425412df1eceea5a8e8486850a13ec71c5111618650e709a438200d962cf33f4

Analysis

max time kernel
171s
max time network
190s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
16-05-2024 20:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4cce26d371200bf446ff6a8b69c6780b_JaffaCakes118.apk
Size

24.2MB
MD5

4cce26d371200bf446ff6a8b69c6780b
SHA1

b102cc32701e186a776baeeee1d91c44425375a4
SHA256

425412df1eceea5a8e8486850a13ec71c5111618650e709a438200d962cf33f4
SHA512

ed73147a31be30b138db3d626a7aec121e4a230fa003beeb2c9322d080716494bf41c4ca0be020f7fd15cdfefc184ac8813b929376117ecbe631ba363e4e7794
SSDEEP

786432:Zj1kUOhZEB1Eq7qOzSmSgnmpj8yk4vvSAjUK:p1lLJ2mJmJ8ytvSAjUK

Score

8^/10

collection discovery evasion persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 3 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/xbin/su	com.egsmart.action
/system/app/Superuser.apk	com.egsmart.action
/system/bin/su	com.egsmart.action

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.egsmart.action

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.egsmart.action

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.egsmart.action

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.egsmart.action

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.egsmart.action

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.egsmart.action

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.egsmart.action

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.egsmart.action

com.egsmart.action
1⤵
- Checks if the Android device is rooted.
- Requests cell location
- Checks CPU information
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries information about the current nearby Wi-Fi networks
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:5194

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Hide Artifacts

T1628

User Evasion

T1628.002

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.egsmart.action/cache/journal.tmp

Filesize
36B

MD5
37e8e716e0e2f4a0b05cd9571d95b84d

SHA1
f8d068f6931707bddb8cd69f706f2224ad1fea3c

SHA256
7080cb592d5149c858b206d3fd0d5e3e7d601f120af00b2616bee928ee1291ca

SHA512
e62b850901835fdb73fa6224618422f721dd765861d42f6bc2dd013413e96bd910ac5313afd9b4f63da74beb12a15fac81b5157456c9caa3031862dab84423f6

Download Submit
/data/data/com.egsmart.action/files/.envelope/i==1.2.0&&1.0.4_1715889719796_envelope.log

Filesize
2KB

MD5
5f59a218d5fefcc63709daceca09edad

SHA1
e98fe5091f7bc010a35a0e4f0be63005775043b9

SHA256
f10b09e1449d913f2eeb562f9911c6eff7ac15770b2266975b4c59459a78948c

SHA512
d796f071dd47a49311d1423eaf5ff5ff1740ec1fd53b30f9e65ef16c44823600c4e302c81795345fc2f51d51e9f18cc449fd88754723fc5c062f07f16776d649

Download Submit
/data/data/com.egsmart.action/files/.imprint

Filesize
416B

MD5
64b52cbe6a576c739962eb8be12d5b87

SHA1
a38c5db033c0af36cf33ab6aea0703f1ae606134

SHA256
7ad55dc98fc6609185bcb422b006de877e587ff18c5525b8013e7788b3ec5994

SHA512
6e85a76ddb141919dfa0da4b829d680515aade15c9a7c39f7566a1a5dd06d52dc160c02ad3787f09e893a8bdddddcdafe4ed17dc4794d354e1f6c45300f7377d

Download Submit
/data/data/com.egsmart.action/files/.umeng/exchangeIdentity.json

Filesize
162B

MD5
ea38f347d5e3a2c4d269d8e26569fa26

SHA1
da9200c09c2e8460181ea17fb2cfa56e3647068a

SHA256
453ab0b282412689b979ada944a02946cba281cc17af6d9d397ebf2a7ab0e78b

SHA512
f6dd34ccb04b81b9b43a613d5554c1338a023206213a8f740b906dedbd626800181472e2114744289bbf4ec58679b34c9c6345336e888f3e21be1b929f9c9d06

Download Submit
/data/data/com.egsmart.action/files/exid.dat

Filesize
55B

MD5
7e4d60f4ed1a50bc795b27ad90d7041b

SHA1
8f98cca6da2053e7f183a5b737447f61e4178dd2

SHA256
a25f1d053dc064cac219faee02d81dac1918760d106c8b76dc7b3833ae8cb5ec

SHA512
6c87d4dcb4252b592fdb734069313a39f0f630939ce544a41193e5892cc10f46b7621d87b837d4c5ce4b2d5dbc560ce7d991a904efbfd686d82004bf90e15d99

Download Submit
/data/data/com.egsmart.action/files/stateless/dW1weF9pbnRlcm5hbA== /dW1weF9pbnRlcm5hbF8xNzE1ODg5NzE5NzU5

Filesize
1KB

MD5
a021fc80c49b8d76caad56ec5dd87f4e

SHA1
02862ef89b517a95cc4896cc1217424a45f5d4c3

SHA256
ed9e05a7f14ad10423c1fc31e8e28a98872510b815d0177912816d326bc9c91d

SHA512
3b7bbe9db46764045534d2fa321782ed71a0ddc64dbaf0f202286c1f6548a211852823d22b91a71e9a874082fe1fad836c1dca8e8211761b1c5e617c495385e8

Download Submit
/data/data/com.egsmart.action/files/umeng_it.cache

Filesize
178B

MD5
7bacd71b9cb044df6d307f06996f1109

SHA1
26b940f469cd411d0fd2bf63a07cea157a98e190

SHA256
3464a654e6be7dfbb2528b5f27366954aa7a0c4de729d28287bcaffe7dd8ec41

SHA512
4ebb77a16c4867438faa5170cfcf21efe434ec378c313a012a47d6073cc1bd151124d4964374fee09c4a87905e57ed7949c642ce792906e9c2d0ef7470572a3d

Download Submit
/data/data/com.egsmart.action/files/umeng_it.cache

Filesize
350B

MD5
7f03718e521e2b42da6342dc4c52857d

SHA1
9e795ff5c529dde82f243d0134669dd29ed95734

SHA256
66efcc2842c3445930bb18791764df48784631d8be450eb80ca27fc719d3f13f

SHA512
78eb6edcbe4cb8f93d97007360d97823694f1252ee8d331adefce4eb8a902912fb7b3499e059a47b9e8dc6181cb32a2d7b29dfd0f23d0a56888eeea044c72b1e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads