8cef4dd7a57ac4e45a22e865350aa603d196d6373cccc5d4219ecaaf2a06fc5e

Analysis

max time kernel
125s
max time network
155s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
16-05-2024 11:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4ae410d85f9ddf89a9c577cefd356e21_JaffaCakes118.apk
Size

1.2MB
MD5

4ae410d85f9ddf89a9c577cefd356e21
SHA1

c8843ed427463283d8bec704195941534b19ae66
SHA256

8cef4dd7a57ac4e45a22e865350aa603d196d6373cccc5d4219ecaaf2a06fc5e
SHA512

8656b16c7fde4fd3dd339eb47c6debfa94cb8aeb7dea7640f77bfff41daa76f7189513c30c46ef62b88c78b96764ae1eb5e793f63fcee894c952f03d68938f5c
SSDEEP

24576:mpEuTjlhBdsfHSDP4OzgmTjfYls64v7WrGWu4RextCtBZ:mHTjlhBdsHnOsmTjfsiwR9

Score

8^/10

collection discovery evasion

Malware Config

Signatures

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.chenai.aiqinggongyu

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.chenai.aiqinggongyu

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.chenai.aiqinggongyu

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.chenai.aiqinggongyu

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.chenai.aiqinggongyu
1⤵
- Requests cell location
- Checks CPU information
- Acquires the wake lock
- Checks if the internet connection is available
PID:4318
- logcat -d -v raw -s AndroidRuntime:E -p com.chenai.aiqinggongyu
  2⤵
  PID:4389
- logcat -c
  2⤵
  PID:4417

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.chenai.aiqinggongyu/files/mobclick_agent_cached_com.chenai.aiqinggongyu

Filesize
100B

MD5
86a31c3c19196b6a2c88a86c4c95593a

SHA1
fbe2ff0daed278d3883567ac079113aa0a2e92ae

SHA256
68e69971ecd934e39f9965cf838018ee9c32e96f647b27b7381e80c38ab38186

SHA512
06dba522eaa504110cb08f551cec8af219c407a559a595f3b7bf06852afd02c727cf453198d2516e13dba09e60538722409528c0c92e6c489e8eee8ec0dcf8e3

Download Submit
/storage/emulated/0/.android_/b

Filesize
90B

MD5
0f89cd47751d3b6c53f0caf011cc5633

SHA1
214563c60938e39d0fcb9d48002b1ff3131126bd

SHA256
f36215e8925dccd33ffd15ccb864a5c335b32524924364d5cfd22d62659d66ea

SHA512
773f8afa025ac15fab4297845855b23b4c98ca5b039ef48243e58984bff14c7b85bbab084955058370bf8d64e51cc6a871996cf530e696f43f03252340fc111d

Download Submit
/storage/emulated/0/Download/ads/rt.dat

Filesize
15B

MD5
fcd64e7de49e2a429b22d55ed7d419ce

SHA1
f25bb536ca0531050398a37022d8aeae0b535991

SHA256
65d3cda3f925650c33a7a3ee5af9ddc804b6fc33f92a03868da20f4254d36910

SHA512
35226f93e3eefa1046bd7fe53d66e79d1c584dcb8926a93fdb60ec47eb4904f1c8a15a672a34aa940c6c8501a61266a4326fcec98e833217d125e892e4840406

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads