e4dda37c4136db759dbc72c3bf212957e981ddaa2f7fe2ad8e0d8f57a7b75484

Analysis

max time kernel
176s
max time network
188s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
15-05-2024 14:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46a8237ecbe0e5917ef9ce670c7ce422_JaffaCakes118.apk
Size

24.1MB
MD5

46a8237ecbe0e5917ef9ce670c7ce422
SHA1

3842bc1cd7589b011e1e86289d18f6f3526b29f6
SHA256

e4dda37c4136db759dbc72c3bf212957e981ddaa2f7fe2ad8e0d8f57a7b75484
SHA512

8d25a58cffef4e5c78732e2cacd439acf67fa03cc584c340f3391623c876dd7c39bc5b6067b1e8eeed4f0cf7bf984254bce0b8ec4a1fe73849600b51388bc135
SSDEEP

393216:07KWMxmZpoM2W+wO9JtjQ19ggc5KbK7ylv4Os1rgnp7h+FJhlsxbjCTASe+oqNhi:ZWHZ1UrF2g95OieSUN8PGxRF+owad

Score

8^/10

banker discovery evasion impact persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.wendenggu.jiuchou

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.wendenggu.jiuchou

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.wendenggu.jiuchou
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.wendenggu.jiuchou:pushservice

Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.wendenggu.jiuchou
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.wendenggu.jiuchou:pushservice

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.wendenggu.jiuchou:pushservice

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.wendenggu.jiuchou

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.wendenggu.jiuchou
Framework service call	android.app.IActivityManager.registerReceiver	com.wendenggu.jiuchou:pushservice

Checks if the internet connection is available 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.wendenggu.jiuchou
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.wendenggu.jiuchou:pushservice

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.wendenggu.jiuchou
Framework API call	javax.crypto.Cipher.doFinal	com.wendenggu.jiuchou:pushservice

com.wendenggu.jiuchou
1⤵
- Checks CPU information
- Checks memory information
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4265
- /data/app/com.wendenggu.jiuchou-zCsj_xE-DRgOIH1mnoXlDg==/lib/x86//libweexjsb.so 48 49 1 /data/user/0/com.wendenggu.jiuchou/app_crash/crash_dump.log
  2⤵
  PID:4299

com.wendenggu.jiuchou:pushservice
1⤵
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries information about the current nearby Wi-Fi networks
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4422

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.wendenggu.jiuchou/cache/image_manager_disk_cache/0541fae81656da68011350a561cf54552f7d9c7c22139f226fc6aafa2b5c82a2.0.tmp

Filesize
695B

MD5
5b1117199c36b2b04b32d86f173499ba

SHA1
1bc3b11bca310a2274e082c8dd88fde869f81c3b

SHA256
0577192bb6912f814cb1f374954109a3c72b82ed68024f02a708d80e55b76a03

SHA512
83ec8f85fe20aae0785f942576a4b28e3c3a086ad33d74551184c4d15bd99c8923bd574e4793bc1a10972e0ac0aa8853653d763d0836629c12d9bc4db2748b05

Download Submit
/data/data/com.wendenggu.jiuchou/cache/image_manager_disk_cache/1ed61e973ce1600ff50d7633509cdf9f2119506cb17bae189b2ae88ca6a15587.0.tmp

Filesize
1KB

MD5
1d18780f88c00cc36d82cbf3317c75f0

SHA1
849efff4f2994967a1e10d329ce28cde9333453c

SHA256
2b949192d824a1cd9287499e1c55f058ff4925cb37ee54eb856842c4a8eb9ce7

SHA512
a9de1187870211ea05bdcfacba3c8a4c6600d2ca4634309986ef1edeb5dd85664f34a1146d05370314175f102df07386fef9a1ae1cfc3902b9d4887d36b2c72f

Download Submit
/data/data/com.wendenggu.jiuchou/cache/image_manager_disk_cache/36ec08a1792bac8ecd73f05367cfd3145246c3e2b89064bedb155fba607b781a.0.tmp

Filesize
945B

MD5
114b83d05485bd1ba632b7ea58822795

SHA1
496dd790808b6a42924458e409c2ca74e5d6d62c

SHA256
623ff2cf779a6cc273733f6b6011632ea08b601ef177c1a9917f5c584e266e3e

SHA512
44e46fdc420dfd5ce8e64b92683a0f39cfe76490a2e11f900359b1bad0ab593a40f63881cb81bca999beaf90b5be4eff03d8e997feb4bd4ce4407f237ee44308

Download Submit
/data/data/com.wendenggu.jiuchou/cache/image_manager_disk_cache/ac8200eeacbf4e2421fc08f41a4083c9f94653c4a824a2cf2dbd2c296a73dc40.0.tmp

Filesize
97B

MD5
7df123f3a9fed4f8486da9f8d45aa05f

SHA1
92836e279abc3785d61aed7d6050a2dd5f95fcc6

SHA256
f21c826c2c5f4dd69cb733b6eaded341f3942dd33bbf9e6656a43bc2d7645e7f

SHA512
d2357e6e6a052d9cf6edd38b2b8cb50796a969383a1d2a53ce84457fb10beba181f320ce32357e9b717d1199cd5cdd8da8181ae85901a2d77dc02769f38117c6

Download Submit
/data/data/com.wendenggu.jiuchou/cache/image_manager_disk_cache/f7bf8ec55968737222e2db119c1b430cafc682e90bdb50966292531cf865c80b.0.tmp

Filesize
1KB

MD5
43d4cf690547dbc3599c061e2a0c9ff3

SHA1
8cdcddaaa2a5ed5855dc843bab2519d236566989

SHA256
3b230f4bc747f8ebdd4205c990c6a3bf4a28e94ea26890ed73f8b89e74b1076f

SHA512
0207ef4dc1a79bc1a706c79c2c541a43660a3f6ee281bc0268be2449b3353784c0ca286196fe27abe7abf4a6d7069e3592c73e27b23fe43c83b189a8d969705c

Download Submit
/data/data/com.wendenggu.jiuchou/cache/image_manager_disk_cache/journal

Filesize
974B

MD5
f27567aa0b6604918ad2a34fd99f4516

SHA1
9a8581b07d2988abcfb8960bf860e0b7796032a0

SHA256
1e52f0bb889a6b4273f9bdf84c8d668ec75dc8a0e42214bc67b0609cbde13561

SHA512
06195ae3d9d271fed0fb30c03c823e3af7988cd0f9b9c30feb1f0f1af61561ae2decdd05c7285cd57d9b278f20aa1f153c8457e3d439b2cf98432c7a90de6b33

Download Submit
/data/data/com.wendenggu.jiuchou/cache/image_manager_disk_cache/journal.tmp

Filesize
31B

MD5
8c92de9ce46d41a22f3b20f77404cc1d

SHA1
8671a6dca00edb72be47363a7071be65cf270373

SHA256
68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274

SHA512
30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

Download Submit
/data/data/com.wendenggu.jiuchou/cache/weex/libs/weexjsb/x86/libweexjsb.so

Filesize
32KB

MD5
5507ebec985f1ceec29e90ef15129934

SHA1
aa65901187678615a5dc9b8ab11cab09abae9988

SHA256
9a9824fa247724da36229b32c6a2db5bf7a6c837de08255e80cf9eba5843b796

SHA512
3a66ac864e5e8376ae1070ef839e970cc39ffdc452e56052ae56081cdb3a67b404e2e89efd7c021d8dce69e6c69c312d4b4a7ca7feb7c46e3f197f0b90091a9d

Download Submit
/data/data/com.wendenggu.jiuchou/databases/pushg.db-journal

Filesize
512B

MD5
bf8d0867eace4f742bc9d801dc0d436a

SHA1
f23b1646eff065b43efbb8a029379975b703620e

SHA256
0ae19b8fec92644cc8f91b23f8cb6f94248de90877db4ce293b9e77ce9fceb24

SHA512
ce4221e8301aca3fc0519d5cf21689efe069bed46999009749d3e3ea3902de12bf330ed92dfbe0212d51337cb5fe6017eaa30c4f63759e6635a562ca89e1de2a

Download Submit
/data/data/com.wendenggu.jiuchou/databases/pushsdk.db-journal

Filesize
512B

MD5
65c5a8c66338f13d058f4160a7824407

SHA1
a3f69a3f12da6f458467bd38a52310afff430315

SHA256
a3f6aefa375f05263234d283d54455aff714eb4089c64de900e91f910a07826a

SHA512
1249da3924e069b766abc6db516b566ab1e8763b6c8c124cc8b4b1a26fbf96450dd96a7f60ef12c9f5148508c1c7a15936cec29e27d52c32ddc8d3af5a5548f8

Download Submit
/data/data/com.wendenggu.jiuchou/databases/pushsdk.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.wendenggu.jiuchou/files/cnc3ejE6/eje3cnc

Filesize
72KB

MD5
fb786db2f0a4367cc19fea00bc90df07

SHA1
56a8b0906a58c13f1ca3234f80a3f79b304d78c1

SHA256
b8e543df06ebae5501072601c8e1cf1c7a8bc7081417c01c8a9422b50d842da3

SHA512
54a95de591e12249006a1ac48eb4d77b309d6582d45b54aa250a273cc3897b9e49fd5d992eb6776efad78e69fae7284f24a80b43a227e2c7a3778d55a066e7f5

Download Submit
/data/data/com.wendenggu.jiuchou/files/init_c1.pid

Filesize
14B

MD5
85647eacae50777b3bb17b26497ff193

SHA1
219c849a818cde9e51bc391436cc06a81ae628c1

SHA256
fe2b11713834266b7e619edfed88568560a7f59d153c2e6aa2d940bb2cd18ff1

SHA512
23f465fe7db319874e175ff7e56ba0cd87b75afefcbf3e173e42e98d3328732cf34c08ffe41befab9eade71ab00776ee8bd9da873a0a55d67f6f0c06404b6fb2

Download Submit
/data/data/com.wendenggu.jiuchou/lib-main/dso_deps

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.wendenggu.jiuchou/lib-main/dso_manifest

Filesize
512B

MD5
fd05870a276e3af5eefc8b8ac78eb53b

SHA1
297bdd01d13f10335f8395fb93de8805555fdf66

SHA256
7747edf26ce5a5541c41a6b57152a43662c1bda613fd7b369e1c8a2bafe28df1

SHA512
725611c269095077b49073e5eba558830f1732ef07cf3b40861be03fa646a745322fcc750b94df9feebc286f672d5dfa805b32dfdc2c99fbd9db45085ca355b3

Download Submit
/data/data/com.wendenggu.jiuchou/lib-main/dso_state

Filesize
189KB

MD5
ee5eb30f1001482f36472d13720f6988

SHA1
85ed1314741debe75e33cde4e188a8058b9766e4

SHA256
999ad11ed3a19c7fd97cb42bcb26e8d0511ae9c63bb69a7794a482a088309a26

SHA512
48afce68f74206723497e36a0372c24359b5a405e3b31781aa63b66b67b4e9374b4834b6a23153326b9f9fa051e5a92ca64c767050605a68ceba1b09f781954a

Download Submit
/data/data/com.wendenggu.jiuchou/lib-main/dso_state

Filesize
52KB

MD5
53022dd615d20547560b3216bbbed308

SHA1
d24dabaaa2a37ad451551c3eec2315df94209f32

SHA256
b836dd4fe5ad6036db19fa7504abdfaaf64d9ee1a08ac4321ea495832a4f471f

SHA512
2671c2a5b2042cdd4419d39ef127a385d57abc8b34cb00f97e42fe106668d641c9be4211fd06a6e2854d29dee47cc117c64a78b32300a3858193cbf7d1408326

Download Submit
/data/data/com.wendenggu.jiuchou/shared_prefs_ext/test_app

Filesize
29B

MD5
9cb3e3ef7f2131ce6440c7e092c4cd00

SHA1
8c41665636b1765edfd498d8dcfb6f3417f5bc1f

SHA256
e38e9989a6194ee6b9ec7baa54d99bd413144b49382fefd470226a1c25c0a808

SHA512
02347bcb0f0c7e75f27d26004a8627cd0b1bb52196ac748f657b53fd031637bdd2de1a11503fb8fdf6d88b9a7ae7666d9325dc0eea69124005ba7c4f4e63c21d

Download Submit
/storage/emulated/0/.imei.txt

Filesize
32B

MD5
41316a3330fc6619044d0c40b7210b7e

SHA1
2834390c84c667d621a7a2e82bae7cd2344012c1

SHA256
ced5b64547cb29970d17094ee14f36497880fd9c2f2b3f68b708bea5cb9824e7

SHA512
3c3d9883f1993c0ed24aacda5aa2171150dcf049f73927af665f1b072c19dfddcd5fc3c0590ab10c30166dfc39a5ac23f0eb10885a494aeacad962cd81e9f40a

Download Submit
/storage/emulated/0/Android/data/com.wendenggu.jiuchou/apps/__UNI__59240F3/temp/1715784582080

Filesize
398KB

MD5
c8fa0f06581c24920e3d62cbe5b8c778

SHA1
18826ecf1a85a877acc621fe9a2314aeb3f37324

SHA256
3d6321e57e97c79d2461646dd7ec5d2a5e10caffccfe1b6c04b17ad02a1fb83a

SHA512
8962b9a4db8594c22a572f91713089b5830cab126c8d2eef0d834c389d44805edc12ce204b6398d0c3489bba84ae6adb6bf389f0b473c9d960dea9fca2f7ca17

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads