7dc453ac719136fea0f2a250060942405addd38881ba696fa1cde9576de05fae

Analysis

max time kernel
20s
max time network
132s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
17/05/2024, 14:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4ff9429294466985cb114979e0ae58ed_JaffaCakes118.apk
Size

19.7MB
MD5

4ff9429294466985cb114979e0ae58ed
SHA1

30cdcd2b0105cd89aa7d785aba479e0265fc9f05
SHA256

7dc453ac719136fea0f2a250060942405addd38881ba696fa1cde9576de05fae
SHA512

e106c7e61dc4a3bf21b91922fa4138c9ec9a32791e8b2d8a04efb75919f2ef2929f43ca7bb69e6a3f19772995e3ca5c6813a9a6398d796eaaff1894046969771
SSDEEP

393216:mZnF6OQbpyzAqv6vd5IrgqYTosRVAzSIS2OJZTkSSTJja3sSq8smiPI89+dCkkMo:uk3bpyzAlX+greuqOJZ4SeJmsm9dCkeN

Score

8^/10

discovery evasion persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.yto.client.activity
/sbin/su	/system/bin/sh -c type su

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.yto.client.activity

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.yto.client.activity

com.yto.client.activity
1⤵
- Checks if the Android device is rooted.
- Checks memory information
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4311
- logcat -d -v threadtime
  2⤵
  PID:4415
- /system/bin/sh -c getprop ro.miui.ui.version.name
  2⤵
  PID:4436
- getprop ro.miui.ui.version.name
  2⤵
  PID:4436
- /system/bin/sh -c getprop ro.build.version.emui
  2⤵
  PID:4461
- getprop ro.build.version.emui
  2⤵
  PID:4461
- /system/bin/sh -c getprop ro.lenovo.series
  2⤵
  PID:4486
- getprop ro.lenovo.series
  2⤵
  PID:4486
- /system/bin/sh -c getprop ro.build.nubia.rom.name
  2⤵
  PID:4513
- getprop ro.build.nubia.rom.name
  2⤵
  PID:4513
- /system/bin/sh -c getprop ro.meizu.product.model
  2⤵
  PID:4543
- getprop ro.meizu.product.model
  2⤵
  PID:4543
- /system/bin/sh -c getprop ro.build.version.opporom
  2⤵
  PID:4567
- getprop ro.build.version.opporom
  2⤵
  PID:4567
- /system/bin/sh -c getprop ro.vivo.os.build.display.id
  2⤵
  PID:4592
- getprop ro.vivo.os.build.display.id
  2⤵
  PID:4592
- /system/bin/sh -c getprop ro.aa.romver
  2⤵
  PID:4619
- getprop ro.aa.romver
  2⤵
  PID:4619
- /system/bin/sh -c getprop ro.lewa.version
  2⤵
  PID:4644
- getprop ro.lewa.version
  2⤵
  PID:4644
- /system/bin/sh -c getprop ro.gn.gnromvernumber
  2⤵
  PID:4669
- getprop ro.gn.gnromvernumber
  2⤵
  PID:4669
- /system/bin/sh -c getprop ro.build.tyd.kbstyle_version
  2⤵
  PID:4694
- getprop ro.build.tyd.kbstyle_version
  2⤵
  PID:4694
- /system/bin/sh -c getprop ro.build.fingerprint
  2⤵
  PID:4720
- getprop ro.build.fingerprint
  2⤵
  PID:4720
- /system/bin/sh -c getprop ro.build.rom.id
  2⤵
  PID:4744
- getprop ro.build.rom.id
  2⤵
  PID:4744
- /system/bin/sh -c type su
  2⤵
  - Checks if the Android device is rooted.
  PID:4769

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.yto.client.activity/databases/bugly_db_legu

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.yto.client.activity/databases/bugly_db_legu-journal

Filesize
512B

MD5
ec75ed63576eb74688b0f2b9b8057d9a

SHA1
a1a24f5f53424117f2e03e43dc4f17b2fc35211f

SHA256
1f4818b6b147f4d8c756ad9be419be3ac167d45119a8b13c8a2fb4f8f06883df

SHA512
ecc20ad00d0f63511d3d89fcfc476bb81aa00cffdb2b3aee7de96b94ed6158ba19113d531572a9f9457c9a8343ee9264ef40b632070dbeea40fe9d66b41a15a9

Download Submit
/data/data/com.yto.client.activity/databases/bugly_db_legu-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.yto.client.activity/databases/bugly_db_legu-wal

Filesize
152KB

MD5
6bb14496d813f39cc4a655b3cbdde337

SHA1
40fa2e8b7fa85738f4ac5d7a9a98fd713c916ccb

SHA256
a54f5396595ce0628ed9e192bc7a656e74c99c34158b1a7c73e6070ea8f7bef8

SHA512
0d90d3545f855ce28f3f30278fd44f437e6eecbc92eb9ccd97ff7ad4b3ab916a2a00cf224d3cf9dd1a5aec93ffd448fc4c43b351c21095e08bf2300f6cf8e74a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads