Analysis

  • max time kernel
    177s
  • max time network
    183s
  • platform
    android_x86
  • resource
    android-x86-arm-20240514-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
  • submitted
    17/05/2024, 18:01

General

  • Target

    50c30b77bf9f4440aabb2490274d222e_JaffaCakes118.apk

  • Size

    10.7MB

  • MD5

    50c30b77bf9f4440aabb2490274d222e

  • SHA1

    df27dc502a919952bf0c7e2ae9e1de7ef68a12e0

  • SHA256

    dcfffc33d33b1907ac53dd8a92f0995bf5408cba966399564000879d095ee2e6

  • SHA512

    c4495f71703bd2621d0c65bff00b65c70086b0310824029edebe82ba74b77b70a6c6dc4c9c042da6557a7a2e89c9cf59f5b81b49d0d39547d3c8e09889a1c559

  • SSDEEP

    196608:tqmqV5EogW+wz4pcpM+XYqH/UW3r7gpjRe3+AuoQr4RiOj/7NmJJC:0m8EmPzQs7fUoPwjRey+XT7eC

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 4 IoCs
  • Requests cell location 2 TTPs 3 IoCs

    Uses Android APIs to to get current cell location.

  • Checks Android system properties for emulator presence. 1 TTPs 7 IoCs
  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

  • Checks Qemu related system properties. 1 TTPs 7 IoCs

    Checks for Android system properties related to Qemu for Emulator detection.

  • Checks memory information 2 TTPs 1 IoCs

    Checks memory information which indicate if the system is an emulator.

  • Loads dropped Dex/Jar 1 TTPs 10 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries information about running processes on the device 1 TTPs 3 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about the current Wi-Fi connection 1 TTPs 3 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Queries information about the current nearby Wi-Fi networks 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 3 IoCs
  • Checks if the internet connection is available 1 TTPs 3 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

Processes

  • com.cai.wuye
    1⤵
    • Checks if the Android device is rooted.
    • Requests cell location
    • Checks Android system properties for emulator presence.
    • Checks CPU information
    • Checks Qemu related system properties.
    • Checks memory information
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Queries information about the current Wi-Fi connection
    • Queries information about the current nearby Wi-Fi networks
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4242
    • chmod 755 /data/data/com.cai.wuye/.jiagu/libjiagu.so
      2⤵
        PID:4305
      • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.cai.wuye/.jiagu/tmp.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/data/com.cai.wuye/.jiagu/oat/x86/tmp.odex --compiler-filter=quicken --class-loader-context=&
        2⤵
        • Loads dropped Dex/Jar
        PID:4328
      • sh -c ps
        2⤵
          PID:4558
        • ps
          2⤵
            PID:4558
          • ps daemonsu
            2⤵
              PID:4584
            • ps | grep su
              2⤵
                PID:4603
            • com.cai.wuye:pushcore
              1⤵
              • Loads dropped Dex/Jar
              • Queries information about running processes on the device
              • Queries information about the current Wi-Fi connection
              • Registers a broadcast receiver at runtime (usually for listening for system events)
              • Checks if the internet connection is available
              PID:4358
            • com.cai.wuye:remote
              1⤵
              • Requests cell location
              • Loads dropped Dex/Jar
              • Queries information about running processes on the device
              • Queries information about the current Wi-Fi connection
              • Queries information about the current nearby Wi-Fi networks
              • Registers a broadcast receiver at runtime (usually for listening for system events)
              • Checks if the internet connection is available
              • Listens for changes in the sensor environment (might be used to detect emulation)
              • Uses Crypto APIs (Might try to encrypt user data)
              PID:4456

            Network

                  MITRE ATT&CK Mobile v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • /data/data/com.cai.wuye/.jiagu/classes.dex

                    Filesize

                    2.6MB

                    MD5

                    25416cbe0fb512b427664c85fe0008af

                    SHA1

                    fc854944d91a76dbac82aea5b0bd59b4d8fcf7ab

                    SHA256

                    ee44f75d69e9af5f90d58abb1d617721ea6207dbc080bd72e505a9a516128fb0

                    SHA512

                    9bea4cd1890103f53f4e64933bf713420a17eb272f38661d7c2307797b8d129ee67cbfb55fec959b9f9a99546c9627e9784743888c14ac33d60f8e1794029196

                  • /data/data/com.cai.wuye/.jiagu/classes.dex

                    Filesize

                    5.5MB

                    MD5

                    4e2755568939809839480adc2913b0fd

                    SHA1

                    d09f45ae2e847a17fad5bbcb15a9e3bcf27a03a1

                    SHA256

                    a055f1cf1c813fb85c2f4f007684b0b1c93329afd23c7d130fb78ed767334817

                    SHA512

                    49303daa2f9c67a7e6fff68bd3a52448dbe47a65e09d0da1a8e390452de53958e83cef6be0ba9f1693a8996ffa4594064c465717ea313135731ca41e7a6b255d

                  • /data/data/com.cai.wuye/.jiagu/libjiagu.so

                    Filesize

                    455KB

                    MD5

                    e5a53000766ebc433b27d6a66ec4f555

                    SHA1

                    2c8f53f1c03aec2005bcad67d731f07261dabde0

                    SHA256

                    78e4ea857f10c2df6c7b94f0584524b52ecc099ed29478fe3964037b8a86ed2e

                    SHA512

                    370a1cb93b14556ad861724f4e9995c9a4c6d37cf2d570f888d1c6000c66d27ac63496b0703361e9fc9bc7f309b7aa4407c5f339d186b0a5b72520d23d04b68d

                  • /data/data/com.cai.wuye/.jiagu/tmp.dex

                    Filesize

                    512B

                    MD5

                    0d269dcd5a3f8e68677b73c541af864f

                    SHA1

                    a9ad4f2b665c06e69be27bd98ba1d48e1b32d6ed

                    SHA256

                    9251076e3b9c2ce2974594d940fd810ea22af5010007eb25e46d22dae2617f9b

                    SHA512

                    9a4ae3ded591cd0c65fe85fe0e69b6e81ba479f0af55633b8f5f73e49796cbf2a6e89e78e59a357c8b498355a4094722adfaa24aa2e8a1d243625e1132e8efeb

                  • /data/data/com.cai.wuye/.jiagu/tmp.dex

                    Filesize

                    284B

                    MD5

                    f1771b68f5f9b168b79ff59ae2daabe4

                    SHA1

                    0df6a835559f5c99670214a12700e7d8c28e5a42

                    SHA256

                    9f8898ce35a47aeafced99ea0d17c33e73037bb2307c7688e50819966f4ae939

                    SHA512

                    dae27d19727b89bec49398503baa6801640540355688dfabbe689c97545295c2c2d9b0f0dcd7cbc4cfbf701d0c0c3289e647a152f49ff242d1ecc741efe4145d

                  • /data/data/com.cai.wuye/files/.jglogs/.jg.ac

                    Filesize

                    52KB

                    MD5

                    9d67f9eac17fa33d70e3ec94f455c39b

                    SHA1

                    6c0acd354bae766db94892bb5d6b5b71cb3724c9

                    SHA256

                    05b7f743702a81609a182fa36afbd9fe545cd221633cf88a880485126d2f88ad

                    SHA512

                    01fa2162a4d2689d0b6c7351c1b57d57c449e1423cafdc9c54cc2bed50d2165727f74b0904e997ab6f6e23b1eab5a02e8b6eab8a7b13abad82b49f634096e707

                  • /data/data/com.cai.wuye/files/.jglogs/.jg.ac

                    Filesize

                    40B

                    MD5

                    cbf273def273bf207c9a98b43bc51cb1

                    SHA1

                    1a89d48e48987a26e225ab23c30227208b8d3729

                    SHA256

                    7d3ece66ee66e42a8d9d4765b29bd946c4cb509db9c326f351f85c526f55ee8c

                    SHA512

                    237551c7d883455f6c23af3aad6893b6a358b70a0c71145d2f462f032cdce2506eda7e119f02b45022a01626f0fa89b8b33ffc0d2eac9e525057e8220410f620

                  • /data/data/com.cai.wuye/files/.jglogs/.jg.di

                    Filesize

                    340B

                    MD5

                    7371363c4d3b78871088936dae531282

                    SHA1

                    23b04c4209285c24ff39cd56e66f19874af061b7

                    SHA256

                    6a35020a0f6ebaebba3ad4260edcd88defba75fe5f5486f51f46f053d607f290

                    SHA512

                    65e1059aaf56b22031aed1007110c248a3d07f6b493c6efced6f3c42fe62cd9e45cd55172836af756927d0b6f44f0666c698f3038ec9df41d6d5ed0ad6b6150a

                  • /data/data/com.cai.wuye/files/.jglogs/.jg.ic

                    Filesize

                    32KB

                    MD5

                    7ee1c72abba1ebab29258bebb3ebe9f8

                    SHA1

                    52844eaacef2608d276cf9dc793f3abd52a25dd2

                    SHA256

                    d43af7ebc1e22eae26fc8d22e239eda03444dc0940f74de2bab4108a7b0eeeb5

                    SHA512

                    630a5b965a0b70c61fa2ccd4bb58daf4c10e33fb865605202091ebb8df399977a37bfb55dccb08ed737dfa97c279ac13f28d635eb88c9bedb3bef699ffbff226

                  • /data/data/com.cai.wuye/files/.jglogs/.jg.ri

                    Filesize

                    512B

                    MD5

                    ab7fb18bc505639ce5a8baad3c6aa80d

                    SHA1

                    7ab8d6e480bfa51787fc0f3f67a97fd52c21c2b4

                    SHA256

                    ae3b90b2de12013e9e10b7e65ef0337214969da6e957e46a1973134020dbce13

                    SHA512

                    fae3e467e931d899eeaeab3864a35f86352edfa2e9cb407ff5e53e7ee7c31de7e907c943b5018eeca52861fb616ef95e3bb0128e60a667f20f3a868d432ee568

                  • /data/data/com.cai.wuye/files/.jiagu.lock

                    Filesize

                    28KB

                    MD5

                    0d3e99204c6401ea499fe9e6d9855497

                    SHA1

                    09829f00ca458eab7374d5079393a2cd69a2348a

                    SHA256

                    63ad014cb50908591939d6a1536f85eece807425af4f4e8a1f9b9eeab13cc5ca

                    SHA512

                    8d9a50aa9abd17e508ed3ac35a3033e8f9e550d1088baa951f53e6c4697c5ac026d22b90e36e27341d64baa3f0202bd89ca97583e99feb25f8c26b5776c59c68

                  • /data/data/com.cai.wuye/files/jpush_stat_cache.json

                    Filesize

                    119B

                    MD5

                    ba4016db3842c59738d32b93ed86afcf

                    SHA1

                    fadaf4fceba3f951ceefb8d293deaae19b9c0540

                    SHA256

                    7c070d4f5615900a837a2a39ccb8668cc804a33d7e15c24895ad8b416d647e99

                    SHA512

                    4c7f8e610da04725c77fd4e280ceac9c521db504682c7cc855bb06bd1026c121c054ac31787b3448937f47ff21c9f3620be7590ddf844786bef2856a4d7bb440

                  • /data/data/com.cai.wuye/files/jpush_stat_history/active_user/nowrap/f89666ab-b606-4c96-a999-d998558cb81c

                    Filesize

                    4KB

                    MD5

                    f2b4b0190b9f384ca885f0c8c9b14700

                    SHA1

                    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

                    SHA256

                    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

                    SHA512

                    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

                  • /data/data/com.cai.wuye/files/jpush_stat_history/normal/nowrap/15b0f047-183e-4a18-8d34-b5de61ced352

                    Filesize

                    32KB

                    MD5

                    1674cda8ce2cabe718031ad4a566f4f6

                    SHA1

                    f7099c608bff3deec413ea3feeefec145be52eaa

                    SHA256

                    e40c31ed90e405b2b81b7e3e8cb1bf19c3f20032781ab427702123dcdf9b2940

                    SHA512

                    305b40c299507bfa87d7c6ff69ace69b9a71c4a2a8bde816b6b8a71d1b6dbd33c61601e46d05f70d7f4276f9b56e61907ee30f19471a756aac736c571b46505e

                  • /data/data/com.cai.wuye/files/libcuid.so

                    Filesize

                    512B

                    MD5

                    7d693a12ee6baf83f31c75ae442d7add

                    SHA1

                    3aa18d5c013572375d9d134ceb0c325b9b5a60be

                    SHA256

                    bc54372a2292a6ff1477d6051309de4d6beb323352f91e1d224d6fc2f40cc5da

                    SHA512

                    620960668175d5edcd783d639b4d28039ede555be2afb4a5d0c02e2920a53db55c92c2091fb7f54e670ca6d4d708cc6c4ca938945176abecb3996a6364e68db2

                  • /data/data/com.cai.wuye/files/lldt/firll.dat

                    Filesize

                    76B

                    MD5

                    546a6ace3f96d4cf40c8cffd201e91cc

                    SHA1

                    585637788104528bf21a17af9871828adc9798f8

                    SHA256

                    88553be48156f2d45e94e22004b117a2bc167c0277a85e9b6ab824fdd44a2a5e

                    SHA512

                    be47bb1acf1783f85e61e8807a9ec4d7dca4edf972279c8f6aad61fdae98cdb58791899c3ddc0ff54808e6a058ff4dd775df43eb7a466f1430d87de486af82cb

                  • /data/data/com.cai.wuye/files/lldt/gal.db-wal

                    Filesize

                    36KB

                    MD5

                    10711b19e4b641cb4753fbb4539cf7f3

                    SHA1

                    416a2cf97c3ddd3492d9e13896f29962cde02e01

                    SHA256

                    31bc7c3e295d25b5b0426c0e8394fca1760212155914643be6c3223686ece140

                    SHA512

                    f1e64602717bf691716d558fdee55b533b5226376485038992e64e6e66d371df7c1d969088c816e96831764f0632330f1e8c2354e9a0510807e7777d4e8f0e82

                  • /data/data/com.cai.wuye/files/lldt/hst.db

                    Filesize

                    20KB

                    MD5

                    af757be229945be283974841139afbae

                    SHA1

                    7effab66dfda5890e9c65b2538fb073a71502670

                    SHA256

                    9e63d4d76760ce8968ff4cd4ea3450981d377876b31a1c651b26cf4ab7282100

                    SHA512

                    e164c3f219121ec48481653693fff175db6ccdb5e9d66b63d4ddbb21d42069579837375ebf1c0525e697a7183bcb9a0b46a86707467269cbe5a55c7b7266bee2

                  • /data/data/com.cai.wuye/files/lldt/hst.db-shm

                    Filesize

                    32KB

                    MD5

                    bb7df04e1b0a2570657527a7e108ae23

                    SHA1

                    5188431849b4613152fd7bdba6a3ff0a4fd6424b

                    SHA256

                    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

                    SHA512

                    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

                  • /data/data/com.cai.wuye/files/lldt/hst.db-wal

                    Filesize

                    36KB

                    MD5

                    692af4612b372faa29fa8c7844f86f05

                    SHA1

                    c66b3662a0720df86b5e13642535b8220640bcb4

                    SHA256

                    9d31fec284a4ee8c71340074f1ea98568681dc30ba4214f77a7f03023be35805

                    SHA512

                    4d3a6e40746a5423797dab0b5c0c06dc9916229f44c4579a1088b52caf607732cad08e1d52952aed7c64abf4eed3f9dd0cc6357d3aa65087c3deb3c56a0eeb29

                  • /data/data/com.cai.wuye/files/ofld/ofl_location.db-journal

                    Filesize

                    512B

                    MD5

                    c8ae2885316d11a5dc2d9432a29b30d6

                    SHA1

                    c2f00a9a88fb7aa6dd15a181569d9c661a551763

                    SHA256

                    eeb1def01af2de8ae63995e5931c8c463de9ba685a9c768cf3c387ff56977482

                    SHA512

                    cd527719c3b5d73352d4102c4a213ef8cf0a004fb0c6feac4f3daf65fedc9742120a1f418b56c28b31a84d224f3dba0810663b807e4e6df611b28e786984dd41

                  • /data/data/com.cai.wuye/files/ofld/ofl_location.db-wal

                    Filesize

                    48KB

                    MD5

                    2fb96dafc27bcf12b57ef6524b863ceb

                    SHA1

                    490f1a49f31bd9aa7ce5092b823e0ad9a7607f67

                    SHA256

                    e3ed0d727ddf4ebf59545fe4570bbae0b40ffbdbd07e33fd59f6af4e496cfb7b

                    SHA512

                    9625f76c448410c7c74bdacfe80e688e08a00a5072ba5609768caecbcbddc51d218d6a1aec3954bc3f00a44fa08209097fbb8b2d487b888a25f88ea3c3ea5d30

                  • /data/data/com.cai.wuye/files/ofld/ofl_statistics.db-wal

                    Filesize

                    156KB

                    MD5

                    8f47ae1c8015e7e3ab1c3f803b00359d

                    SHA1

                    b6e62bb3d10e6caaabec255ba98083fda3927779

                    SHA256

                    18f9cb21e131e0c629ced4c1efc008fc3bb79945d903fad24e76ce6eab01d086

                    SHA512

                    cc60ad1b8b62af86cc2db7f0f241f14ced8153732eef5b45cc86289c72a5bf1c9b26b9a83150c46119b6bc9e19742fc23f075e2a3cd66145ff1d44e15010806c

                  • /storage/emulated/0/360/.deviceId

                    Filesize

                    20KB

                    MD5

                    0106bcfbec03d55439badfcae6525fb1

                    SHA1

                    fb210c7400a9dd18b5c8b0979d544ef47fd5c5ea

                    SHA256

                    d7190c32e0f1eef5a7d18f6905b74057f1e28080bc9c8c1de5c5e21b3cd3dc6f

                    SHA512

                    18aa18463553a66b86f483cb31d6ef4f89852247f98700c88651cb8e1921092797f5a4651a4ed894f0e73913d5419705b9fe7208e8f5c48603a16962f88f00f6

                  • /storage/emulated/0/360/.iddata

                    Filesize

                    512B

                    MD5

                    bbf013f246f92df77c23e390afafc1f3

                    SHA1

                    bac047d73f8b37a2d195ead45e48063decad2bef

                    SHA256

                    70593740ed9b26dc3505388b9de0cd8ce10edba925365bfe4b51a5f19f41313a

                    SHA512

                    58efe4d056ad936ff5205d7ac449754b9d38b22be16289c749c20732ce188921b30da787fb3759149204238afb0154faf50faa5e9239e9a8509bdb6448a2b336

                  • /storage/emulated/0/baidu/tempdata/lcvif.dat

                    Filesize

                    96B

                    MD5

                    ca03176617d14d14ee955c1687d0fb76

                    SHA1

                    a5c15f2b00c6dd4814e1b0a2d0e6a84c0005260d

                    SHA256

                    e9e0e1fdbca0667f14e177a981401613e508e6cdccc142eac50f7bb70d25e089

                    SHA512

                    a35ef3f64a72b030d4cea239ab0e2ca5b1a15ffcc339e31d4fa59d0b1efe087a030c71131520850d2f9db2ee772c8236f96f6b345bf74b9b644e2fac8b020a95

                  • /storage/emulated/0/baidu/tempdata/lcvif.dat

                    Filesize

                    96B

                    MD5

                    d00476caf53f91f908b6a51b61629056

                    SHA1

                    e29b300cc1134bcbaaa2ea33973934f813bc6ac0

                    SHA256

                    6a267865d73450d44ebbf6431294ec1a75cd4dcf50d95469a948c2db399d5622

                    SHA512

                    9d2a9f249a7841208bf4b3ab96d92e226356d8b5c9a571236b95f05d46f685e0528147fe5103d8fa084626b885130b4685583286959b58b512014e603741aa79

                  • /storage/emulated/0/baidu/tempdata/yoh.dat

                    Filesize

                    24B

                    MD5

                    a936690571e9104e1922dda4a0ba5bd1

                    SHA1

                    65f49c57edde2f96be2a1dbdfc3f7351f1e66554

                    SHA256

                    f0f5049c51879dd7da0ce4a43349b5b34ce053d072a0ca704f62cf22ba4a8412

                    SHA512

                    3be1c3693963aebdfc04e86b1c820ee0ec3cf0b200e6a4788ef1141f39fd6c2f77f4227247ae4affa66c0a6c027df8466cc0dcec1e67ebfb953e36bee97de394

                  • /storage/emulated/0/baidu/tempdata/yoh.dat

                    Filesize

                    24B

                    MD5

                    1681ffc6e046c7af98c9e6c232a3fe0a

                    SHA1

                    d3399b7262fb56cb9ed053d68db9291c410839c4

                    SHA256

                    9d908ecfb6b256def8b49a7c504e6c889c4b0e41fe6ce3e01863dd7b61a20aa0

                    SHA512

                    11bb994b5d2eab48b18667c7d8943e82c9011cb1d974304b8f2b6247a7e6b7f55ca2f7c62893644c3728d17dafd74ae3ba46271cf6287bb9e751c779a26fefc5

                  • /storage/emulated/0/data/.push_deviceid

                    Filesize

                    32B

                    MD5

                    3ae37badcbee8927f3d697bc45a7da9d

                    SHA1

                    ffca49069271a0efcdf801d7bf787baa431fc436

                    SHA256

                    0e2c1c38798555e9096c54c40da11cd33237cc46af1ac0ae9a355a6e6d3fae16

                    SHA512

                    00e78c982e125e6566ddc5c4146037464e8bb166e7acd9708a97539e4a18da260280f7705089d9909c81d2b584a4fe099b45b3db2d490a97bf27f0310e450bf1