f2d50027840a8938ee1bf2f74de8f0128e255ea24589aa53b4e986d2a9095fd2

General

Target

4f505fbd18622b6c35cf165067af4066_JaffaCakes118.apk
Size

5.2MB
MD5

4f505fbd18622b6c35cf165067af4066
SHA1

e877c473542995545b20d5875abf923399096ede
SHA256

f2d50027840a8938ee1bf2f74de8f0128e255ea24589aa53b4e986d2a9095fd2
SHA512

9ffc1273be2b11fc5db4dd956c2ca27779e92acd2c4f7dd90a4c08fbba9ff71639183848caa029d3ac5424b210377a7ea983aac39e45e91b7aa1904baf98a117
SSDEEP

98304:lCFt7jtoVfcjNBkBgXl3ucyXg4VIO5fSVdOIIJx/5/MOCbviZXkym:lCF1jCVfFgXl+cyXgov5fSDGB5/HBXk5

Score

7^/10

discovery evasion impact persistence

Malware Config

Signatures

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.dalongtech.cloudtv

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.dalongtech.cloudtv/app_push_lib/plugin-deploy.jar	5159	com.dalongtech.cloudtv
/data/user/0/com.dalongtech.cloudtv/app_push_lib/plugin-deploy.jar	5229	com.dalongtech.cloudtv:bdservice_v1

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.dalongtech.cloudtv

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.dalongtech.cloudtv:bdservice_v1
Framework service call	android.app.IActivityManager.registerReceiver	com.dalongtech.cloudtv

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.dalongtech.cloudtv

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.dalongtech.cloudtv
Framework API call	javax.crypto.Cipher.doFinal	com.dalongtech.cloudtv:bdservice_v1

com.dalongtech.cloudtv
1⤵
- Checks CPU information
- Loads dropped Dex/Jar
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:5159

com.dalongtech.cloudtv:bdservice_v1
1⤵
- Loads dropped Dex/Jar
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:5229

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1

T1407

Virtualization/Sandbox Evasion

1

T1633

System Checks

1

T1633.001

Credential Access

Discovery

System Information Discovery

1

T1426

System Network Configuration Discovery

2

T1422

System Network Connections Discovery

2

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

1

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.dalongtech.cloudtv/app_push_lib/plugin-deploy.jar

Filesize
213KB

MD5
e70723b8f6c4c7c09a6019733022cf53

SHA1
e3ca32166c65e4dc73c21347ab22d54a7b5a9a83

SHA256
32d35cd80b0302e3fcdd7349b4ff9a7b689ce080435109607ff79a834ff710d5

SHA512
461c0499193c5ef5aa4e2e5d358031e7d28c98c8e1e38d22b710271bf3b561c28232bfaadbc2c275357e31b7b0ad6bca798008328ac3cff3701c1c9cca2ddddd

Download Submit
/data/data/com.dalongtech.cloudtv/app_push_lib/plugin-deploy.key

Filesize
174B

MD5
1ea8459a688352c3573a8e80727c2644

SHA1
9b47864e96eed98798a6da2b8860c8f8a68f089e

SHA256
be2c0f9e472138a78d35f29013fc43dfeae991806dfebbc5be5c8dc86b8a1093

SHA512
99a26c03e760fdac91546a47e18e58851996b7e38e93812a6be23f1eee64370323ac492c4c224bd419d91566356fcb8eca3989ff4f2ce41db3d16301fa9dd75f

Download Submit
/data/data/com.dalongtech.cloudtv/files/.um/um_cache_1715937429675.env

Filesize
596B

MD5
a1126ca90d372cc31497d464eef0a4cd

SHA1
b8ad47a7f00627d9aadc95719805ec5675d51e03

SHA256
3b016ca579fd3b6bf9148f52f140aa0f7554b9992022827db02c7ef2f63b0ab5

SHA512
a4ac446afa5a5302fb66b9ff10fc474c5d528e83546609b301cd434375cf1cb087f2c3da79a7087f3dad6ba41515fd494fa79bb3fb57e0e4333b72e3bc7498bc

Download Submit
/data/data/com.dalongtech.cloudtv/files/.umeng/exchangeIdentity.json

Filesize
162B

MD5
3158e9d8c6af69aad97c74f0eb29d40d

SHA1
4cce46789929529cfba78c366a9c7b701c7745fa

SHA256
6b9e524b03982c5a87c2945f0fd1db54f2567521c5a1da7dd1858cb38ef1fd8c

SHA512
da18de31ea7f2e1115c5cbdd79a6b6855ce9385da36a30008b805cf5b905f0b53f52b540c7f5701746d565f84b0f621d4fbfd86207c7b9365d4ab6f1b4641498

Download Submit
/data/data/com.dalongtech.cloudtv/files/umeng_it.cache

Filesize
245B

MD5
6e2f178f26615ed35a1ef294cc3ad7e9

SHA1
ba6f7136b7e712c0f8a3b090329b532753e7403d

SHA256
7d0587b64637cce9f9818d6eb1947cf5dd78507ca2e8f2107eac0c8b8ef3bff8

SHA512
e374292e7b246a8dacd192c71a041e8a31bbf89a4ef798f681cd684e31a679f7cebec78ed24bc09951a1c07c07b9791818fb5ce2f0fe61338a4a231ac4e81226

Download Submit
/data/user/0/com.dalongtech.cloudtv/app_push_lib/plugin-deploy.jar

Filesize
530KB

MD5
bdfa71feb08b80b649fddcd7488b03b4

SHA1
bcacf11199fd2c353034a7271b5dbfe2dd4cbddb

SHA256
f8bd07a7afce2d102976afaadd33dc70336a0b06682ac8d6fe9544a08d086d1d

SHA512
37dc848b995def498d0c832a76ed0ad429db18f26a5e9659c2b77a63bff555560160b6be4d22387eb529b2291bb27ae21718ddadb315bd1aa4c092d6330f049a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads