Analysis

  • max time kernel
    179s
  • max time network
    181s
  • platform
    android_x64
  • resource
    android-x64-20240514-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
  • submitted
    17-05-2024 16:44

General

  • Target

    50782829adb6127099f799f794572868_JaffaCakes118.apk

  • Size

    4.9MB

  • MD5

    50782829adb6127099f799f794572868

  • SHA1

    bc1eaff041668d8015c8d3ba0eef949cccf23dd0

  • SHA256

    4499f7b775d18998fc1ae4a6851e66ebd0f51017a758f8320687a738a16c5771

  • SHA512

    ce001abf5ae76683eca6e21f908684bbc728a4d0a1cc73d17bb6bd5b5fc76321feaf3e1149f81dcb190a3f58c9ff24c3053a509073031c1ccf349f1982d631eb

  • SSDEEP

    98304:7HDcwyHRXY3osK/aHhpg1RltnGyKXHdirV2UqrE0SCqIsQgl1FesZfr7CzLLw/oi:73+1ios0aHM1R7G0rVNqrNSCxsQM1z6Y

Malware Config

Signatures

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Requests cell location 1 TTPs 2 IoCs

    Uses Android APIs to to get current cell information.

  • Checks CPU information 2 TTPs 3 IoCs

    Checks CPU information which indicate if the system is an emulator.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about the current Wi-Fi connection 1 TTPs 3 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Queries information about the current nearby Wi-Fi networks 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
  • Checks if the internet connection is available 1 TTPs 3 IoCs
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
  • Reads information about phone network operator. 1 TTPs
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

Processes

  • com.syezon.wifi
    1⤵
    • Requests cell location
    • Checks CPU information
    • Queries information about running processes on the device
    • Queries information about the current Wi-Fi connection
    • Queries information about the current nearby Wi-Fi networks
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5112
  • com.syezon.wifi:remote
    1⤵
    • Requests cell location
    • Checks CPU information
    • Queries information about the current Wi-Fi connection
    • Queries information about the current nearby Wi-Fi networks
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5208
  • com.syezon.wifi:push
    1⤵
    • Checks CPU information
    • Queries information about the current Wi-Fi connection
    • Checks if the internet connection is available
    PID:5332

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.syezon.wifi/databases/wifi.db-journal

    Filesize

    512B

    MD5

    ee140b7dbef467cb054996e1cdd37f7d

    SHA1

    cdbcc44b74506884130ccf582255b119fc1c3111

    SHA256

    0ab4725cb9263c0d4046a83c1f256d998008d040766e58ced205ba9235b0c29e

    SHA512

    e13d4c105816c3f03f3976e3712d2a01156b43f25f20c18248ed4301a57a25b13d4b0081b615ae4a060932b8cd367ac0946d62094939b57292e01e4c50b84957

  • /data/data/com.syezon.wifi/files/libcuid.so

    Filesize

    4KB

    MD5

    031a24b538506de97f825c0c82b99bfe

    SHA1

    bdcf439a8ced117f7b8eafc2db438403a43c0080

    SHA256

    c91d528e718aa9266ea464f9d85d288ecf14decd2b4843750ae7ec13207c2591

    SHA512

    1440e299f568e8fd275774f359ee42a0cd4ae414c7783250321ffc440b90d634e34f78d474b6321ce60c7e34d8b75869735ba9f5a92140196e9f33f53510ebdc

  • /data/data/com.syezon.wifi/files/lldt/firll.dat

    Filesize

    76B

    MD5

    904673ee55a42956ab634328c3456f80

    SHA1

    465fa352ba9f5a88f0465036db5aa0be8b4dadf1

    SHA256

    0d79fe42527aa94d98c704524123a94c80478a6fff733c50abb23adc1ba780de

    SHA512

    4eca44ca3df6ea38d9e0e85c331b179bdbb51ef5ec4056c04d8e66a1d6cfd4c03fb55bc9427f1c0ba47a384bbacb3c386acfa8bc9a3e05796b2f35735b39fdce

  • /data/data/com.syezon.wifi/files/mobclick_agent_sealed_com.syezon.wifi

    Filesize

    663B

    MD5

    3cf8ad7249fa09301b0a276b9861e719

    SHA1

    2e2499c83b1d9629fa4ca2bac1fe18256e03e9d5

    SHA256

    e2f1cae4f87eb9eb5001c90b2eb03c91f9304e4d59489d6ba27ed0330a8f6979

    SHA512

    2c69d7705542722d58545b4c487353ec08e8c9e9d0a630a26deb82dbd8203983e63de55be626f40bd77a5a32a312ad255bed162a3f89a03d6b760e9a4a056a51

  • /data/data/com.syezon.wifi/files/mobclick_agent_sealed_com.syezon.wifi

    Filesize

    656B

    MD5

    575c6ad8090c2e4436db47d670d20bf9

    SHA1

    939c69d28c9d2d90a47b4106119621c09aacf0cd

    SHA256

    48f004ea938222f19d7897d4079cbc9a59e65d93487f3cb6b7cce200cbb43d3c

    SHA512

    95be50ef901b6d60f4840e0777d8116b2e48f6dcdcb983e2184d8a1657260329ac4c6c045586d3ab5e8914c826501bc5161488c436595c2f5c0018f5af2f0ea7

  • /data/data/com.syezon.wifi/files/ofld/ofl.config

    Filesize

    235B

    MD5

    174a23244295d4e443627aefba4747f5

    SHA1

    73d8fcc7f64cd9b7efba2be762625e56e6a485fd

    SHA256

    2f7397ee1b4b123fbd35f3e171a478b61351ca0c2449a20402c543b022d343f5

    SHA512

    cc7d57213364d5619d454e4876d56fb08d4fed49be9ef7dda1212bac1b5310955737664c51b0df4a3c3417dd33338f41046829e9d9635c91ec2cfac2f03ce920

  • /data/data/com.syezon.wifi/files/ofld/ofl_location.db

    Filesize

    28KB

    MD5

    49eefa442e55be8652c7c3c5f28d912e

    SHA1

    941ef7e65d47d38dd5f47084663f4fd7f57fbbc9

    SHA256

    63d7b59dcdc791b5d1380a1d06b9e199f6136965dc21a887efdd0cfac9d0a1b7

    SHA512

    b6c9d8a985a865c43348e34d94f149e4b552359d9afc7f5db660535ea107fbbdcedee542b9bfa018f1881c6c021b1e9bd331debe9562dcdffe2f8b3655d2d3c7

  • /data/data/com.syezon.wifi/files/ofld/ofl_location.db-journal

    Filesize

    24KB

    MD5

    990270a748f0b96a819bfae8efc62e76

    SHA1

    45fb27ae8b26d77882020ba80e23ec0a4fdeb3a6

    SHA256

    7d9a3efea56af448214f9f1cfef2e7ade550e7c1083e0b0a0c3956f974c24bba

    SHA512

    7c49c7288dbaceeaf244ec5ced4b2eb6d44a56b1f6f4237ecef8d007d1abd8990c20445a3e56df5d0004a3cc64ad8b94b94427abbb4e0892ac103b294d13df24

  • /data/data/com.syezon.wifi/files/ofld/ofl_statistics.db

    Filesize

    80KB

    MD5

    35e1c0fb9c3da55aa7cbfcffc7507083

    SHA1

    21e18d4d31b0aea597464b5a29e6919935e8ab3f

    SHA256

    9b06a584b6e022b185e4822c202d8e28348d377027399b40dcde744efacb34c1

    SHA512

    8d787a76cf3769bb9b1eb0c9275fae9b3034e739fe6bdeffe67dcd7c19d47ee16631d1f357dd8ec7a4d07c710505a7b517cb76333e3749beb65e6ae72ac35d80

  • /data/data/com.syezon.wifi/files/ofld/ofl_statistics.db-journal

    Filesize

    8KB

    MD5

    417d311792fa38e35512e50beba0e042

    SHA1

    d1411be19b5e7735ddcf5e7a5ba4a8113e52f86e

    SHA256

    8aa0406aead07054365541a08cad60512fa1c7c91579762154f7bae733b64306

    SHA512

    113a6854b1280ad614ab61fe1de37f8d28fe4a08af5f727a9c25019ba24a65d97453fa236ecc0c44cd38813d01fdda85744f39d5aa9607dec8880975a4803b08

  • /data/data/com.syezon.wifi/files/ofld/ofl_statistics.db-journal

    Filesize

    28KB

    MD5

    000875e1a2106f82b0f0ead4e052747e

    SHA1

    5cf90b842489c3e12c9faef7ddbdf20d009a4291

    SHA256

    f338cd34759dc56064be9758b8f028b0013f70bb2e14baa81de9b1085842062c

    SHA512

    1dfdd9f99426e7592ba7958b5f37cd95c2cecd45bbcfd8823506718e5a48b73f691f5f5755618994d8fbe7118caf6c45fadecdac26763530b405be6fc39d4eba

  • /data/data/com.syezon.wifi/files/ofld/ofl_statistics.db-journal

    Filesize

    8KB

    MD5

    b1e6be0ec8024aac356a20de7cca7aa8

    SHA1

    780dc838d2fccfe7a55a1dfc16b90a36e23c7737

    SHA256

    17851d1638eea5d29ddd103166f4ba46600882a7e5c18944859ccb6681d06780

    SHA512

    6bd47ef973c06288b1d4964461de1f2df80b596eee4b169f83601e35563fc93a032d661fcdc5220e1853fb5ef1fc85b097ced3f7c0a867701301b311be38cb01

  • /data/data/com.syezon.wifi/files/ofld/ofl_statistics.db-journal

    Filesize

    8KB

    MD5

    3c74d4cacf78906d2c00858eb20d5986

    SHA1

    25863a4a6d8c27c72098d11c6c3e35108a008b9a

    SHA256

    fdab21c3169ee8b17d76b3eb924aed7d8fd26308a5626e130b0a747570107475

    SHA512

    6ecc256f48c208f5feb461ae9184ffbc9e0ed2b9fc0e02c0f802bd4907d2b00ff7f9bd2954e7cb1d07584f18cd91084a1c44a7cdf1d6d264fd18258c97ac9aaf

  • /data/data/com.syezon.wifi/files/ofld/ofl_statistics.db-journal

    Filesize

    8KB

    MD5

    2d461c02c12c797f2c97cc47768a046a

    SHA1

    1ce9e3458e6329ba42eb6e934f9a0aa0724ea93e

    SHA256

    80362863476d26e23bd49fe754612cd138f5936a75f68929a3e33958184de665

    SHA512

    9d787c89c172fba94728f426986e335b0dc82109ff7a6e6896d6ec4913b3b40cb2353dcafc60943d0a4d2ee880c2b4771ebf626cd4c6b028c3de0e5613c2315a

  • /data/data/com.syezon.wifi/files/ofld/ofl_statistics.db-journal

    Filesize

    8KB

    MD5

    f1e6764db5e91f62a92e3d207a3fd046

    SHA1

    d311b6c3b413decd5ffb3e69833a2b67e00c4f79

    SHA256

    fe4115d7d82934e1829332607ca0fbfa55320dd3f8bb98a64b007f2a94d4f525

    SHA512

    97722e911facb382bb6ca2c75d9a04d01f5e4a3e4c40f93faecec0987fc60da60515ab4595c309a91a3dfb0f8320c996a13b1b9cb5331797cdb8fe639c73f9da

  • /data/data/com.syezon.wifi/files/umeng_it.cache

    Filesize

    8KB

    MD5

    a8a4fc408ad9a31fc48049e3ff794a9b

    SHA1

    1424f541b6f086799503f32cb2c189449c87649f

    SHA256

    134113012c79c28769533d568d62462fc76fe0dfc3a0331e222a2a1585a060b0

    SHA512

    a9ab77f4a13afb7819fbc3a32a2ce86104b140e8acd56320ff298c96ce10c195120622afaf837fa9d60adb7be8dce1ee12b0b48aaa8ab70f0790a8abb030db4b

  • /storage/emulated/0/.DataStorage/ContextData.xml

    Filesize

    453B

    MD5

    2b7e998f4ef5bb5aac10d358f61b6357

    SHA1

    2b8c6e395c48a17e025bd2fa07e6ae47b2550996

    SHA256

    907823e2dcf6b322bb137b1bed7c46aa5d6f24428b05a61eed4b4e1cfae76d82

    SHA512

    9f6264419b9e7d3a42f7092a2471a2c2fe64430c5ce755c28c452ab56117ee20d8fc1482e539726eab845ca4c704f838c375031726e8266bbdcfba63151cc1e9

  • /storage/emulated/0/.DataStorage/ContextData.xml

    Filesize

    788B

    MD5

    3889e631580e6a3c3987f481b1d544d2

    SHA1

    dd7aace74941358e3123acbd4e52f81c64f651c3

    SHA256

    bdd8daccd0bd30f759331c820525c26ba6719708a784266a6124b7bc14d0be8c

    SHA512

    7361ff87c135d787a175a8c775dc9ffcf7cc55b7db27d874465b95324acfdfb6d218ffe6c13414ea04607e80b95d6cf634e303489625e5cf68f196af81302746

  • /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

    Filesize

    408B

    MD5

    e3e14bfddb91d19c64c64525fab6c255

    SHA1

    f0010d8ece4ca42f99a593e53d7b53ff62d56279

    SHA256

    efbe9cad4d25e5aeed8e85c550ae518f760e08c60023daaeb97b1556e26ea912

    SHA512

    3c220e3486361a3a5229f6321609bba825776c33c1bd0c880a12f32e9c57fb2a33b92522f9e5f27a028af07e7b076f28602abc43f1bcfd4bdddebfe0f0f54dfa

  • /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

    Filesize

    491B

    MD5

    d8e32bb7cecdd844b924faf031593c26

    SHA1

    b70d59342564e59e8466ce317f7c6f03bc60c213

    SHA256

    d900379c7c7db0f20ea5c94f4fc4c6d2faf00249676d59475676f489670e6aab

    SHA512

    aa5886e9e5cfcefc5515d317fd038b6321669610f2a7c40f80b09abcd9b674191c86d0f8da6906fbce1ea83fcda8bdcd63af950046e67fcaceca26e0e779fadb

  • /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

    Filesize

    28KB

    MD5

    5efc3643a45bb7411d398b10d3993850

    SHA1

    3b6d679f7472caa7ded20eebb16f54d63a468c1b

    SHA256

    8cf1e3768c9fd6565b214280156521d30f3a27563afb12398a326a2d0456dc81

    SHA512

    a1165fc281dfeaafa57b4dc6251fb7018ce125ac4222f5e664ca16a5b41ab1dfa72dff2298234bee8f327ccd95ba3634bd990a63edba0a7c75f48492768ab051

  • /storage/emulated/0/.android/mobclick_agent_cache/com.syezon.wifi/flowadd

    Filesize

    512B

    MD5

    d122c4343d09831f9eddf7b441817439

    SHA1

    13456cec187e226be81e1d0dc051af91bd467e99

    SHA256

    b341b2e2bdaa18a3df4687b077dd8cfaa2befdb0dc3c5d942d80ac17f796d29c

    SHA512

    21b6b6ee8a6776f4edf57cfd53b747d8643ea63dd6b621fb786c88b74c3189750a1662c80d1a731e59de873f3ecd2027fee60ba6d3ceb6bb4b5f122d0d955b87

  • /storage/emulated/0/.android/mobclick_agent_cache/com.syezon.wifi/flowadd

    Filesize

    8KB

    MD5

    1acca54aea6f2c54f3c6a7dd75430f99

    SHA1

    f6e58fc76a78a608cb4efd1d7439856bf2670928

    SHA256

    a91953e5ac173c43471dc0237bd8b181e1d9b1d885d01af6c4c5bd5605512180

    SHA512

    07ca0fd4ae880043d1d04cdd6e6d179713c555adfc117e966e8eabf5ed6bdbdfa3c8c9690aa4fb7a070b077a9087a486413ab74f4167c37822fd1d624b14fbb4

  • /storage/emulated/0/.android/mobclick_agent_cache/com.syezon.wifi/init

    Filesize

    8KB

    MD5

    66fbdee9a0d38be23fc87d6dcfb7f0b1

    SHA1

    2f8be483235e789fe7e35f473dc9f0bbf6e3fa0f

    SHA256

    e1d2bc1262cf4b8e9ad9b292faa9198f997187856876a0660c280896a6491ba9

    SHA512

    ac1656d7e9792392b324a34635dc761568acb5997683949958340c7c1626398125fc6ea1fd72de9b5ec029f55b73e63f1e9e62cd0bf17d67c56004e452133cc3

  • /storage/emulated/0/.android/mobclick_agent_cache/com.syezon.wifi/init

    Filesize

    8KB

    MD5

    2bb3bbcea632193f5d3d96315c1e9ae8

    SHA1

    efe74e0cb424b465944d70e586e11a4bbfe847bb

    SHA256

    c692d1efb69af98b997cc0c28425e05952b3c033a20f1c1826f623c5aca495d1

    SHA512

    1ec50c2454e2459f62f439e560712e7b891b6d518cabbeb47dc35af1c79ecbee55ae2dcb8407a3d64aa632ed220e05dc007a70b9d435644ebd9ca58c18c82dcb

  • /storage/emulated/0/Android/data/com.syezon.wifi/files/baidu/tempdata/conlts.dat

    Filesize

    12B

    MD5

    8d80bc8ea90e9cac010d3ddf97bda5f5

    SHA1

    f063bc0d356e6ba9ab1eb9a851131ffbefd8fa07

    SHA256

    f52db31332534833414abd5e870f78c810b8ebbe5b134bbf599506beecfd1b93

    SHA512

    9ea732dd572a9a4ba91b70891972230a09576687ca1bc19e62d5a98b5b84e0f2ae11985108008bc9fbccf357219b8bd3dbf146bb70752f618f70dc5d0c46a7c7

  • /storage/emulated/0/Android/data/com.syezon.wifi/files/baidu/tempdata/conlts.dat

    Filesize

    152B

    MD5

    054b8147fd56ee5611e9692a8cbc22a0

    SHA1

    68b20f2316a3e79853d38a61345875a056e85196

    SHA256

    26e631168b56222a6b7b925525cbf6decfe346c0a9d8447edd9d346b20ebd1c2

    SHA512

    40f8dfb54b8939f6a3f004ac5e20c1c505ca29adf841cbb7da771e1b5fe01535d224fadf0119f6ebf5c69fd911eb61846b7394089f6e6d24259baf57cc3fc9bb

  • /storage/emulated/0/Android/data/com.syezon.wifi/files/baidu/tempdata/llg.dat

    Filesize

    24B

    MD5

    161557b06b4a4d3ce095528dea370eb7

    SHA1

    8bfe9c4d916fe58d856b5a6ecaf8cd9ea4df2c9f

    SHA256

    f054ef19481234ee5b2db1d1c681839dab235a857ed3a4bc02efa8f785f478d4

    SHA512

    96ce8aedbdbb387438efc86aaabd13a6378628bfae203d2bc25ea1cd7daa6ddbd6dd2c81d631fbdc9b653a93011d3c80f0c085580275b683d5e0bce077e6e449

  • /storage/emulated/0/Android/data/com.syezon.wifi/files/baidu/tempdata/llg.dat

    Filesize

    478B

    MD5

    a37f83f88d854253f311e4d117f7831b

    SHA1

    180d8f0c94605d57ae73fb4a4e4d4368b2386930

    SHA256

    1ddb3036b3bdf9ab26c5c71b93c06a7503b7083098200605f8da6be242f7254f

    SHA512

    ad69943716e3e9d7eac193d75f4df1ee3197e8dd159d7baf65929463b035c63752d317f76d465ccfaefb97b8a31622b8916568020aa5a1c65a596d7747717094

  • /storage/emulated/0/backups/.SystemConfig/.cuid2

    Filesize

    109B

    MD5

    81ced8bd5ce01f214a97d01566727521

    SHA1

    aef315ef77915839613090d0228e5f263e620043

    SHA256

    8832dcb27e5df0cb095fb8165c19d4070be02d20c04dde15aa4bfd4b1b8d5e26

    SHA512

    c0a414692d7a9e3f4469119d2db4f7676c3a6d8d2ae6a5131ccd7917ef6cc65a8d4ce6291c33aac976c580716930250272efeed0a27d46b18052cef83ee6bfc4

  • /storage/emulated/0/baidu/tempdata/lcvif.dat

    Filesize

    96B

    MD5

    8cb9b705c03bf2f40f65618e6df1a7a5

    SHA1

    5623b8a36d048d265dfcc007df85cdf0e389b13c

    SHA256

    029de0737643c2dcf40481d68d2164a453497886450eb73b005391bdb477d986

    SHA512

    5355b4ae56ffd4886c9923daddb0793f56bc5b1a1f5d24a83c76a1ce9068b8892519407d1e2f89dc3f031a0858cfe5dd3b80f9d4eb0fca58ae0bf3f9a666f542

  • /storage/emulated/0/baidu/tempdata/ls.db-journal

    Filesize

    8KB

    MD5

    d8167f2e4d2f45c801f77dddb764b947

    SHA1

    b4a4a0f6f473f366a787a7f9e87b172e87c09c74

    SHA256

    531541ee68a2dcbe71b84648dcec4379d9f755693f393b324c15fd8b0bb0f50f

    SHA512

    55862ce3035d04b3fc1fa874b85d6885d9ba1c3102d64639ba122c0bb1c4d9de8427b15941bbd294ad11ef922b54e38520721b6123ea69b628fd9534e5b500f6