Analysis
-
max time kernel
149s -
max time network
167s -
platform
android_x86 -
resource
android-x86-arm-20240506-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240506-enlocale:en-usos:android-9-x86system -
submitted
13/05/2024, 20:58
Static task
static1
Behavioral task
behavioral1
Sample
3c8c163a3be06fac9473d38e0c739206_JaffaCakes118.apk
Resource
android-x86-arm-20240506-en
Behavioral task
behavioral2
Sample
boy.apk
Resource
android-x86-arm-20240506-en
Behavioral task
behavioral3
Sample
boy.apk
Resource
android-x64-20240506-en
Behavioral task
behavioral4
Sample
boy.apk
Resource
android-x64-arm64-20240506-en
Behavioral task
behavioral5
Sample
girl.apk
Resource
android-x86-arm-20240506-en
Behavioral task
behavioral6
Sample
girl.apk
Resource
android-x64-20240506-en
Behavioral task
behavioral7
Sample
girl.apk
Resource
android-x64-arm64-20240506-en
General
-
Target
3c8c163a3be06fac9473d38e0c739206_JaffaCakes118.apk
-
Size
24.9MB
-
MD5
3c8c163a3be06fac9473d38e0c739206
-
SHA1
4141775e93ff4592d42cab2b8386e0f873ebddbf
-
SHA256
cbb8bbc5a1bb603a019eaf2aaa06314be37b18acb0e4ecca25250f8f33a638c7
-
SHA512
c97225c94e6291fce5b355b18ed86c5efa3edd0154f2425b13d2e662b61e3976f2ce2176d7f18904318be44cfe8bd88f48561a78f74e320f83ff36494ef99569
-
SSDEEP
393216:XRRgO81/LcBZ5agn4GVOnY1ASjL4JHXBl/RNWNwZlGCNntrZdOW5uEezv7P:hRgdLcBZ5aZG8d8L2BluNsNtriT7TP
Malware Config
Signatures
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
description ioc Process File opened for read /proc/cpuinfo com.lianaibiji.dev -
Checks known Qemu files. 1 TTPs 3 IoCs
Checks for known Qemu files that exist on Android virtual device images.
ioc Process /system/lib/libc_malloc_debug_qemu.so com.lianaibiji.dev /sys/qemu_trace com.lianaibiji.dev /system/bin/qemu-props com.lianaibiji.dev -
Checks known Qemu pipes. 1 TTPs 2 IoCs
Checks for known pipes used by the Android emulator to communicate with the host.
ioc Process /dev/qemu_pipe com.lianaibiji.dev /dev/socket/qemud com.lianaibiji.dev -
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
description ioc Process File opened for read /proc/meminfo com.lianaibiji.dev -
Queries information about running processes on the device 1 TTPs 4 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.lianaibiji.dev Framework service call android.app.IActivityManager.getRunningAppProcesses com.lianaibiji.dev:ipc Framework service call android.app.IActivityManager.getRunningAppProcesses io.rong.push Framework service call android.app.IActivityManager.getRunningAppProcesses com.lianaibiji.dev:pushservice -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.lianaibiji.dev -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.lianaibiji.dev Framework service call android.app.IActivityManager.registerReceiver com.lianaibiji.dev:pushservice -
Checks if the internet connection is available 1 TTPs 3 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.lianaibiji.dev Framework service call android.net.IConnectivityManager.getActiveNetworkInfo io.rong.push Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.lianaibiji.dev:pushservice -
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.lianaibiji.dev Framework API call javax.crypto.Cipher.doFinal com.lianaibiji.dev:pushservice
Processes
-
com.lianaibiji.dev1⤵
- Checks CPU information
- Checks known Qemu files.
- Checks known Qemu pipes.
- Checks memory information
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4199 -
/system/bin/sh -c getprop2⤵PID:4244
-
-
getprop2⤵PID:4244
-
-
com.lianaibiji.dev:ipc1⤵
- Queries information about running processes on the device
PID:4379
-
io.rong.push1⤵
- Queries information about running processes on the device
- Checks if the internet connection is available
PID:4413 -
/system/bin/chmod 777 /data/user/0/com.lianaibiji.dev/app_lib/x86/push_daemon2⤵PID:4479
-
-
com.lianaibiji.dev:pushservice1⤵
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4462
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
58B
MD50d210bfb2a0e1f1b4c082a6a0f79de07
SHA1bb8ed9e364db79d1d9f2fcde3f15091893222faa
SHA256988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
SHA512536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
513B
MD5ebacaffab57c93ac3ff3a3cff1a612c4
SHA11b12cbabafe0e147f56f524e727f76aea20b2ea6
SHA256c9d2db101ac623dc5170e85cd308bca48dd48f7f84dd4bd0c9838de7d1c04870
SHA51236e57257b727cddab894dc39d2ff6328c8bf3ae166ee17e9f9e23b55cc6ab473fcd1cd5275e83b52e3a2fd3819bf5d7c1e4cd8b3a317ec571f73fe4fc10db87b
-
Filesize
22KB
MD595a6ae7e536798bf76d664d87e2ad308
SHA12acf3429c4980bb0eeeb098c796eaf8ade658af9
SHA256add1f58ec0502154bd2538b187dbdfea1057213a9d8ed479f94c64902a9a7218
SHA512c5079e3240b5ccefc836f8831e76eb3a99c50bd73dafe5469555f14c641aebd9710b4e83d3e542432d69e28543fd405100a5884fb204ac08c7162ba8bbed2f19
-
Filesize
512B
MD5999f521a2ca9b5aa911da40ab42be47c
SHA102dbcd45cd2f2e515c05b4d336747a18c74417a9
SHA256dd241ee9ccd383b49763f347a515b429d2410bf99a5dc83f3b27ed6f45ee5d32
SHA512d503f0687ad84dcd38ef719b7f799cfb016d5eebb6aa912ac5d32e4d526f1792e4efedb8284d42c1f34cec6ede4b731319040687ea0c436fa92ac7046bcdec7f
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
289KB
MD5cbd28527b202ad71d499558af0983ef5
SHA162d44ebaee4332aa27f556c2de025ebcf39c82a7
SHA2561dcbb965a6baa84f616cb72bfda933962e36e72db01ba92c2ef4d73ffc802765
SHA5127b0620a38b8a4d6793a63ec2d0a80962390df7000317517584aeb956774f6fd32423d6bdc891988513972144c692dc0bc6b4653ee2115274cac24053fe8ad6f1
-
Filesize
512B
MD5108f0ffff9572786ed66e0b22939b040
SHA196570c0d91967ae48ebda6041bdd250c865557dd
SHA256e1726289aa159eb56a9857e84e512cfbae2d8b9e13e656e05cf6e969ca3dd219
SHA512452c1e3a915a086ad6b64fb200fd728f2301fc465953a1fe6e177a4563cf5c2f65be5c0ad80e632e67ea8b8aea228d0539382b8eb5dd61fc84f5d4d9c0228634
-
Filesize
20KB
MD5575975bbde8b01da5fe0f13a07f68ba7
SHA139eb0e29bfde237d79ee23123bb3fc86d1cf852b
SHA25617a15b44658c27a86f4fb60128167b8820146bd83f5acaeb7d0ce99bb54b2b00
SHA512b862178e65baadbc31b15dc877ed3e7881aa641dc3203cbcbfc12748b8bdf212da9ecac0d25325f8d21fd5bc416a34da4cbef92d1a7e206a45159bab43fc819e
-
Filesize
512B
MD57fa0b0a05165630dd935a78f31a8ce2b
SHA1d9d972f7a75f3246fd3e37bb8a75da4ac455dcdb
SHA25607ee2c48f5cc8378e09817b6a0abc4fa506de8af90d39f2a52059bb73f12a455
SHA5124d669d6c0fa8cf1ea162dbd3a70b6f46900f3c26949c29ea2ba96c746bc528676dd6a2c879fe080004366c9e8c9b05d747adad978a96c8c75a5d73e3408b73c3
-
Filesize
124KB
MD582c7cee9f4a51f21e2b2e6995ba221f1
SHA18e043097aa5eb385d44393832292c25b55237366
SHA2569d395cfd6005a428f10d372f61e07f9b7cff91c60410129d55bee62c9d54d59b
SHA512c5719814a658489c4483397930e21fd71098b8f9dfda9673b730d33085e009e5c1f4ac4cf573b038385073d1d9fc01d99630663b43cfd0ec3d70fbb8f1bdf6d0
-
Filesize
40KB
MD5a2c8ea957c4597e5db4c0a0d8e0c5ed9
SHA160e20b2855a3cf0725332849c7717c6d98875e1e
SHA256c821fbe5f760f9087a3e1618936eab77433afb71558cffc0624ba2999bb33866
SHA512780de46a7729ff1aad53afb51388c1cea55a8bb2f8a9de6e76c979c4bae0f9d58c83e772c443a2cb8b8e507a9aa399f0ad1400bcdcdb916d17f6c73061172b36
-
Filesize
24KB
MD55a713039f39f5159fa18eaaefe967025
SHA1e50d0649571010b3982ccebab927db8c2e288455
SHA256bf3ffa8789cff33b91d7b6b6c77c46e2ddff24d76fd3fa40b3398541649fc34d
SHA512dab2d147d99f43b972a44b338d928d0a628b235058f053aa557b0b3ba403c6e78212f9685620244ba707c342b310b3f07325741fb323069ca8bed37371aa4666
-
Filesize
32KB
MD5118f86cb0ef1a1927368a41777ef4865
SHA1a4b61efb5dbafabc6efaa12535ecdd4914caa77f
SHA25611728a8e3533c4bc88d6a8376af8ecb28fb5187e615f7beea02f85d33f433f3f
SHA512db2742d886f44cac818bbea6daae7cae07fcf8e800ffba75bbc83b991519cfc6b903c4fb0155dd749844643472fd3f2778fed478db8e12bc94d3229affb300ca
-
Filesize
32KB
MD5e78a5bcd6ae2aaf46da5c953b6a2aaf1
SHA18a42e5c12dc551f9a10c81c6558e446e8bcc9174
SHA2562c29972516f7a96ee44341e76eb5e8ab3d8b99d7f34482dcb2de687285b17ad8
SHA512bd2275bfe2ffec84a2388a5e4f4deaf54412b489d2fd40e080d41ed769a1f2376732dcbcec419ea3f66f9ed3525ae876346e9a3f41bd05c563f494dd52434a72
-
Filesize
36KB
MD5ba9e8386f47bb920adffb3fe8e2bd762
SHA1b25ccf2617ec07a293f77ae6b757932d1c9970a3
SHA2564736dd9a57101888a22a63fdec3f3f76f0f093ed8110dc83f403d06e4e32df8e
SHA512b2a33f57ba7bc1b481ea4a1a6a4a7cd086659b333fb80bdc6d7c8f5f7155a4391d0e24a9e167bf37b36ffdf8dcc92f0e12ccb7327942925646aefcde9d2bb6fd
-
Filesize
36KB
MD53e8a91b095739d2044cff9b6123abaa7
SHA1a6b4f3adf651f66a6db1b8938fe669974856e395
SHA256fdde5fa77023fcc4b5af61ba42b48e2b46b55b26246934ee2f40937ea04bfc9a
SHA512b0da48b1c15f3bb42e3efcd06aac0cc8daa4a0a08528ef18f23a0968b350898bcc91f709577548534e208ac81c36f6cd017878b043861508041c06d85679a250
-
Filesize
512B
MD55006f0810a5d79e3e54e883c0941f04c
SHA1307e53df49dfdde6bf32cf75f0a6f2b720b7eaad
SHA256cd73e8323206698fd1413a672e94d6a9a1cda04f12e5295ca95b6d2f34e4a672
SHA512954f77676538e2c103ad0eb13153050443c1960fbd69b41cbd2cf5de04586d05072faa2561ab4bd059247733caddce31a1a0b9d07204f4ea83bc573633eff1b5
-
Filesize
52KB
MD5a33a5e07ecbb9e2b724dab5fd710ca4b
SHA1238196d438ccdf5191d56560d1c500e80a56835d
SHA2564c824a7a342400fdcfdd6b5f769b0de43508afa71332ed94df5a8f1359a251c6
SHA512d552e19c93675acdd26610a67eaf9a3c002a4a67b33ef1b39356856c3c534cee775432ac0ab60ccc69f2e42e70d5369c00295ede330c97f1cf344c5c66b25e3d
-
Filesize
12KB
MD5967688960b42101cd6ddfc921fdd0ed8
SHA1cbc2d6a3d8a4fdd4c353d5081c65b7952611e082
SHA256d43af7458da185ffa3a48d8948106e83352222bfed8a9b5deb93fe72bbad36fa
SHA5127a33358bf5952d946af00c95552c94fa0f27351ca0ff206d218df83d56003e3a1b66095902986790e2b0501d463b958ddcb04a5fc3a56f79bf61158019fd8573
-
Filesize
12KB
MD5921c0f1d01795995b5f044ce2c775053
SHA1f2be68272bb8ddf6a7e1406fb676f82bde6adff4
SHA256557a1ba078a3e7074c286b9ed2aa2886995b730c2542c06f5162f3343e011424
SHA5122cf86d3dd1ddb0aaaef754953f7c1467b874cb3087051f52bf64bcbb263b3e2ed9f95ac5546136d6b6302f16e0c2ce0c572956926372814c995a6aabfabe49ea
-
Filesize
8KB
MD5dea63618070bddf7c20666f505de2019
SHA11066c738911571e85643d73e2887f0cdc8906cc0
SHA256c271ff4ccf22f9fa3f42fd769ff681404357995fdcb99620ff5599fa7eaa0433
SHA512ae5c0b459fb96006bfde38befaf1d0ec8b26e6c025343b768358414b1060f073001eb60fbbe02714463d127490ddf177baf7cfeaeb54fab577104ccc446513f0
-
Filesize
8KB
MD58e3cf2acdcb9b1c6c30a9c6f46c5ff60
SHA170500b22feec76283b7d2afb2670ac71cb19384a
SHA256fcb29b19a78fd5a59c980d4729cb1411b12aed5dfd3976bdc780ddea8a9b60cc
SHA512d5fdb3f6b7d4795eb38a0cb08b7c12fd73086d4bb6f8a33b38fd725484c909982cbf4fa5db607536f3c576751cf0fca4c97ed0585e63655e4156523d5ac9ff08
-
Filesize
4KB
MD5d2972966c2479b596272f45904d2e6c1
SHA15d0faf84feca8b6e31e73661138458aaba552bbb
SHA2568971240ec7d37e1a366f97cd5d87c62fde90d7a92c5ec2181137f74f3fe0b84a
SHA51279322dcac50cfef5a3d7ed5b56e3024e1679bb7e434d203f297c5b8724947cba61d5583eec38b825f9dfcc3371417e2a7b58fa63bcb82c4405346ddbd52347d4
-
Filesize
1KB
MD5d7dacad7f6cd7c6b3a9eda004587a996
SHA1ff11bc280e5af2e103b016f5c4d68c2964146eb2
SHA256e0e183c7f5d55db27ea132b145a11b751be390ae9ec792741d44aa300f5b5e27
SHA51258ce333c30def556b202683c40af08c1874b7100c09d939975466ce3faad5bff0bfee1904ca8f66d7ca80ee083d2dbfdfac1958b1aaabe934df183b4a7acc653
-
Filesize
1KB
MD5079f9c4c972462ebf9f0db7b56f17a9b
SHA12dbf00c783618d2e4bb4747e5686839012e1472f
SHA25643a1f4de7b7590d9b283439bc18cd208f6c72c6e1f417083d4194587ba4bdd1b
SHA512fa890fc7c69b2d38db63b1ef5cfbadd4b5e1b233e4bbadb32ad2d222623042ad0c68706aaaff8e0b611e98e2047c28710df9f565297ce999f424efa91d659ed0
-
Filesize
162B
MD5c903a4d3f67116bd47f4b60a679a76fc
SHA1f682101090c48ebd128ea827f1c92ab4e41d621c
SHA2562a47b486d6399bd91aa9f1f223d48c45ddd60b08530e44be18b4007a7e9f68db
SHA5129b833a04286ce842f9ed27f823a7b4fe1634dbfa03d5a1e4cc87bc41c61a28d3a2ea2c1edd3f186665891d56537c3d1e6e0a6970f8828dd0edc683095ecdbf84
-
Filesize
15B
MD5748d9beeaa1899252a7365b780b95fb0
SHA12158cbe9044f2b138df0094615afe6616e526c9d
SHA25659290d2d5a77605f8140feb82e44e8438115fb2f93dc56ed4c225b88c21baaa8
SHA512cdeb0c4cebf1cc96ebda6940763a940df76120ee991bc7f003480caf055a970f16e4a19ef2ba2c56fa056d539b981e16542ec7239a7b91dd3828585bc2d1e440
-
Filesize
54B
MD5801d5cebdf7057f81d623613e94375e3
SHA1ab74c9aa425b757af6b6902f30d77ceb479d8fc5
SHA256af4ca5bac885d8e271113c3c96c7fbf827d9e2b800985f805b49bdf7f02fa0ea
SHA51238eafc66edc4d1f5660d99396b3b1d141431d0ed737647afdcbb84a94df35b0686363a72adc57d71459cc753bee1a29b31c5ea5ac011406ac6ef45f9bcfa639d
-
Filesize
415B
MD51aa65abd424f9bfc2c1e2a5c4d42e7e6
SHA1089601e64c40c8f54401aa25eccc6b4cbf39c7f6
SHA2563db2163b5ec7573c98f6418bf8ff75637123e65ea8b441db553017ba8a6e4b28
SHA5120db56b90324849477f2a57214b24f0d86faea1154fa9ec653cd6ad8fe6c0afff5a4c53aa98c47a7b9379d9ed4101b3374699625ec2f50ddca697e3c6bf15e915
-
Filesize
412KB
MD52585a5a4046a56ff6952011746975411
SHA1485834eaf62e72e6e39b80c078296e858fc4b918
SHA256347c4d2f2ccf3f025f69df11269b0efc0955526c0f8be86ba773da10c69d631f
SHA5121790e78cba6c25532c134a960feb58a1631a97ea474f3fa178a28b8ddd2aefd1248ea88a492c182e03ffe5a351ebd67bca51bc63ba88c1c9a28d581f98903bf4
-
Filesize
403KB
MD5449c31c221381da03a9bdd50ab382667
SHA18da871cfbed4e68fe2286c6c4a7bdea5b9257730
SHA256b0346ba1fcf0a369ebb9d507e5bce9090f8757665b04f833a5bea1f993408d40
SHA5122977a3e3e4724dbd327f56c87eb6a98ac7ee00557d0b02c852bb45a42680d01fb33e0d6fda45fce49f6b23aa2c230eb639aa6141d7bd4ccc3aa2ddb0b199e71f