Overview
overview
8Static
static
650782829ad...18.apk
android-9-x86
850782829ad...18.apk
android-10-x64
8CommonPlugin-3.4.apk
android-9-x86
1CommonPlugin-3.4.apk
android-10-x64
1CommonPlugin-3.4.apk
android-11-x64
1FrameworkP....0.apk
android-9-x86
1FrameworkP....0.apk
android-10-x64
1FrameworkP....0.apk
android-11-x64
1WelcomePlugin-2.4.apk
android-9-x86
1WelcomePlugin-2.4.apk
android-10-x64
1WelcomePlugin-2.4.apk
android-11-x64
1gdtadv2.apk
android-9-x86
gdtadv2.apk
android-10-x64
gdtadv2.apk
android-11-x64
Analysis
-
max time kernel
179s -
max time network
181s -
platform
android_x64 -
resource
android-x64-20240514-en -
resource tags
androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system -
submitted
17-05-2024 16:44
Static task
static1
Behavioral task
behavioral1
Sample
50782829adb6127099f799f794572868_JaffaCakes118.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral2
Sample
50782829adb6127099f799f794572868_JaffaCakes118.apk
Resource
android-x64-20240514-en
Behavioral task
behavioral3
Sample
CommonPlugin-3.4.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral4
Sample
CommonPlugin-3.4.apk
Resource
android-x64-20240514-en
Behavioral task
behavioral5
Sample
CommonPlugin-3.4.apk
Resource
android-x64-arm64-20240514-en
Behavioral task
behavioral6
Sample
FrameworkPlugin-3.0.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral7
Sample
FrameworkPlugin-3.0.apk
Resource
android-x64-20240514-en
Behavioral task
behavioral8
Sample
FrameworkPlugin-3.0.apk
Resource
android-x64-arm64-20240514-en
Behavioral task
behavioral9
Sample
WelcomePlugin-2.4.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral10
Sample
WelcomePlugin-2.4.apk
Resource
android-x64-20240514-en
Behavioral task
behavioral11
Sample
WelcomePlugin-2.4.apk
Resource
android-x64-arm64-20240514-en
Behavioral task
behavioral12
Sample
gdtadv2.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral13
Sample
gdtadv2.apk
Resource
android-x64-20240514-en
Behavioral task
behavioral14
Sample
gdtadv2.apk
Resource
android-x64-arm64-20240514-en
General
-
Target
50782829adb6127099f799f794572868_JaffaCakes118.apk
-
Size
4.9MB
-
MD5
50782829adb6127099f799f794572868
-
SHA1
bc1eaff041668d8015c8d3ba0eef949cccf23dd0
-
SHA256
4499f7b775d18998fc1ae4a6851e66ebd0f51017a758f8320687a738a16c5771
-
SHA512
ce001abf5ae76683eca6e21f908684bbc728a4d0a1cc73d17bb6bd5b5fc76321feaf3e1149f81dcb190a3f58c9ff24c3053a509073031c1ccf349f1982d631eb
-
SSDEEP
98304:7HDcwyHRXY3osK/aHhpg1RltnGyKXHdirV2UqrE0SCqIsQgl1FesZfr7CzLLw/oi:73+1ios0aHM1R7G0rVNqrNSCxsQM1z6Y
Malware Config
Signatures
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Requests cell location 1 TTPs 2 IoCs
Uses Android APIs to to get current cell information.
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getAllCellInfo com.syezon.wifi:remote Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.syezon.wifi -
Checks CPU information 2 TTPs 3 IoCs
Checks CPU information which indicate if the system is an emulator.
description ioc Process File opened for read /proc/cpuinfo com.syezon.wifi File opened for read /proc/cpuinfo com.syezon.wifi:remote File opened for read /proc/cpuinfo com.syezon.wifi:push -
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.syezon.wifi -
Queries information about the current Wi-Fi connection 1 TTPs 3 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.syezon.wifi Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.syezon.wifi:remote Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.syezon.wifi:push -
Queries information about the current nearby Wi-Fi networks 1 TTPs 2 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
description ioc Process Framework service call android.net.wifi.IWifiManager.getScanResults com.syezon.wifi Framework service call android.net.wifi.IWifiManager.getScanResults com.syezon.wifi:remote -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.syezon.wifi:remote Framework service call android.app.IActivityManager.registerReceiver com.syezon.wifi -
Checks if the internet connection is available 1 TTPs 3 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.syezon.wifi Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.syezon.wifi:remote Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.syezon.wifi:push -
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
description ioc Process Framework API call android.hardware.SensorManager.registerListener com.syezon.wifi:remote -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.syezon.wifi Framework API call javax.crypto.Cipher.doFinal com.syezon.wifi:remote
Processes
-
com.syezon.wifi1⤵
- Requests cell location
- Checks CPU information
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries information about the current nearby Wi-Fi networks
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:5112
-
com.syezon.wifi:remote1⤵
- Requests cell location
- Checks CPU information
- Queries information about the current Wi-Fi connection
- Queries information about the current nearby Wi-Fi networks
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Listens for changes in the sensor environment (might be used to detect emulation)
- Uses Crypto APIs (Might try to encrypt user data)
PID:5208
-
com.syezon.wifi:push1⤵
- Checks CPU information
- Queries information about the current Wi-Fi connection
- Checks if the internet connection is available
PID:5332
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Hide Artifacts
1User Evasion
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512B
MD5ee140b7dbef467cb054996e1cdd37f7d
SHA1cdbcc44b74506884130ccf582255b119fc1c3111
SHA2560ab4725cb9263c0d4046a83c1f256d998008d040766e58ced205ba9235b0c29e
SHA512e13d4c105816c3f03f3976e3712d2a01156b43f25f20c18248ed4301a57a25b13d4b0081b615ae4a060932b8cd367ac0946d62094939b57292e01e4c50b84957
-
Filesize
4KB
MD5031a24b538506de97f825c0c82b99bfe
SHA1bdcf439a8ced117f7b8eafc2db438403a43c0080
SHA256c91d528e718aa9266ea464f9d85d288ecf14decd2b4843750ae7ec13207c2591
SHA5121440e299f568e8fd275774f359ee42a0cd4ae414c7783250321ffc440b90d634e34f78d474b6321ce60c7e34d8b75869735ba9f5a92140196e9f33f53510ebdc
-
Filesize
76B
MD5904673ee55a42956ab634328c3456f80
SHA1465fa352ba9f5a88f0465036db5aa0be8b4dadf1
SHA2560d79fe42527aa94d98c704524123a94c80478a6fff733c50abb23adc1ba780de
SHA5124eca44ca3df6ea38d9e0e85c331b179bdbb51ef5ec4056c04d8e66a1d6cfd4c03fb55bc9427f1c0ba47a384bbacb3c386acfa8bc9a3e05796b2f35735b39fdce
-
Filesize
663B
MD53cf8ad7249fa09301b0a276b9861e719
SHA12e2499c83b1d9629fa4ca2bac1fe18256e03e9d5
SHA256e2f1cae4f87eb9eb5001c90b2eb03c91f9304e4d59489d6ba27ed0330a8f6979
SHA5122c69d7705542722d58545b4c487353ec08e8c9e9d0a630a26deb82dbd8203983e63de55be626f40bd77a5a32a312ad255bed162a3f89a03d6b760e9a4a056a51
-
Filesize
656B
MD5575c6ad8090c2e4436db47d670d20bf9
SHA1939c69d28c9d2d90a47b4106119621c09aacf0cd
SHA25648f004ea938222f19d7897d4079cbc9a59e65d93487f3cb6b7cce200cbb43d3c
SHA51295be50ef901b6d60f4840e0777d8116b2e48f6dcdcb983e2184d8a1657260329ac4c6c045586d3ab5e8914c826501bc5161488c436595c2f5c0018f5af2f0ea7
-
Filesize
235B
MD5174a23244295d4e443627aefba4747f5
SHA173d8fcc7f64cd9b7efba2be762625e56e6a485fd
SHA2562f7397ee1b4b123fbd35f3e171a478b61351ca0c2449a20402c543b022d343f5
SHA512cc7d57213364d5619d454e4876d56fb08d4fed49be9ef7dda1212bac1b5310955737664c51b0df4a3c3417dd33338f41046829e9d9635c91ec2cfac2f03ce920
-
Filesize
28KB
MD549eefa442e55be8652c7c3c5f28d912e
SHA1941ef7e65d47d38dd5f47084663f4fd7f57fbbc9
SHA25663d7b59dcdc791b5d1380a1d06b9e199f6136965dc21a887efdd0cfac9d0a1b7
SHA512b6c9d8a985a865c43348e34d94f149e4b552359d9afc7f5db660535ea107fbbdcedee542b9bfa018f1881c6c021b1e9bd331debe9562dcdffe2f8b3655d2d3c7
-
Filesize
24KB
MD5990270a748f0b96a819bfae8efc62e76
SHA145fb27ae8b26d77882020ba80e23ec0a4fdeb3a6
SHA2567d9a3efea56af448214f9f1cfef2e7ade550e7c1083e0b0a0c3956f974c24bba
SHA5127c49c7288dbaceeaf244ec5ced4b2eb6d44a56b1f6f4237ecef8d007d1abd8990c20445a3e56df5d0004a3cc64ad8b94b94427abbb4e0892ac103b294d13df24
-
Filesize
80KB
MD535e1c0fb9c3da55aa7cbfcffc7507083
SHA121e18d4d31b0aea597464b5a29e6919935e8ab3f
SHA2569b06a584b6e022b185e4822c202d8e28348d377027399b40dcde744efacb34c1
SHA5128d787a76cf3769bb9b1eb0c9275fae9b3034e739fe6bdeffe67dcd7c19d47ee16631d1f357dd8ec7a4d07c710505a7b517cb76333e3749beb65e6ae72ac35d80
-
Filesize
8KB
MD5417d311792fa38e35512e50beba0e042
SHA1d1411be19b5e7735ddcf5e7a5ba4a8113e52f86e
SHA2568aa0406aead07054365541a08cad60512fa1c7c91579762154f7bae733b64306
SHA512113a6854b1280ad614ab61fe1de37f8d28fe4a08af5f727a9c25019ba24a65d97453fa236ecc0c44cd38813d01fdda85744f39d5aa9607dec8880975a4803b08
-
Filesize
28KB
MD5000875e1a2106f82b0f0ead4e052747e
SHA15cf90b842489c3e12c9faef7ddbdf20d009a4291
SHA256f338cd34759dc56064be9758b8f028b0013f70bb2e14baa81de9b1085842062c
SHA5121dfdd9f99426e7592ba7958b5f37cd95c2cecd45bbcfd8823506718e5a48b73f691f5f5755618994d8fbe7118caf6c45fadecdac26763530b405be6fc39d4eba
-
Filesize
8KB
MD5b1e6be0ec8024aac356a20de7cca7aa8
SHA1780dc838d2fccfe7a55a1dfc16b90a36e23c7737
SHA25617851d1638eea5d29ddd103166f4ba46600882a7e5c18944859ccb6681d06780
SHA5126bd47ef973c06288b1d4964461de1f2df80b596eee4b169f83601e35563fc93a032d661fcdc5220e1853fb5ef1fc85b097ced3f7c0a867701301b311be38cb01
-
Filesize
8KB
MD53c74d4cacf78906d2c00858eb20d5986
SHA125863a4a6d8c27c72098d11c6c3e35108a008b9a
SHA256fdab21c3169ee8b17d76b3eb924aed7d8fd26308a5626e130b0a747570107475
SHA5126ecc256f48c208f5feb461ae9184ffbc9e0ed2b9fc0e02c0f802bd4907d2b00ff7f9bd2954e7cb1d07584f18cd91084a1c44a7cdf1d6d264fd18258c97ac9aaf
-
Filesize
8KB
MD52d461c02c12c797f2c97cc47768a046a
SHA11ce9e3458e6329ba42eb6e934f9a0aa0724ea93e
SHA25680362863476d26e23bd49fe754612cd138f5936a75f68929a3e33958184de665
SHA5129d787c89c172fba94728f426986e335b0dc82109ff7a6e6896d6ec4913b3b40cb2353dcafc60943d0a4d2ee880c2b4771ebf626cd4c6b028c3de0e5613c2315a
-
Filesize
8KB
MD5f1e6764db5e91f62a92e3d207a3fd046
SHA1d311b6c3b413decd5ffb3e69833a2b67e00c4f79
SHA256fe4115d7d82934e1829332607ca0fbfa55320dd3f8bb98a64b007f2a94d4f525
SHA51297722e911facb382bb6ca2c75d9a04d01f5e4a3e4c40f93faecec0987fc60da60515ab4595c309a91a3dfb0f8320c996a13b1b9cb5331797cdb8fe639c73f9da
-
Filesize
8KB
MD5a8a4fc408ad9a31fc48049e3ff794a9b
SHA11424f541b6f086799503f32cb2c189449c87649f
SHA256134113012c79c28769533d568d62462fc76fe0dfc3a0331e222a2a1585a060b0
SHA512a9ab77f4a13afb7819fbc3a32a2ce86104b140e8acd56320ff298c96ce10c195120622afaf837fa9d60adb7be8dce1ee12b0b48aaa8ab70f0790a8abb030db4b
-
Filesize
453B
MD52b7e998f4ef5bb5aac10d358f61b6357
SHA12b8c6e395c48a17e025bd2fa07e6ae47b2550996
SHA256907823e2dcf6b322bb137b1bed7c46aa5d6f24428b05a61eed4b4e1cfae76d82
SHA5129f6264419b9e7d3a42f7092a2471a2c2fe64430c5ce755c28c452ab56117ee20d8fc1482e539726eab845ca4c704f838c375031726e8266bbdcfba63151cc1e9
-
Filesize
788B
MD53889e631580e6a3c3987f481b1d544d2
SHA1dd7aace74941358e3123acbd4e52f81c64f651c3
SHA256bdd8daccd0bd30f759331c820525c26ba6719708a784266a6124b7bc14d0be8c
SHA5127361ff87c135d787a175a8c775dc9ffcf7cc55b7db27d874465b95324acfdfb6d218ffe6c13414ea04607e80b95d6cf634e303489625e5cf68f196af81302746
-
Filesize
408B
MD5e3e14bfddb91d19c64c64525fab6c255
SHA1f0010d8ece4ca42f99a593e53d7b53ff62d56279
SHA256efbe9cad4d25e5aeed8e85c550ae518f760e08c60023daaeb97b1556e26ea912
SHA5123c220e3486361a3a5229f6321609bba825776c33c1bd0c880a12f32e9c57fb2a33b92522f9e5f27a028af07e7b076f28602abc43f1bcfd4bdddebfe0f0f54dfa
-
Filesize
491B
MD5d8e32bb7cecdd844b924faf031593c26
SHA1b70d59342564e59e8466ce317f7c6f03bc60c213
SHA256d900379c7c7db0f20ea5c94f4fc4c6d2faf00249676d59475676f489670e6aab
SHA512aa5886e9e5cfcefc5515d317fd038b6321669610f2a7c40f80b09abcd9b674191c86d0f8da6906fbce1ea83fcda8bdcd63af950046e67fcaceca26e0e779fadb
-
Filesize
28KB
MD55efc3643a45bb7411d398b10d3993850
SHA13b6d679f7472caa7ded20eebb16f54d63a468c1b
SHA2568cf1e3768c9fd6565b214280156521d30f3a27563afb12398a326a2d0456dc81
SHA512a1165fc281dfeaafa57b4dc6251fb7018ce125ac4222f5e664ca16a5b41ab1dfa72dff2298234bee8f327ccd95ba3634bd990a63edba0a7c75f48492768ab051
-
Filesize
512B
MD5d122c4343d09831f9eddf7b441817439
SHA113456cec187e226be81e1d0dc051af91bd467e99
SHA256b341b2e2bdaa18a3df4687b077dd8cfaa2befdb0dc3c5d942d80ac17f796d29c
SHA51221b6b6ee8a6776f4edf57cfd53b747d8643ea63dd6b621fb786c88b74c3189750a1662c80d1a731e59de873f3ecd2027fee60ba6d3ceb6bb4b5f122d0d955b87
-
Filesize
8KB
MD51acca54aea6f2c54f3c6a7dd75430f99
SHA1f6e58fc76a78a608cb4efd1d7439856bf2670928
SHA256a91953e5ac173c43471dc0237bd8b181e1d9b1d885d01af6c4c5bd5605512180
SHA51207ca0fd4ae880043d1d04cdd6e6d179713c555adfc117e966e8eabf5ed6bdbdfa3c8c9690aa4fb7a070b077a9087a486413ab74f4167c37822fd1d624b14fbb4
-
Filesize
8KB
MD566fbdee9a0d38be23fc87d6dcfb7f0b1
SHA12f8be483235e789fe7e35f473dc9f0bbf6e3fa0f
SHA256e1d2bc1262cf4b8e9ad9b292faa9198f997187856876a0660c280896a6491ba9
SHA512ac1656d7e9792392b324a34635dc761568acb5997683949958340c7c1626398125fc6ea1fd72de9b5ec029f55b73e63f1e9e62cd0bf17d67c56004e452133cc3
-
Filesize
8KB
MD52bb3bbcea632193f5d3d96315c1e9ae8
SHA1efe74e0cb424b465944d70e586e11a4bbfe847bb
SHA256c692d1efb69af98b997cc0c28425e05952b3c033a20f1c1826f623c5aca495d1
SHA5121ec50c2454e2459f62f439e560712e7b891b6d518cabbeb47dc35af1c79ecbee55ae2dcb8407a3d64aa632ed220e05dc007a70b9d435644ebd9ca58c18c82dcb
-
Filesize
12B
MD58d80bc8ea90e9cac010d3ddf97bda5f5
SHA1f063bc0d356e6ba9ab1eb9a851131ffbefd8fa07
SHA256f52db31332534833414abd5e870f78c810b8ebbe5b134bbf599506beecfd1b93
SHA5129ea732dd572a9a4ba91b70891972230a09576687ca1bc19e62d5a98b5b84e0f2ae11985108008bc9fbccf357219b8bd3dbf146bb70752f618f70dc5d0c46a7c7
-
Filesize
152B
MD5054b8147fd56ee5611e9692a8cbc22a0
SHA168b20f2316a3e79853d38a61345875a056e85196
SHA25626e631168b56222a6b7b925525cbf6decfe346c0a9d8447edd9d346b20ebd1c2
SHA51240f8dfb54b8939f6a3f004ac5e20c1c505ca29adf841cbb7da771e1b5fe01535d224fadf0119f6ebf5c69fd911eb61846b7394089f6e6d24259baf57cc3fc9bb
-
Filesize
24B
MD5161557b06b4a4d3ce095528dea370eb7
SHA18bfe9c4d916fe58d856b5a6ecaf8cd9ea4df2c9f
SHA256f054ef19481234ee5b2db1d1c681839dab235a857ed3a4bc02efa8f785f478d4
SHA51296ce8aedbdbb387438efc86aaabd13a6378628bfae203d2bc25ea1cd7daa6ddbd6dd2c81d631fbdc9b653a93011d3c80f0c085580275b683d5e0bce077e6e449
-
Filesize
478B
MD5a37f83f88d854253f311e4d117f7831b
SHA1180d8f0c94605d57ae73fb4a4e4d4368b2386930
SHA2561ddb3036b3bdf9ab26c5c71b93c06a7503b7083098200605f8da6be242f7254f
SHA512ad69943716e3e9d7eac193d75f4df1ee3197e8dd159d7baf65929463b035c63752d317f76d465ccfaefb97b8a31622b8916568020aa5a1c65a596d7747717094
-
Filesize
109B
MD581ced8bd5ce01f214a97d01566727521
SHA1aef315ef77915839613090d0228e5f263e620043
SHA2568832dcb27e5df0cb095fb8165c19d4070be02d20c04dde15aa4bfd4b1b8d5e26
SHA512c0a414692d7a9e3f4469119d2db4f7676c3a6d8d2ae6a5131ccd7917ef6cc65a8d4ce6291c33aac976c580716930250272efeed0a27d46b18052cef83ee6bfc4
-
Filesize
96B
MD58cb9b705c03bf2f40f65618e6df1a7a5
SHA15623b8a36d048d265dfcc007df85cdf0e389b13c
SHA256029de0737643c2dcf40481d68d2164a453497886450eb73b005391bdb477d986
SHA5125355b4ae56ffd4886c9923daddb0793f56bc5b1a1f5d24a83c76a1ce9068b8892519407d1e2f89dc3f031a0858cfe5dd3b80f9d4eb0fca58ae0bf3f9a666f542
-
Filesize
8KB
MD5d8167f2e4d2f45c801f77dddb764b947
SHA1b4a4a0f6f473f366a787a7f9e87b172e87c09c74
SHA256531541ee68a2dcbe71b84648dcec4379d9f755693f393b324c15fd8b0bb0f50f
SHA51255862ce3035d04b3fc1fa874b85d6885d9ba1c3102d64639ba122c0bb1c4d9de8427b15941bbd294ad11ef922b54e38520721b6123ea69b628fd9534e5b500f6