Analysis

  • max time kernel
    166s
  • max time network
    189s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240514-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240514-enlocale:en-usos:android-13-x64system
  • submitted
    15/05/2024, 21:39

General

  • Target
    4828525495a571ba65feb6b0d941f42a_JaffaCakes118.apk
  • Size 13.4MB
  • Sample240515-1h1ejsdf48
  • SHA256 4c8f2bd3a3d108d158e0ec8862b21404fc616d3d8ad0e5f8bf560089254a67c1
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Signatures

Processes

  • cn.win888.banying.dpl
    1⤵
    • Checks if the Android device is rooted.
    • Requests cell location
    • Checks CPU information
    • Checks memory information
    • Queries information about running processes on the device
    • Queries the mobile country code (MCC)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4339

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ua.db

        • Path /data/data/cn.win888.banying.dpl/databases/.ua/ua.db
        • Size 32KB
        • SHA256 bcd322999fc3f2c13002692a8a5fe42790e9d0b8429400ae9eecba0061d53de8
        • MD5 SHA1 SHA512 SSDEEP

        ua.db

        • Path /data/data/cn.win888.banying.dpl/databases/.ua/ua.db
        • Size 16KB
        • SHA256 63188db3330efae29131b13d6beb7568cd641220e24443b20e4b4ccb34db720d
        • MD5 SHA1 SHA512 SSDEEP

        ua.db

        • Path /data/data/cn.win888.banying.dpl/databases/.ua/ua.db
        • Size 32KB
        • SHA256 21e4cdbb0530e4e8f8ee25af192e86cce6e917605050c3fcd8811768f6e87f56
        • MD5 SHA1 SHA512 SSDEEP

        ua.db

        • Path /data/data/cn.win888.banying.dpl/databases/.ua/ua.db
        • Size 16KB
        • SHA256 d830fcc2fb91f207be6707816c20c271cb3895d43f7fdd5257d2ed3ae86bfe05
        • MD5 SHA1 SHA512 SSDEEP

        ua.db

        • Path /data/data/cn.win888.banying.dpl/databases/.ua/ua.db
        • Size 24KB
        • SHA256 0c8d2fca3c480e7321867b76899f07159c552192df5bd1ebc6c8d1cc74d914c3
        • MD5 SHA1 SHA512 SSDEEP

        ua.db

        • Path /data/data/cn.win888.banying.dpl/databases/.ua/ua.db
        • Size 16KB
        • SHA256 cbfdeb861dc783d82fc47e71b2bc4cee29164411fddaa2ebaeb2769a9f750a28
        • MD5 SHA1 SHA512 SSDEEP

        ua.db-journal

        • Path /data/data/cn.win888.banying.dpl/databases/.ua/ua.db-journal
        • Size 512B
        • SHA256 b932e4a6d9493cdc7f16ea8abc0e94e7c135142b0e04bfddcc0926110fb0d499
        • MD5 SHA1 SHA512

        ua.db-journal

        • Path /data/data/cn.win888.banying.dpl/databases/.ua/ua.db-journal
        • Size 8KB
        • SHA256 a8fc2ff11d7d5fc63c36a853aca4de1c801773f9c4bebc41544e81a3cb75033e
        • MD5 SHA1 SHA512 SSDEEP

        ua.db-journal

        • Path /data/data/cn.win888.banying.dpl/databases/.ua/ua.db-journal
        • Size 8KB
        • SHA256 02cfe96febf127633a6b58ece5fb44eaaaaf030aa556c09d6bcad274d0ec778d
        • MD5 SHA1 SHA512 SSDEEP

        ua.db-journal

        • Path /data/data/cn.win888.banying.dpl/databases/.ua/ua.db-journal
        • Size 16KB
        • SHA256 60cb306bcabec775a474537b43a374c050524a3681d56d14875e5cff6945246a
        • MD5 SHA1 SHA512 SSDEEP

        ua.db-journal

        • Path /data/data/cn.win888.banying.dpl/databases/.ua/ua.db-journal
        • Size 8KB
        • SHA256 960f467bded68c0903b0d49bee996fbf23524623319f396757045ceefb39f69a
        • MD5 SHA1 SHA512 SSDEEP

        ua.db-journal

        • Path /data/data/cn.win888.banying.dpl/databases/.ua/ua.db-journal
        • Size 16KB
        • SHA256 6a7202f3a63bf83db620fc83f881af585d9ff97188f8bf4f102c67257f65ccb9
        • MD5 SHA1 SHA512 SSDEEP

        cc.db

        • Path /data/data/cn.win888.banying.dpl/databases/cc/cc.db
        • Size 36KB
        • SHA256 6945d75275af161fa082eab8b348f4cdccbab03854963f5e861fde210447e058
        • MD5 SHA1 SHA512 SSDEEP

        cc.db

        • Path /data/data/cn.win888.banying.dpl/databases/cc/cc.db
        • Size 36KB
        • SHA256 66c83ae35e997c33eaffe9c0557d98ee31931c18b99585a64eb6cc8f63d303e3
        • MD5 SHA1 SHA512 SSDEEP

        cc.db-journal

        • Path /data/data/cn.win888.banying.dpl/databases/cc/cc.db-journal
        • Size 512B
        • SHA256 969899b2275f2de809bbac85f302adce766046723cb00cef46f9f00513cf142a
        • MD5 SHA1 SHA512

        cc.db-journal

        • Path /data/data/cn.win888.banying.dpl/databases/cc/cc.db-journal
        • Size 8KB
        • SHA256 d36cd66514c333ef1772a88915c25a895ed20d847d289b94535fb3ae1f288bb1
        • MD5 SHA1 SHA512 SSDEEP

        cc.db-journal

        • Path /data/data/cn.win888.banying.dpl/databases/cc/cc.db-journal
        • Size 8KB
        • SHA256 662fed47a0fc40f7335c433775c637eb7633bb97b14acb6adf8efd4a724985ec
        • MD5 SHA1 SHA512 SSDEEP

        cc.db-journal

        • Path /data/data/cn.win888.banying.dpl/databases/cc/cc.db-journal
        • Size 8KB
        • SHA256 231171f508b24aabcb255ba299212d4f34e82ee88ed1fb24c78ee5dd7076ec88
        • MD5 SHA1 SHA512 SSDEEP

        cc.db-journal

        • Path /data/data/cn.win888.banying.dpl/databases/cc/cc.db-journal
        • Size 8KB
        • SHA256 a318be58b3f324fc616347b85f37c4b2d1276dc8e5dc665c872eedaa42cda2de
        • MD5 SHA1 SHA512 SSDEEP

        cc.db-journal

        • Path /data/data/cn.win888.banying.dpl/databases/cc/cc.db-journal
        • Size 12KB
        • SHA256 956273735c2b0ccbaf108674de1d8b473259075dd6aac6a13430ed293ef593e4
        • MD5 SHA1 SHA512 SSDEEP

        1004

        • Path /data/user/0/cn.win888.banying.dpl/app_crashrecord/1004
        • Size 230B
        • SHA256 3d2e097f48b8104e7c56f0ec9eed24dbbb754ec319b0daf78c6d09828e2ffccf
        • MD5 SHA1 SHA512

        1004

        • Path /data/user/0/cn.win888.banying.dpl/app_crashrecord/1004
        • Size 58B
        • SHA256 988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
        • MD5 SHA1 SHA512

        bugly_db_

        • Path /data/user/0/cn.win888.banying.dpl/databases/bugly_db_
        • Size 52KB
        • SHA256 5ae32a426488c1cec19bedc15d9ea2fb4c2807ecdff47704e0cb3a3e677c4211
        • MD5 SHA1 SHA512 SSDEEP

        bugly_db_-journal

        • Path /data/user/0/cn.win888.banying.dpl/databases/bugly_db_-journal
        • Size 8KB
        • SHA256 8ea183d2815a729a366783d599ceab929544cc3dcfa4de9ee38ba4cd21371a86
        • MD5 SHA1 SHA512 SSDEEP

        bugly_db_-journal

        • Path /data/user/0/cn.win888.banying.dpl/databases/bugly_db_-journal
        • Size 512B
        • SHA256 52fe7ebd29089fd71271e369000b059b4f0dc11374228159e3ec5ba1f63a79ec
        • MD5 SHA1 SHA512

        bugly_db_-journal

        • Path /data/user/0/cn.win888.banying.dpl/databases/bugly_db_-journal
        • Size 8KB
        • SHA256 26defa5b885c2f5fee7b88a6115d7aa342e6f4dfd2cd283dcaf37e01ecf0a156
        • MD5 SHA1 SHA512 SSDEEP

        bugly_db_-journal

        • Path /data/user/0/cn.win888.banying.dpl/databases/bugly_db_-journal
        • Size 8KB
        • SHA256 1b444c2c60e7d5e544a33effc46543db74a18535184a5bb9584c8f327f84a8c5
        • MD5 SHA1 SHA512 SSDEEP

        bugly_db_-journal

        • Path /data/user/0/cn.win888.banying.dpl/databases/bugly_db_-journal
        • Size 8KB
        • SHA256 d18aec0ac6e08379a18382b583def36fbf25a4d8b64b7992825814121ba2589b
        • MD5 SHA1 SHA512 SSDEEP

        bugly_db_-journal

        • Path /data/user/0/cn.win888.banying.dpl/databases/bugly_db_-journal
        • Size 8KB
        • SHA256 f31395e16e68b451161e894fa1a8559d6a76f97c7b6d41037b2aeb9a902fabc2
        • MD5 SHA1 SHA512 SSDEEP

        cn.win888.banying.dpl

        • Path /data/user/0/cn.win888.banying.dpl/databases/cn.win888.banying.dpl
        • Size 24KB
        • SHA256 a79228e66e29f5a114c5070af675ab467b943283fe3b88f6e2de5a12d3079669
        • MD5 SHA1 SHA512 SSDEEP

        cn.win888.banying.dpl

        • Path /data/user/0/cn.win888.banying.dpl/databases/cn.win888.banying.dpl
        • Size 24KB
        • SHA256 b1861d92bc08a3c7633937a5b609c84cd2d8707ddd4d379f2e062703f71f444b
        • MD5 SHA1 SHA512 SSDEEP

        cn.win888.banying.dpl

        • Path /data/user/0/cn.win888.banying.dpl/databases/cn.win888.banying.dpl
        • Size 24KB
        • SHA256 2a6ffa2f2793b722ebbc8e6c8bdfce4e811241fb578b66d3d9d2fde4a71e7f79
        • MD5 SHA1 SHA512 SSDEEP

        cn.win888.banying.dpl

        • Path /data/user/0/cn.win888.banying.dpl/databases/cn.win888.banying.dpl
        • Size 24KB
        • SHA256 d9314c629488c9e60d5aa4680de810e14add24b949e51f0d703562b98a88cdcf
        • MD5 SHA1 SHA512 SSDEEP

        cn.win888.banying.dpl

        • Path /data/user/0/cn.win888.banying.dpl/databases/cn.win888.banying.dpl
        • Size 32KB
        • SHA256 c77716ff1f0330a6acd40d1aa87eb055edcee944c1807d0badab4c3124f18313
        • MD5 SHA1 SHA512 SSDEEP

        cn.win888.banying.dpl

        • Path /data/user/0/cn.win888.banying.dpl/databases/cn.win888.banying.dpl
        • Size 32KB
        • SHA256 acbac84b61ef81d0c6aa7d0d27423477c42b8d316993bdcefb0b4d46e3851d2e
        • MD5 SHA1 SHA512 SSDEEP

        cn.win888.banying.dpl-journal

        • Path /data/user/0/cn.win888.banying.dpl/databases/cn.win888.banying.dpl-journal
        • Size 512B
        • SHA256 ea44603d793d70c79fe7ad314c70478bc0fadb9af3ad306f81d136fca78d5f3b
        • MD5 SHA1 SHA512

        cn.win888.banying.dpl-journal

        • Path /data/user/0/cn.win888.banying.dpl/databases/cn.win888.banying.dpl-journal
        • Size 8KB
        • SHA256 c2db02b10449caeb0d6562e1358f337267dd36a8067c0c2f648564e31568068e
        • MD5 SHA1 SHA512 SSDEEP

        cn.win888.banying.dpl-journal

        • Path /data/user/0/cn.win888.banying.dpl/databases/cn.win888.banying.dpl-journal
        • Size 8KB
        • SHA256 741f62d6f5cc1444f700094f80df6dc3d4ea8b2dee36159e649da7fdba003818
        • MD5 SHA1 SHA512 SSDEEP

        cn.win888.banying.dpl-journal

        • Path /data/user/0/cn.win888.banying.dpl/databases/cn.win888.banying.dpl-journal
        • Size 16KB
        • SHA256 4587de38394a9ba87b15ca285e65299d8530bdc760097a6cceeeae2673bdaa72
        • MD5 SHA1 SHA512 SSDEEP

        cn.win888.banying.dpl-journal

        • Path /data/user/0/cn.win888.banying.dpl/databases/cn.win888.banying.dpl-journal
        • Size 16KB
        • SHA256 022a1ff42fc46a034be40c00d11113060f020b33942f525e8cd996f3ca6c016a
        • MD5 SHA1 SHA512 SSDEEP

        cn.win888.banying.dpl-journal

        • Path /data/user/0/cn.win888.banying.dpl/databases/cn.win888.banying.dpl-journal
        • Size 20KB
        • SHA256 3f84593eb588b4e98d8748a16c64b50c641cde52dfb0bcfbeff34efa51239028
        • MD5 SHA1 SHA512 SSDEEP

        um_cache_1715809337355.env

        • Path /data/user/0/cn.win888.banying.dpl/files/.um/um_cache_1715809337355.env
        • Size 1KB
        • SHA256 6d7b1ec323f91113b9abb97aec1e576025cc1820dd956d34c772a7de000ffcc3
        • MD5 SHA1 SHA512

        exchangeIdentity.json

        • Path /data/user/0/cn.win888.banying.dpl/files/.umeng/exchangeIdentity.json
        • Size 162B
        • SHA256 1f9e3a5a5ded3de4949ece258d025a8bd242ad44108211f05d0f9da18c918d39
        • MD5 SHA1 SHA512

        exid.dat

        • Path /data/user/0/cn.win888.banying.dpl/files/exid.dat
        • Size 54B
        • SHA256 a48dcf8e576ed21eea2b8ed54f7b7b304d0e85641f92f3fbfdc228beb538f9a8
        • MD5 SHA1 SHA512

        1715809208731_4339

        • Path /data/user/0/cn.win888.banying.dpl/files/td_database1SaaS/1715809208731_4339
        • Size 1KB
        • SHA256 36a60f8559aff7d0e3da2b397fb5c53a56e93260c18e1b6f4621b00d900e18e7
        • MD5 SHA1 SHA512

        1715809239267_4339

        • Path /data/user/0/cn.win888.banying.dpl/files/td_database1SaaS/1715809239267_4339
        • Size 2KB
        • SHA256 0b4feafff53465e2ca8ddb763d0b6e9689526a0b6ea30a5bdf1eedaf8d7dcf47
        • MD5 SHA1 SHA512

        1715809239340_4339

        • Path /data/user/0/cn.win888.banying.dpl/files/td_database1SaaS/1715809239340_4339
        • Size 2KB
        • SHA256 2fde2afa68107b0475d61ab82468db194164c714c0fb276799d8a0981fb18498
        • MD5 SHA1 SHA512

        1715809239412_4339

        • Path /data/user/0/cn.win888.banying.dpl/files/td_database1SaaS/1715809239412_4339
        • Size 2KB
        • SHA256 1a200b0866f0433a8d1b6ac76aa420cc29b91612c54b5c6ca1e5bb57f0047b82
        • MD5 SHA1 SHA512

        1715809268398_4339

        • Path /data/user/0/cn.win888.banying.dpl/files/td_database1SaaS/1715809268398_4339
        • Size 2KB
        • SHA256 773c268a9857a20570ed06ca0ada571922cad4b48e343d121575d14b09e5e533
        • MD5 SHA1 SHA512

        1715809268648_4339

        • Path /data/user/0/cn.win888.banying.dpl/files/td_database1SaaS/1715809268648_4339
        • Size 2KB
        • SHA256 cbad154644fb76a233aff7297f980b784c32aaca78fa9fceb4422beca6a913cc
        • MD5 SHA1 SHA512

        1715809208451_4339

        • Path /data/user/0/cn.win888.banying.dpl/files/td_database2SaaS/1715809208451_4339
        • Size 1KB
        • SHA256 f763be7044a74894e04a0669ada31e30562ff080141491fa84d92f79a4af07e8
        • MD5 SHA1 SHA512

        1715809208486_4339

        • Path /data/user/0/cn.win888.banying.dpl/files/td_database2SaaS/1715809208486_4339
        • Size 1KB
        • SHA256 8b27bd8de5fe8b2374118b98b1f33631957a9f72c0be9807573c0cc3ba2a7d47
        • MD5 SHA1 SHA512

        1715809239016_4339

        • Path /data/user/0/cn.win888.banying.dpl/files/td_database2SaaS/1715809239016_4339
        • Size 1KB
        • SHA256 c850f0edeca4f5f9f78864418d42fe06c53bf709083cf451d87e5041ee02b4ad
        • MD5 SHA1 SHA512

        umeng_it.cache

        • Path /data/user/0/cn.win888.banying.dpl/files/umeng_it.cache
        • Size 433B
        • SHA256 08e3fb23e97650e2dd2aec5c1d5e5a8b9e6989b822304cb0a228b4f3b598ab33
        • MD5 SHA1 SHA512

        ContextData.xml

        • Path /storage/emulated/0/.DataStorage/ContextData.xml
        • Size 111B
        • SHA256 9ef7cd446ae68cbcac6dcb50835c00321f19af85f98d194f20db3a192a755522
        • MD5 SHA1 SHA512

        ContextData.xml

        • Path /storage/emulated/0/.DataStorage/ContextData.xml
        • Size 213B
        • SHA256 011b43880eb9846dd7b91f3f487d6563ca677cff095a3746c27b37994d7d9edc
        • MD5 SHA1 SHA512

        Alvin2.xml

        • Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
        • Size 167B
        • SHA256 88e88dcad177b875c910031cc10e0fe415037666df430bd0ad8961e27f436df2
        • MD5 SHA1 SHA512

        Alvin2.xml

        • Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
        • Size 65B
        • SHA256 3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793
        • MD5 SHA1 SHA512

        Alvin2.xml

        • Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
        • Size 111B
        • SHA256 37b6db0ee74a5f658e4d0cd9055988abb7506cf5e2f42d1009846369e143de1a
        • MD5 SHA1 SHA512

        .tcookieid

        • Path /storage/emulated/0/.tcookieid
        • Size 33B
        • SHA256 ac980ae6a0631fa1856f4cd2f1fd3ed41232a24fd3c77c10939f63b605909fae
        • MD5 SHA1 SHA512