Analysis

  • max time kernel
    149s
  • max time network
    167s
  • platform
    android_x86
  • resource
    android-x86-arm-20240506-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240506-enlocale:en-usos:android-9-x86system
  • submitted
    13/05/2024, 20:58

General

  • Target

    3c8c163a3be06fac9473d38e0c739206_JaffaCakes118.apk

  • Size

    24.9MB

  • MD5

    3c8c163a3be06fac9473d38e0c739206

  • SHA1

    4141775e93ff4592d42cab2b8386e0f873ebddbf

  • SHA256

    cbb8bbc5a1bb603a019eaf2aaa06314be37b18acb0e4ecca25250f8f33a638c7

  • SHA512

    c97225c94e6291fce5b355b18ed86c5efa3edd0154f2425b13d2e662b61e3976f2ce2176d7f18904318be44cfe8bd88f48561a78f74e320f83ff36494ef99569

  • SSDEEP

    393216:XRRgO81/LcBZ5agn4GVOnY1ASjL4JHXBl/RNWNwZlGCNntrZdOW5uEezv7P:hRgdLcBZ5aZG8d8L2BluNsNtriT7TP

Malware Config

Signatures

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

  • Checks known Qemu files. 1 TTPs 3 IoCs

    Checks for known Qemu files that exist on Android virtual device images.

  • Checks known Qemu pipes. 1 TTPs 2 IoCs

    Checks for known pipes used by the Android emulator to communicate with the host.

  • Checks memory information 2 TTPs 1 IoCs

    Checks memory information which indicate if the system is an emulator.

  • Queries information about running processes on the device 1 TTPs 4 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
  • Checks if the internet connection is available 1 TTPs 3 IoCs
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
  • Reads information about phone network operator. 1 TTPs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

Processes

  • com.lianaibiji.dev
    1⤵
    • Checks CPU information
    • Checks known Qemu files.
    • Checks known Qemu pipes.
    • Checks memory information
    • Queries information about running processes on the device
    • Queries information about the current Wi-Fi connection
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4199
    • /system/bin/sh -c getprop
      2⤵
        PID:4244
      • getprop
        2⤵
          PID:4244
      • com.lianaibiji.dev:ipc
        1⤵
        • Queries information about running processes on the device
        PID:4379
      • io.rong.push
        1⤵
        • Queries information about running processes on the device
        • Checks if the internet connection is available
        PID:4413
        • /system/bin/chmod 777 /data/user/0/com.lianaibiji.dev/app_lib/x86/push_daemon
          2⤵
            PID:4479
        • com.lianaibiji.dev:pushservice
          1⤵
          • Queries information about running processes on the device
          • Registers a broadcast receiver at runtime (usually for listening for system events)
          • Checks if the internet connection is available
          • Uses Crypto APIs (Might try to encrypt user data)
          PID:4462

        Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • /data/data/com.lianaibiji.dev/app_crashrecord/1004

          Filesize

          58B

          MD5

          0d210bfb2a0e1f1b4c082a6a0f79de07

          SHA1

          bb8ed9e364db79d1d9f2fcde3f15091893222faa

          SHA256

          988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d

          SHA512

          536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1

        • /data/data/com.lianaibiji.dev/app_crashrecord/1004

          Filesize

          4KB

          MD5

          f2b4b0190b9f384ca885f0c8c9b14700

          SHA1

          934ff2646757b5b6e7f20f6a0aa76c7f995d9361

          SHA256

          0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

          SHA512

          ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

        • /data/data/com.lianaibiji.dev/cache/tomb.zip

          Filesize

          513B

          MD5

          ebacaffab57c93ac3ff3a3cff1a612c4

          SHA1

          1b12cbabafe0e147f56f524e727f76aea20b2ea6

          SHA256

          c9d2db101ac623dc5170e85cd308bca48dd48f7f84dd4bd0c9838de7d1c04870

          SHA512

          36e57257b727cddab894dc39d2ff6328c8bf3ae166ee17e9f9e23b55cc6ab473fcd1cd5275e83b52e3a2fd3819bf5d7c1e4cd8b3a317ec571f73fe4fc10db87b

        • /data/data/com.lianaibiji.dev/databases/bugly_db_

          Filesize

          22KB

          MD5

          95a6ae7e536798bf76d664d87e2ad308

          SHA1

          2acf3429c4980bb0eeeb098c796eaf8ade658af9

          SHA256

          add1f58ec0502154bd2538b187dbdfea1057213a9d8ed479f94c64902a9a7218

          SHA512

          c5079e3240b5ccefc836f8831e76eb3a99c50bd73dafe5469555f14c641aebd9710b4e83d3e542432d69e28543fd405100a5884fb204ac08c7162ba8bbed2f19

        • /data/data/com.lianaibiji.dev/databases/bugly_db_-journal

          Filesize

          512B

          MD5

          999f521a2ca9b5aa911da40ab42be47c

          SHA1

          02dbcd45cd2f2e515c05b4d336747a18c74417a9

          SHA256

          dd241ee9ccd383b49763f347a515b429d2410bf99a5dc83f3b27ed6f45ee5d32

          SHA512

          d503f0687ad84dcd38ef719b7f799cfb016d5eebb6aa912ac5d32e4d526f1792e4efedb8284d42c1f34cec6ede4b731319040687ea0c436fa92ac7046bcdec7f

        • /data/data/com.lianaibiji.dev/databases/bugly_db_-shm

          Filesize

          32KB

          MD5

          bb7df04e1b0a2570657527a7e108ae23

          SHA1

          5188431849b4613152fd7bdba6a3ff0a4fd6424b

          SHA256

          c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

          SHA512

          768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

        • /data/data/com.lianaibiji.dev/databases/bugly_db_-wal

          Filesize

          289KB

          MD5

          cbd28527b202ad71d499558af0983ef5

          SHA1

          62d44ebaee4332aa27f556c2de025ebcf39c82a7

          SHA256

          1dcbb965a6baa84f616cb72bfda933962e36e72db01ba92c2ef4d73ffc802765

          SHA512

          7b0620a38b8a4d6793a63ec2d0a80962390df7000317517584aeb956774f6fd32423d6bdc891988513972144c692dc0bc6b4653ee2115274cac24053fe8ad6f1

        • /data/data/com.lianaibiji.dev/databases/lianaiji-journal

          Filesize

          512B

          MD5

          108f0ffff9572786ed66e0b22939b040

          SHA1

          96570c0d91967ae48ebda6041bdd250c865557dd

          SHA256

          e1726289aa159eb56a9857e84e512cfbae2d8b9e13e656e05cf6e969ca3dd219

          SHA512

          452c1e3a915a086ad6b64fb200fd728f2301fc465953a1fe6e177a4563cf5c2f65be5c0ad80e632e67ea8b8aea228d0539382b8eb5dd61fc84f5d4d9c0228634

        • /data/data/com.lianaibiji.dev/databases/lianaiji-wal

          Filesize

          20KB

          MD5

          575975bbde8b01da5fe0f13a07f68ba7

          SHA1

          39eb0e29bfde237d79ee23123bb3fc86d1cf852b

          SHA256

          17a15b44658c27a86f4fb60128167b8820146bd83f5acaeb7d0ce99bb54b2b00

          SHA512

          b862178e65baadbc31b15dc877ed3e7881aa641dc3203cbcbfc12748b8bdf212da9ecac0d25325f8d21fd5bc416a34da4cbef92d1a7e206a45159bab43fc819e

        • /data/data/com.lianaibiji.dev/databases/mintegral.msdk.db-journal

          Filesize

          512B

          MD5

          7fa0b0a05165630dd935a78f31a8ce2b

          SHA1

          d9d972f7a75f3246fd3e37bb8a75da4ac455dcdb

          SHA256

          07ee2c48f5cc8378e09817b6a0abc4fa506de8af90d39f2a52059bb73f12a455

          SHA512

          4d669d6c0fa8cf1ea162dbd3a70b6f46900f3c26949c29ea2ba96c746bc528676dd6a2c879fe080004366c9e8c9b05d747adad978a96c8c75a5d73e3408b73c3

        • /data/data/com.lianaibiji.dev/databases/mintegral.msdk.db-wal

          Filesize

          124KB

          MD5

          82c7cee9f4a51f21e2b2e6995ba221f1

          SHA1

          8e043097aa5eb385d44393832292c25b55237366

          SHA256

          9d395cfd6005a428f10d372f61e07f9b7cff91c60410129d55bee62c9d54d59b

          SHA512

          c5719814a658489c4483397930e21fd71098b8f9dfda9673b730d33085e009e5c1f4ac4cf573b038385073d1d9fc01d99630663b43cfd0ec3d70fbb8f1bdf6d0

        • /data/data/com.lianaibiji.dev/databases/ua.db

          Filesize

          40KB

          MD5

          a2c8ea957c4597e5db4c0a0d8e0c5ed9

          SHA1

          60e20b2855a3cf0725332849c7717c6d98875e1e

          SHA256

          c821fbe5f760f9087a3e1618936eab77433afb71558cffc0624ba2999bb33866

          SHA512

          780de46a7729ff1aad53afb51388c1cea55a8bb2f8a9de6e76c979c4bae0f9d58c83e772c443a2cb8b8e507a9aa399f0ad1400bcdcdb916d17f6c73061172b36

        • /data/data/com.lianaibiji.dev/databases/ua.db

          Filesize

          24KB

          MD5

          5a713039f39f5159fa18eaaefe967025

          SHA1

          e50d0649571010b3982ccebab927db8c2e288455

          SHA256

          bf3ffa8789cff33b91d7b6b6c77c46e2ddff24d76fd3fa40b3398541649fc34d

          SHA512

          dab2d147d99f43b972a44b338d928d0a628b235058f053aa557b0b3ba403c6e78212f9685620244ba707c342b310b3f07325741fb323069ca8bed37371aa4666

        • /data/data/com.lianaibiji.dev/databases/ua.db

          Filesize

          32KB

          MD5

          118f86cb0ef1a1927368a41777ef4865

          SHA1

          a4b61efb5dbafabc6efaa12535ecdd4914caa77f

          SHA256

          11728a8e3533c4bc88d6a8376af8ecb28fb5187e615f7beea02f85d33f433f3f

          SHA512

          db2742d886f44cac818bbea6daae7cae07fcf8e800ffba75bbc83b991519cfc6b903c4fb0155dd749844643472fd3f2778fed478db8e12bc94d3229affb300ca

        • /data/data/com.lianaibiji.dev/databases/ua.db

          Filesize

          32KB

          MD5

          e78a5bcd6ae2aaf46da5c953b6a2aaf1

          SHA1

          8a42e5c12dc551f9a10c81c6558e446e8bcc9174

          SHA256

          2c29972516f7a96ee44341e76eb5e8ab3d8b99d7f34482dcb2de687285b17ad8

          SHA512

          bd2275bfe2ffec84a2388a5e4f4deaf54412b489d2fd40e080d41ed769a1f2376732dcbcec419ea3f66f9ed3525ae876346e9a3f41bd05c563f494dd52434a72

        • /data/data/com.lianaibiji.dev/databases/ua.db

          Filesize

          36KB

          MD5

          ba9e8386f47bb920adffb3fe8e2bd762

          SHA1

          b25ccf2617ec07a293f77ae6b757932d1c9970a3

          SHA256

          4736dd9a57101888a22a63fdec3f3f76f0f093ed8110dc83f403d06e4e32df8e

          SHA512

          b2a33f57ba7bc1b481ea4a1a6a4a7cd086659b333fb80bdc6d7c8f5f7155a4391d0e24a9e167bf37b36ffdf8dcc92f0e12ccb7327942925646aefcde9d2bb6fd

        • /data/data/com.lianaibiji.dev/databases/ua.db

          Filesize

          36KB

          MD5

          3e8a91b095739d2044cff9b6123abaa7

          SHA1

          a6b4f3adf651f66a6db1b8938fe669974856e395

          SHA256

          fdde5fa77023fcc4b5af61ba42b48e2b46b55b26246934ee2f40937ea04bfc9a

          SHA512

          b0da48b1c15f3bb42e3efcd06aac0cc8daa4a0a08528ef18f23a0968b350898bcc91f709577548534e208ac81c36f6cd017878b043861508041c06d85679a250

        • /data/data/com.lianaibiji.dev/databases/ua.db-journal

          Filesize

          512B

          MD5

          5006f0810a5d79e3e54e883c0941f04c

          SHA1

          307e53df49dfdde6bf32cf75f0a6f2b720b7eaad

          SHA256

          cd73e8323206698fd1413a672e94d6a9a1cda04f12e5295ca95b6d2f34e4a672

          SHA512

          954f77676538e2c103ad0eb13153050443c1960fbd69b41cbd2cf5de04586d05072faa2561ab4bd059247733caddce31a1a0b9d07204f4ea83bc573633eff1b5

        • /data/data/com.lianaibiji.dev/databases/ua.db-wal

          Filesize

          52KB

          MD5

          a33a5e07ecbb9e2b724dab5fd710ca4b

          SHA1

          238196d438ccdf5191d56560d1c500e80a56835d

          SHA256

          4c824a7a342400fdcfdd6b5f769b0de43508afa71332ed94df5a8f1359a251c6

          SHA512

          d552e19c93675acdd26610a67eaf9a3c002a4a67b33ef1b39356856c3c534cee775432ac0ab60ccc69f2e42e70d5369c00295ede330c97f1cf344c5c66b25e3d

        • /data/data/com.lianaibiji.dev/databases/ua.db-wal

          Filesize

          12KB

          MD5

          967688960b42101cd6ddfc921fdd0ed8

          SHA1

          cbc2d6a3d8a4fdd4c353d5081c65b7952611e082

          SHA256

          d43af7458da185ffa3a48d8948106e83352222bfed8a9b5deb93fe72bbad36fa

          SHA512

          7a33358bf5952d946af00c95552c94fa0f27351ca0ff206d218df83d56003e3a1b66095902986790e2b0501d463b958ddcb04a5fc3a56f79bf61158019fd8573

        • /data/data/com.lianaibiji.dev/databases/ua.db-wal

          Filesize

          12KB

          MD5

          921c0f1d01795995b5f044ce2c775053

          SHA1

          f2be68272bb8ddf6a7e1406fb676f82bde6adff4

          SHA256

          557a1ba078a3e7074c286b9ed2aa2886995b730c2542c06f5162f3343e011424

          SHA512

          2cf86d3dd1ddb0aaaef754953f7c1467b874cb3087051f52bf64bcbb263b3e2ed9f95ac5546136d6b6302f16e0c2ce0c572956926372814c995a6aabfabe49ea

        • /data/data/com.lianaibiji.dev/databases/ua.db-wal

          Filesize

          8KB

          MD5

          dea63618070bddf7c20666f505de2019

          SHA1

          1066c738911571e85643d73e2887f0cdc8906cc0

          SHA256

          c271ff4ccf22f9fa3f42fd769ff681404357995fdcb99620ff5599fa7eaa0433

          SHA512

          ae5c0b459fb96006bfde38befaf1d0ec8b26e6c025343b768358414b1060f073001eb60fbbe02714463d127490ddf177baf7cfeaeb54fab577104ccc446513f0

        • /data/data/com.lianaibiji.dev/databases/ua.db-wal

          Filesize

          8KB

          MD5

          8e3cf2acdcb9b1c6c30a9c6f46c5ff60

          SHA1

          70500b22feec76283b7d2afb2670ac71cb19384a

          SHA256

          fcb29b19a78fd5a59c980d4729cb1411b12aed5dfd3976bdc780ddea8a9b60cc

          SHA512

          d5fdb3f6b7d4795eb38a0cb08b7c12fd73086d4bb6f8a33b38fd725484c909982cbf4fa5db607536f3c576751cf0fca4c97ed0585e63655e4156523d5ac9ff08

        • /data/data/com.lianaibiji.dev/databases/ua.db-wal

          Filesize

          4KB

          MD5

          d2972966c2479b596272f45904d2e6c1

          SHA1

          5d0faf84feca8b6e31e73661138458aaba552bbb

          SHA256

          8971240ec7d37e1a366f97cd5d87c62fde90d7a92c5ec2181137f74f3fe0b84a

          SHA512

          79322dcac50cfef5a3d7ed5b56e3024e1679bb7e434d203f297c5b8724947cba61d5583eec38b825f9dfcc3371417e2a7b58fa63bcb82c4405346ddbd52347d4

        • /data/data/com.lianaibiji.dev/files/.envelope/a==8.0.2&&6.1.1_1715633992923_envelope.log

          Filesize

          1KB

          MD5

          d7dacad7f6cd7c6b3a9eda004587a996

          SHA1

          ff11bc280e5af2e103b016f5c4d68c2964146eb2

          SHA256

          e0e183c7f5d55db27ea132b145a11b751be390ae9ec792741d44aa300f5b5e27

          SHA512

          58ce333c30def556b202683c40af08c1874b7100c09d939975466ce3faad5bff0bfee1904ca8f66d7ca80ee083d2dbfdfac1958b1aaabe934df183b4a7acc653

        • /data/data/com.lianaibiji.dev/files/.envelope/t==8.0.2&&6.1.1_1715633991511_envelope.log

          Filesize

          1KB

          MD5

          079f9c4c972462ebf9f0db7b56f17a9b

          SHA1

          2dbf00c783618d2e4bb4747e5686839012e1472f

          SHA256

          43a1f4de7b7590d9b283439bc18cd208f6c72c6e1f417083d4194587ba4bdd1b

          SHA512

          fa890fc7c69b2d38db63b1ef5cfbadd4b5e1b233e4bbadb32ad2d222623042ad0c68706aaaff8e0b611e98e2047c28710df9f565297ce999f424efa91d659ed0

        • /data/data/com.lianaibiji.dev/files/.umeng/exchangeIdentity.json

          Filesize

          162B

          MD5

          c903a4d3f67116bd47f4b60a679a76fc

          SHA1

          f682101090c48ebd128ea827f1c92ab4e41d621c

          SHA256

          2a47b486d6399bd91aa9f1f223d48c45ddd60b08530e44be18b4007a7e9f68db

          SHA512

          9b833a04286ce842f9ed27f823a7b4fe1634dbfa03d5a1e4cc87bc41c61a28d3a2ea2c1edd3f186665891d56537c3d1e6e0a6970f8828dd0edc683095ecdbf84

        • /data/data/com.lianaibiji.dev/files/IMEI

          Filesize

          15B

          MD5

          748d9beeaa1899252a7365b780b95fb0

          SHA1

          2158cbe9044f2b138df0094615afe6616e526c9d

          SHA256

          59290d2d5a77605f8140feb82e44e8438115fb2f93dc56ed4c225b88c21baaa8

          SHA512

          cdeb0c4cebf1cc96ebda6940763a940df76120ee991bc7f003480caf055a970f16e4a19ef2ba2c56fa056d539b981e16542ec7239a7b91dd3828585bc2d1e440

        • /data/data/com.lianaibiji.dev/files/exid.dat

          Filesize

          54B

          MD5

          801d5cebdf7057f81d623613e94375e3

          SHA1

          ab74c9aa425b757af6b6902f30d77ceb479d8fc5

          SHA256

          af4ca5bac885d8e271113c3c96c7fbf827d9e2b800985f805b49bdf7f02fa0ea

          SHA512

          38eafc66edc4d1f5660d99396b3b1d141431d0ed737647afdcbb84a94df35b0686363a72adc57d71459cc753bee1a29b31c5ea5ac011406ac6ef45f9bcfa639d

        • /data/data/com.lianaibiji.dev/files/umeng_it.cache

          Filesize

          415B

          MD5

          1aa65abd424f9bfc2c1e2a5c4d42e7e6

          SHA1

          089601e64c40c8f54401aa25eccc6b4cbf39c7f6

          SHA256

          3db2163b5ec7573c98f6418bf8ff75637123e65ea8b441db553017ba8a6e4b28

          SHA512

          0db56b90324849477f2a57214b24f0d86faea1154fa9ec653cd6ad8fe6c0afff5a4c53aa98c47a7b9379d9ed4101b3374699625ec2f50ddca697e3c6bf15e915

        • /storage/emulated/0/Android/data/com.lianaibiji.dev/cache/skins/boy.skin

          Filesize

          412KB

          MD5

          2585a5a4046a56ff6952011746975411

          SHA1

          485834eaf62e72e6e39b80c078296e858fc4b918

          SHA256

          347c4d2f2ccf3f025f69df11269b0efc0955526c0f8be86ba773da10c69d631f

          SHA512

          1790e78cba6c25532c134a960feb58a1631a97ea474f3fa178a28b8ddd2aefd1248ea88a492c182e03ffe5a351ebd67bca51bc63ba88c1c9a28d581f98903bf4

        • /storage/emulated/0/Android/data/com.lianaibiji.dev/cache/skins/girl.skin

          Filesize

          403KB

          MD5

          449c31c221381da03a9bdd50ab382667

          SHA1

          8da871cfbed4e68fe2286c6c4a7bdea5b9257730

          SHA256

          b0346ba1fcf0a369ebb9d507e5bce9090f8757665b04f833a5bea1f993408d40

          SHA512

          2977a3e3e4724dbd327f56c87eb6a98ac7ee00557d0b02c852bb45a42680d01fb33e0d6fda45fce49f6b23aa2c230eb639aa6141d7bd4ccc3aa2ddb0b199e71f