425412df1eceea5a8e8486850a13ec71c5111618650e709a438200d962cf33f4

General

Target

4cce26d371200bf446ff6a8b69c6780b_JaffaCakes118.apk
Size

24.2MB
MD5

4cce26d371200bf446ff6a8b69c6780b
SHA1

b102cc32701e186a776baeeee1d91c44425375a4
SHA256

425412df1eceea5a8e8486850a13ec71c5111618650e709a438200d962cf33f4
SHA512

ed73147a31be30b138db3d626a7aec121e4a230fa003beeb2c9322d080716494bf41c4ca0be020f7fd15cdfefc184ac8813b929376117ecbe631ba363e4e7794
SSDEEP

786432:Zj1kUOhZEB1Eq7qOzSmSgnmpj8yk4vvSAjUK:p1lLJ2mJmJ8ytvSAjUK

Score

8^/10

collection discovery evasion persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.egsmart.action

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.egsmart.action

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.egsmart.action

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.egsmart.action

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.egsmart.action

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.egsmart.action

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.egsmart.action

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.egsmart.action

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.egsmart.action

com.egsmart.action
1⤵
- Checks if the Android device is rooted.
- Requests cell location
- Checks CPU information
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries information about the current nearby Wi-Fi networks
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:4302
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
  2⤵
  PID:4382
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
  2⤵
  PID:4404

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Execution Guardrails

1

T1627

Geofencing

1

T1627.001

Hide Artifacts

1

T1628

User Evasion

1

T1628.002

Virtualization/Sandbox Evasion

1

T1633

System Checks

1

T1633.001

Credential Access

Discovery

Location Tracking

Process Discovery

System Information Discovery

2

T1426

System Network Configuration Discovery

1

T1422

System Network Connections Discovery

3

T1421

Lateral Movement

Collection

Location Tracking

1

T1430

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.egsmart.action/cache/journal.tmp

Filesize
36B

MD5
37e8e716e0e2f4a0b05cd9571d95b84d

SHA1
f8d068f6931707bddb8cd69f706f2224ad1fea3c

SHA256
7080cb592d5149c858b206d3fd0d5e3e7d601f120af00b2616bee928ee1291ca

SHA512
e62b850901835fdb73fa6224618422f721dd765861d42f6bc2dd013413e96bd910ac5313afd9b4f63da74beb12a15fac81b5157456c9caa3031862dab84423f6

Download Submit
/data/data/com.egsmart.action/files/.envelope/i==1.2.0&&1.0.4_1715889718464_envelope.log

Filesize
2KB

MD5
6ab9a9294ae70ddbfe2864bb50e5d001

SHA1
142861b432f357dd9265eaef7ea4759d5d448865

SHA256
9cab74499b32e9883662b1b3b6ae2e59b6880d6d74b4619cf83190a2a08035df

SHA512
27b00858c47613bb96fde8c9b2ba128cb621b97d9279242578a4d9cb4a2076085ab38b921fd0c6ec3be993d0f83abac0a29221d68bb1a655f611e55f0920d350

Download Submit
/data/data/com.egsmart.action/files/.umeng/exchangeIdentity.json

Filesize
162B

MD5
af32f8d773f01fcb5811434a1d71f61c

SHA1
e475165906407c005c04e1356e6f2bdef9efd59d

SHA256
df0c00d66eaaba4c69e3d5bf1c195e767adab0faa0e5c5ec9e58a569214927e7

SHA512
c0307ce586f99fedd6324587b230a16862eefaeef09edf7480269f5837418545d3436565ed081bd951c5db757b3fb04cae904bc45f162293309e4e68d9f070a6

Download Submit
/data/data/com.egsmart.action/files/exid.dat

Filesize
55B

MD5
7e4d60f4ed1a50bc795b27ad90d7041b

SHA1
8f98cca6da2053e7f183a5b737447f61e4178dd2

SHA256
a25f1d053dc064cac219faee02d81dac1918760d106c8b76dc7b3833ae8cb5ec

SHA512
6c87d4dcb4252b592fdb734069313a39f0f630939ce544a41193e5892cc10f46b7621d87b837d4c5ce4b2d5dbc560ce7d991a904efbfd686d82004bf90e15d99

Download Submit
/data/data/com.egsmart.action/files/stateless/dW1weF9pbnRlcm5hbA== /dW1weF9pbnRlcm5hbF8xNzE1ODg5NzE3ODI4

Filesize
1KB

MD5
6e5b395664b66656a45ee07172c3209f

SHA1
5999e13a661dea3d8dc93b869b91837e1ad41bc1

SHA256
7d6775b2ba38115947bf4755611c7261c20c3540ef18ec3d8d544156848ed4f3

SHA512
8e1727180f50c2f9a43fd1cebf34d642b54af66f5b4973dcc010bf6db0d3b0a315e04fe4627ea26eeb37126288344f5c9faac35d0fdf7d19e13c33bf71c68820

Download Submit
/data/data/com.egsmart.action/files/umeng_it.cache

Filesize
415B

MD5
b887a5b12cdfe12284334d987cddf6e4

SHA1
b1b944c7e457167de951e25c7e84a5c2c6c5f95b

SHA256
7f849405042162f7d1546088e8b5bc0474cf197a84c8dd32397de06f7ddff687

SHA512
2810ed4f470edaa3b8f89796415085f6778900b046fcf332aa779ade82f402af5cfebebdee30ae1f8577accac94ca6e64fcaac23e31aba8a667350a3f35ed682

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads