c2dbe6b5610858dd53

SHA1
f92f5e3414bb09e1243f16d178f6b428351d7bbb

SHA256
4f5dd2ca019931d075b75f7717529d071ac9cdac7a8d179c9679863ab4e2f5d6

SHA512
4291c29666e40eb708f98d64323faeeb3c04f323b205c1687e11a79704ec71cba572504df121191d9ab43c0e5ff1d51a5ea91e831f7c359e83deb78ca644edcf

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads