Analysis

  • max time kernel
    146s
  • max time network
    162s
  • platform
    android_x86
  • resource
    android-x86-arm-20240506-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240506-enlocale:en-usos:android-9-x86system
  • submitted
    14-05-2024 00:08

General

  • Target

    3d24e43e2dfa26d1dfae77060b70a432_JaffaCakes118.apk

  • Size

    22.0MB

  • MD5

    3d24e43e2dfa26d1dfae77060b70a432

  • SHA1

    141ae95c20da750488a403423a9257053fe03206

  • SHA256

    4eb2e7b17a0def4faef9e1b7b7637fb38c7d5531295b35fbd67c0b2119009593

  • SHA512

    a1425bbe3f03a5d9081d679005926c729ab77775225b23ef2eecaf10ba363934434099afcf9ef33e4435b4865e738aae48979d09836c4ba12e472a1a3a1a9987

  • SSDEEP

    393216:1sppdv71TIDnFeXKZYvGrIyDpN2SLZA9uNw5NVPJzSBRDg:10dj16gYY+Uyec2JDua

Malware Config

Signatures

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

  • Queries information about running processes on the device 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Checks if the internet connection is available 1 TTPs 2 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests cell location 1 TTPs 1 IoCs

    Uses Android APIs to to get current cell information.

  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 2 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.dailyyoga.cn
    1⤵
    • Checks CPU information
    • Queries information about running processes on the device
    • Queries information about the current Wi-Fi connection
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4276
    • getprop
      2⤵
        PID:4401
    • com.dailyyoga.cn:pushservice
      1⤵
      • Queries information about running processes on the device
      • Queries information about the current Wi-Fi connection
      • Queries the mobile country code (MCC)
      • Checks if the internet connection is available
      • Requests cell location
      • Listens for changes in the sensor environment (might be used to detect emulation)
      PID:4316

    Network

    MITRE ATT&CK Mobile v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • /data/data/com.dailyyoga.cn/databases/dailyyogadb.db

      Filesize

      4KB

      MD5

      f2b4b0190b9f384ca885f0c8c9b14700

      SHA1

      934ff2646757b5b6e7f20f6a0aa76c7f995d9361

      SHA256

      0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

      SHA512

      ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

    • /data/data/com.dailyyoga.cn/databases/dailyyogadb.db-journal

      Filesize

      512B

      MD5

      01d68956b23012804604353b794c61d9

      SHA1

      78b527b4da3bf0942648e4c4c3d149706c7edc0a

      SHA256

      e2811746395dd07c110ab64473880cf387fdbc8ea6ccc341b54c2dfcea28f4a9

      SHA512

      eca974189867fd008ce9eba1257c0c4414dd4d3f2116d3886c3f28347c353132a2249ff6a4f4118e3fda0e798b06dd8d33adf710c14caf606713c29e53b3e107

    • /data/data/com.dailyyoga.cn/databases/dailyyogadb.db-shm

      Filesize

      32KB

      MD5

      bb7df04e1b0a2570657527a7e108ae23

      SHA1

      5188431849b4613152fd7bdba6a3ff0a4fd6424b

      SHA256

      c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

      SHA512

      768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

    • /data/data/com.dailyyoga.cn/databases/dailyyogadb.db-wal

      Filesize

      80KB

      MD5

      72e0d0c6816ee3ce887ae70c0511ebf9

      SHA1

      b4b546a4789a590f2b9a9e2abc7c7f29f4c37b0b

      SHA256

      b2b22eec542740dde5e1130897d5f70084779ebb61842a8ccddf03b880ded268

      SHA512

      cc6fc0abe8b9814b00971ef1d4b7ba267bebf2f1f09a1cdc6f052ba3568ab56e462d9119ae45b00e7b81db9fc7d501408c38f3885ace13ee458e4d97d0a928d9

    • /data/data/com.dailyyoga.cn/databases/download.db-journal

      Filesize

      512B

      MD5

      be1337600131d820cdfc0c22420036f0

      SHA1

      357cdea33f4f2776ee90eb1589a50fbf833f47ac

      SHA256

      ed73267bc36e3891ea26e42c89f4737222c200144739cb262e8c49024ed6cde2

      SHA512

      d3fa2ea660b92ea91ac5bb068bf89547c211a90aaa7274f72c8f80966a68d2ec0dc9916b8d91822541727b8149a74076cf6279f4646f0a2566338705e2927c54

    • /data/data/com.dailyyoga.cn/databases/download.db-wal

      Filesize

      32KB

      MD5

      61dac5a409c47eb070884929b2576422

      SHA1

      e90c13dc0e45531187ffe1aba109f0a509c934d9

      SHA256

      955c93818c75ac9c8e6e392ea371aec2f7272a302f2e1437048608584d5bd181

      SHA512

      1cf0c8ee2f7f612e5af66278b7891b29a822707b3b15af99d2f4d39b99a6b33af178f678b4431dced9e96ae7414ca7ebcc37c9629bb5e9cb77f4050557af9841

    • /data/data/com.dailyyoga.cn/databases/sharesdk.db-journal

      Filesize

      512B

      MD5

      eaebdce87ce5a83596da0c80a03d8e66

      SHA1

      a05a889a796769d6cb8e5553d128978b320b45fa

      SHA256

      1bfa37eeba40f547d207a5abae5068e69fb581ef43917ea08cf5ea8a61375be5

      SHA512

      05239f8ed344034a1703378afb7c943124d3acf4f9d9207e57535d390abbae339be17f40d684273b7b121c25f0e6f7dcea2fcd6f7425e66ac9d7d8e80c6f667a

    • /data/data/com.dailyyoga.cn/databases/sharesdk.db-wal

      Filesize

      32KB

      MD5

      223f29a4efc6a66f1fb01b435fd7512e

      SHA1

      b005901146e9adcdb72dd670f678d2e46ca0211c

      SHA256

      3d0f3ad5b2d6165a90a2ca0a59d80a98b64e85eba6f08e081abdc9f1fcb11bc3

      SHA512

      ce118648466f57d5a40418329c33c071546fd9e33c804ca57b90b681f031ae25a4461799dbcd436ab8613d3676d104911dce1ecfd5d467b289cdf05201ee7dbe

    • /data/data/com.dailyyoga.cn/files/TDtcagent.db

      Filesize

      20KB

      MD5

      f455ee3bb2a775714e058aeea253b340

      SHA1

      d8c22bd9f175022f48ec71b47c11685507cbbf3c

      SHA256

      c8d4f3247250083009a1f302253a80f6746eb39ebf854c8d950bfb05454b0328

      SHA512

      cb00ed0806f230b4d6ed31b43c04424930815a5e62194ccd986f0c2d13ce97ec3319835506aa17e44349fe3a4c76fe1209c195c60b03fef9609d926c49a593c4

    • /data/data/com.dailyyoga.cn/files/TDtcagent.db

      Filesize

      24KB

      MD5

      71ad2d2caee1e1978793d4754d5fc635

      SHA1

      a2e6522718750a9ccc1868ef9b24b9b2725e8270

      SHA256

      9eb82c326ed30b13b62c864adc8836683a8ece6f706ad4cd887938555c8802bc

      SHA512

      195f2711c7564630fc1c87bb92955ce868100e7851cf98f303c14a8bb559f49ace56b273c56a55954351a32943feae2d94039b842ec0eb7d8e6a11e478d0a716

    • /data/data/com.dailyyoga.cn/files/TDtcagent.db

      Filesize

      28KB

      MD5

      9383a4ef94cd9f3a55c3af358db8c775

      SHA1

      1cf84147d959a8bea5cee546bfd8e51e2403b230

      SHA256

      7d3c569765855d2cc46579211d6b12ec81f86a293f8644331fbf3957035a5fed

      SHA512

      48fd88cdc502ff82ad26ee0f2829ed300e881ef6c9594787763aed447f6f12bb6e2701e6edadb1d7ac535562cfcbe91e5ac89fed8ef3a0b53d68787ef0e574eb

    • /data/data/com.dailyyoga.cn/files/TDtcagent.db

      Filesize

      40KB

      MD5

      06a08406957bef6fc9ab1c6bb79422ed

      SHA1

      f2fff6d9099c1343c1c141e7d74e8ac7569abf3b

      SHA256

      6631be4537ac1090e1cd4291dffa225311bd7d87088caf1eab773de73ef4a907

      SHA512

      50c3a3bdd060c3bace6c0ecd0432041512dc111443db70347d602d6cb7d24a6d4a08dff44a3dc0e65b7271588b0c4f52f1ab0ec6f5252078e47cf2675eb33077

    • /data/data/com.dailyyoga.cn/files/TDtcagent.db

      Filesize

      24KB

      MD5

      f30b999a71fb2db4e43693acf94713f5

      SHA1

      82de45ad68222a8080b239e54655984d0112c6b5

      SHA256

      492abd3b7c15712160f5ce11a2667c76c104ae8c479d237a9297ad649d92bf06

      SHA512

      56b6e41d3a2f6489b2ded682b332ec8fc7b4b8b60cf68c6a7aafca977dcb2232484e800fa5c41008bfeaa688f128fbf1723aedf72ba9a76045f4511d77e044e8

    • /data/data/com.dailyyoga.cn/files/TDtcagent.db

      Filesize

      32KB

      MD5

      ee72454a1cdb67a85f7670088ce5c369

      SHA1

      619626c770aaf7c80dbd25f086ada9b3fea52fde

      SHA256

      425af3f6bfa9a0c69f7f17a1ecf97b461ed2ce7035478a7dbf877f1fa47f964c

      SHA512

      c6b5cc2424a806d472d1c404a64b0f695d9f15f767cda0784f9dc1bc8c2faba6c5ed5ab660ae7fda9c7c2c73c59014f911fe55646d5927e3e181c9ba3728cac9

    • /data/data/com.dailyyoga.cn/files/TDtcagent.db-journal

      Filesize

      512B

      MD5

      6a7953014dbe636033ca1cbb1c2c3eda

      SHA1

      fc62b4d773f414a3d6bbe3316d4a875eb7e5d8f5

      SHA256

      ab49e33fb4d4329d0922f16ff73e38385d34b40bf91da811066f7b1317c4d5ac

      SHA512

      638951941bd37660e78bc137d415480950909eac914ec46bc6c1f91df5e5bd1a0f98ee87186fe88e77ceb78ac831767ca9fdc14f8665fabb7817dc4d92907dfa

    • /data/data/com.dailyyoga.cn/files/TDtcagent.db-wal

      Filesize

      72KB

      MD5

      c0f0beba43f559d1ef26896c6ac9e6ac

      SHA1

      98221936bac860ab670cef16e92bd16c13596661

      SHA256

      b780c595ec342133a3e2296a1130505968cf48de055d7e376aeb92a17760af71

      SHA512

      3bc113a2838c262e2cee96a8a9e91b8150be4ca3e2a4ed926ca09ff0f952b062eb43f3ef779dbc9ba14e7b8883db36c6a9dbf44b269844a7feef8bd7cde88a0a

    • /data/data/com.dailyyoga.cn/files/TDtcagent.db-wal

      Filesize

      8KB

      MD5

      1084a37d5b5f01ef93db9c3bfcbb3aac

      SHA1

      f716dd0fdeebf2002324043c37709d330cc6cfed

      SHA256

      249c5df8f088c930dcd02435427e4ef17a9de101464867ae7a1b5e88fb37220d

      SHA512

      009d1c5b0d27c5c75f45ff977a0fa88efe7f6083e4cd48d01ec0056397ecdc8a5ec441e82f265dbba3d567e26ebcbcd44e7f85261b423a6c3e63751abb57c1a3

    • /data/data/com.dailyyoga.cn/files/TDtcagent.db-wal

      Filesize

      8KB

      MD5

      16231dbd20ff7d1458db284f8a70b84d

      SHA1

      655f69a36606ce80496e53641875d7ec90d29d74

      SHA256

      aba1265aace2ca01281033873c5e5b07fe012ff317bfa8c4411c489d0fc2ee50

      SHA512

      a3dfc676cca0b98a616747bdcfe69bff4361c7f1029c59a8b5f945ab14dbd0ec33147ff4fe48b63fb679076dea7eaecd19dce4ec53e4eeedd07795023014a948

    • /data/data/com.dailyyoga.cn/files/TDtcagent.db-wal

      Filesize

      8KB

      MD5

      a7a15f7b703b14b042e95eadec9a4be1

      SHA1

      1df60baa47db12f0890d74eecd8a1ef6214cbd12

      SHA256

      24435d41d19822fa10256b778a7348bf3edbea8ad5bf310c9baf1d75f29495cc

      SHA512

      92c8725b4b1dc8864546b085d95f6ddae7759dc3ab765b7988b6aa39240c8f294265e9f7e20295f0dda6a755c4049fc3347f19ffc07f0f0031b1d537c5aa7e65

    • /data/data/com.dailyyoga.cn/files/TDtcagent.db-wal

      Filesize

      24KB

      MD5

      2586b7dcc486a148bf58bc52e72aafc9

      SHA1

      8a305a32b440eb4715071b3929f2bd0723971b18

      SHA256

      e611b97c4ec54104882694e1040e605ca7eeeaf6cf7f428998d8d88168a5e398

      SHA512

      a1ab359660beff944ee532f1a59934d14a198f0293ed95df67c9333cf5b6d6e1a4b12a3dfc404c97701b5f9cfd0fd7c04e141b4126158c53957dd4757a6b2e9b

    • /data/data/com.dailyyoga.cn/files/TDtcagent.db-wal

      Filesize

      8KB

      MD5

      6d47414bf4590d744e842949cd3ea6e8

      SHA1

      f8ff55dcab9c508f06cffe3f4466ef1de0f1a2fc

      SHA256

      37b6676e56ed9dac957f3bfd010961260c1e85148fa5e877600285b75c5a878a

      SHA512

      5d229d26cd9e132485369c4cf2b43a318e84b0ccfa46ba02fb301d4efdf7b60776146fabd2bac631ad126072baae3722475301eb3d90575d1d76317375402081

    • /data/data/com.dailyyoga.cn/files/gaClientId

      Filesize

      36B

      MD5

      6af3cf2f1f1bb4b4a4b2d166337aefc5

      SHA1

      2f6478e52aee14479efbc2358ab94834af7dab4d

      SHA256

      42248053f1de9505f1997144785336f884e637eeb416b1f13298cd958ee83ee6

      SHA512

      81992d51129f8bd95dd18b28e69120590aaa46ebe3b9586a63a3fe6a7ca79307ac7d57879eb14ca25b1dfc45fe01c654a9de8232fb34c854885203e029ebff86

    • /data/data/com.dailyyoga.cn/files/mobclick_agent_sealed_com.dailyyoga.cn

      Filesize

      553B

      MD5

      1f6c32f6d589ebd4b1a88dc6ed1f027e

      SHA1

      1cbcfb0ef1db6cabdb88b1f9999cbf1d454e7949

      SHA256

      f655316a42d96e4945d1977673da685e9953f8485fe5e4085322cada71502529

      SHA512

      6ef8bca1caa8b64c029a151aec6901d7ddd869c7f44c56c2f6791961c45875afd575bdc4750dfaaa32f4ba963d37d5722205aca64ef9b3bb9530ad1f1255ba02

    • /storage/emulated/0/Android/data/com.dailyyoga.cn/cache/uil-images/journal.tmp

      Filesize

      31B

      MD5

      8c92de9ce46d41a22f3b20f77404cc1d

      SHA1

      8671a6dca00edb72be47363a7071be65cf270373

      SHA256

      68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274

      SHA512

      30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

    • /storage/emulated/0/Android/data/com.dailyyoga.cn/dailyyoga#yogadaily/log/20240514/000.html

      Filesize

      172B

      MD5

      f9d636338df561cef69ce101710d7129

      SHA1

      bb8b8b9039e36eb6b25974139d63a2aa96996322

      SHA256

      2c435b63a4cc7fc03516500af33c1ec655cad8036cc8509928572d94f0a73c58

      SHA512

      87701fab592e520a60028048ad92faf12e8d4aa456cc7b0753b2d48aa1aa37a56a988c16ef1560dbf76eff1e843e4b2a2d20566b1c027a3f2fbe6df4e28d5b1e

    • /storage/emulated/0/Android/data/com.dailyyoga.cn/dailyyoga#yogadaily/log/20240514/000.html

      Filesize

      85B

      MD5

      cfc64ec9a743601d97930d41a79ee4b0

      SHA1

      2240b1ca768b2d5c1688153feb79430e3c737db9

      SHA256

      4dd8887ae7a3d190a19f58f57bf2e99e3bc00e54c9cf63a5acfdf8c3521db123

      SHA512

      79f6ac3804c5f4992319117031c91ac7384b8697844c087efe883e66725c7c8efc88b6a7e262926df6e7f34c7b470e430906ede8d4b0bfcc237eb44105513e32

    • /storage/emulated/0/Android/data/com.dailyyoga.cn/dailyyoga#yogadaily/log/20240514/000.html

      Filesize

      82B

      MD5

      9690822dd0e883b92298996d2b549643

      SHA1

      b63954106287ec0ce19c9c15e384afcda41b712d

      SHA256

      f8447078253148ebbc694912f221fda6590400482fb5ffe8ad05ebf4befd890e

      SHA512

      f5fd1465a250b22314b2e180c53399ac499c0f60f565362d70e9b37dee86c0f35d8b5aebc2f86bb3509a9531ecb13837e07ddca8d20c2b8f738e2332641f017f

    • /storage/emulated/0/Android/data/com.dailyyoga.cn/dailyyoga#yogadaily/log/20240514/000.html

      Filesize

      113B

      MD5

      7119a1b16017ee8baedcf3612e7aac87

      SHA1

      78ee093fb50f7366d3fa9c31ba344b2f8f684879

      SHA256

      15677c4a4455c026e74d0b05faba3425189959ea2dbd180495d2e4639d1301f8

      SHA512

      7ebdf0a9ae483e3893a05451c3453fbcec849e29195138b5e1ceead959a1803d7100097b78af5783991ccaa8337fca1299def42ffeeeffe9c1a869f7eb61ca4c

    • /storage/emulated/0/ShareSDK/.ba

      Filesize

      369B

      MD5

      0d0f7870cce666939da6a327fe9a75fc

      SHA1

      21ff268ba55815c011bd0a793cab3858b8e5248e

      SHA256

      83ad928b56fdfa96cfe6fd9adb37457e4c0b96969cabfcb4cdcd3c497f4a3a6a

      SHA512

      78244d9268017dbff5cf73c31f03f385573437ec731d39b05cc2a44d273fdad46ffc804047a76cabceb1b589605361fdd9e54c5e30e0f7e826b3fd01262a9570

    • /storage/emulated/0/ShareSDK/.ba

      Filesize

      468B

      MD5

      d26cafdbf6164ecc1602022bfaae65f1

      SHA1

      b75afbf54a415646f5c3c0d276c3c193971b8007

      SHA256

      2e44e24433c31c6e3d7c2536eec27c4d0c198e2e3466b3bad113a0ca08ecdaa4

      SHA512

      dc73cd0e35588f52c96196b10dccefd306230ddbf9ce8ae76fbaec11538e8b77f49515b70123ecd75dcfb8419caf90b207131308d24baa550f452b8a5c0ab965

    • /storage/emulated/0/ShareSDK/.dk

      Filesize

      107B

      MD5

      c9383021bd97affc44be4db7018c4d7b

      SHA1

      7e680409d1c86e35149bebc22f2cf8c484f0d23e

      SHA256

      b7b7e032170e3190a84359e5c37adede1d58b6bf4c455ef0c01f73335709bb65

      SHA512

      7303f068da97319891e2d25c1c737035f1cfdc365d75d954102b612000e54d7e2b5dfafe10bdf909563e2b46ec3ff9e546423bff6f0aa9496880eab1c1c36a81