87328403f86f04ddd622c23235e3d95bc18fee012394e58dde120368f6b273b0

Analysis

max time kernel
162s
max time network
181s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
18/05/2024, 13:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
54eac4cb267a2ee26165942548fe80c8_JaffaCakes118.apk
Size 21.1MB
Sample240518-ql4w2add2x
SHA256 87328403f86f04ddd622c23235e3d95bc18fee012394e58dde120368f6b273b0
MD5 54eac4cb267a2ee26165942548fe80c8
SHA1 998441e26d506db08ebf9eb8c6270eb2089b9bfe
SHA512 992c6830f09a28b5905060307d649840ccb79d4bf4181deb630502dc682f77ccbb9468d5f85ef3b5cb7af805c0064136c955d6282e931198b89132c2a6097192
SSDEEP 393216:XskIdIzut4lb2FMFu85DUju+cr4EmBG+HVa/nK/V/tNwRBdRsDBjpSGJ1lUI:+Outm2FS1pUvob+HVa/K/V/tNwjsVFSY
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection discovery evasion impact persistence

Malware Config

Signatures

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.hzzc.jiewo

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.hzzc.jiewo
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.hzzc.jiewo:channel

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.hzzc.jiewo

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.hzzc.jiewo

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.hzzc.jiewo
Framework service call	android.app.IActivityManager.registerReceiver	com.hzzc.jiewo:channel

Checks if the internet connection is available 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.hzzc.jiewo
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.hzzc.jiewo:channel

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.hzzc.jiewo
Framework API call	javax.crypto.Cipher.doFinal	com.hzzc.jiewo:channel

com.hzzc.jiewo
1⤵
- Requests cell location
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries information about the current nearby Wi-Fi networks
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4330
- getprop ro.product.cpu.abi
  2⤵
  PID:4457
- getprop
  2⤵
  PID:4468

com.hzzc.jiewo:channel
1⤵
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4594

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Credential Access

Discovery

Location Tracking

T1430

Process Discovery

T1424

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

MessageStore.db

Path /data/data/com.hzzc.jiewo/databases/MessageStore.db
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

MessageStore.db-journal

Path /data/data/com.hzzc.jiewo/databases/MessageStore.db-journal
Size 512B
SHA256 f1783d31aeb3850ce25ad5e350ac7ceacd7f915ce490fc5ba5d41bd5a147f863
MD5 f0155abb86c2cca22775768bf20330cb
SHA1 5507b2edff177c74baff02561dc6e08d0692940b
SHA512 5076db19a922615ea28751477bf281b62cae0d6482bc748a046f5effff1ce1685678e5d38ec83801006e828ff492c4ae282225927f3afa64099cc5dd049492d0
MD5 SHA1 SHA512

Submit Download

MessageStore.db-shm

Path /data/data/com.hzzc.jiewo/databases/MessageStore.db-shm
Size 80KB
SHA256 f554b379fdc403682344ef7acf8a59ad4ca32c5c11e1d3148078b1ebc3648820
MD5 4663ca6a0e964f2f6ca41fbb6539ef4a
SHA1 189ed6a87f244900f0c14691564843a0ff9ab6e6
SHA512 f42f12638a11539082c24846cc605285d20cde75f1af881a9ccbdd47a6db6d2bc9d7773d0d52da895a485589dc48f0c90e9080c0144eaf3e8705c7c65fedb6e2
SSDEEP 96:g/rCndNgpcNxCivN555QTrotzvgOEJxRHL:mWndNgmNEivNPUUbgOEJxVL
MD5 SHA1 SHA512 SSDEEP

Submit Download

MessageStore.db-wal

Path /data/data/com.hzzc.jiewo/databases/MessageStore.db-wal
Size 60KB
SHA256 9962c63d16774132738a05220a90eb1a874de48dc12451d41eaa5d6f71fb0d5f
MD5 4c5fc41c45c9d60e91d17274b6f80a4e
SHA1 93bb1fc1fd3c084185f76d7af2daef5103f4185f
SHA512 8f5fa25107a669f15ab55d258414560d543433d3d43bbcade1adcab849ed8a391985bd1a097ab8b1b2d31d17442319ee4b63f9eab911182edb31cb75dc1d2bdc
SSDEEP 24:Kv9CgzyGSP/xoULBYrlUi/UPzmD6ZWaJyZ4M0yAN9GSP/xvZyWzeq3JOqo/3o196:6zNSP/krlBRvZ4M0yIoSP/hSq3RVbO
MD5 SHA1 SHA512 SSDEEP

Submit Download

MsgLogStore.db

Path /data/data/com.hzzc.jiewo/databases/MsgLogStore.db
Size 4KB
SHA256 8653a26f7060122f5d3b42233c59ec42b1d1b6e8e22304019a06a5ebdd558f9d
MD5 f456be4f0d4a2251a7e0d77cdc66da99
SHA1 9581185e2530a0542b5d8a13a4762d95dcfe13f5
SHA512 f0925636268018d2202f9df8bbed0d057b7bb8a033a34b9601f07bd5830e032db8d425a4f00e58aa3e1a48f1bff92af6f65147139e3b9b97abd45db3bba90f96
MD5 SHA1 SHA512

Submit Download

MsgLogStore.db-journal

Path /data/data/com.hzzc.jiewo/databases/MsgLogStore.db-journal
Size 512B
SHA256 4acb7bae38656d55c0044d58c036e1e89e2aaad861db23aecfabfba95d7f6b76
MD5 e721e3e2a4d02fa5a52d8543e6b01ec9
SHA1 c42d2bd298fc1c223defee829a69cfe0d08c5efe
SHA512 6691bf6693bc1935dad46d8ef74fc7321d690c88251bd119713266c9cf0f948ad20fc0e143c8419db83fe9cc702f6f1009afac584ce956749a542d780bba29a2
MD5 SHA1 SHA512

Submit Download

MsgLogStore.db-shm

Path /data/data/com.hzzc.jiewo/databases/MsgLogStore.db-shm
Size 32KB
SHA256 9b4f80e1c8d9f4e0d0482052970d294389f9a803e03d44686c8aedd4f1795e06
MD5 3deb3f9b7ae2d95f8e49c3b48946fc62
SHA1 d101b65ba522f3b4a91b17194a993b20774e0231
SHA512 816580f5f3f2f208a42d1571e10af54dff9640e147271592dd15f5ae45396012ad1c4593ce5b916df187791e2c44c2448cb73e2d85d0ef72cb44ef0ff24a1bdd
SSDEEP 3:t:
MD5 SHA1 SHA512 SSDEEP

Submit Download

MsgLogStore.db-wal

Path /data/data/com.hzzc.jiewo/databases/MsgLogStore.db-wal
Size 68KB
SHA256 52cbe3d657f34491050f6072157b4de4c78c3cd995bc37589540d42e39289f8b
MD5 406936130fdefe7548cf3904b283c3b1
SHA1 ffeae773ea93cfa4a7a0c17e48f69bdbcf38c6d9
SHA512 962ae0951c148c689d01b7c82df3ff7f8cc5be265a55879129c1840520257df9b580b3a8a407e8baa002534732b42cac7d19ff3ff2c61a4366c31a65cd331cca
SSDEEP 48:PzNSP/zKF3sQO+t070OCJfhF8GIUWZwbSP/Q88:b0POqQG0OdPY8
MD5 SHA1 SHA512 SSDEEP

Submit Download

accs.db

Path /data/data/com.hzzc.jiewo/databases/accs.db
Size 4KB
SHA256 ef534d7a83e0f49ff80ac312bdaa08dc435faf4e6973dc8da5f3292ba167ece5
MD5 e6266835a0db2051d9c8622bb8ddd695
SHA1 a51ee2d7a87699d32c50f4e22fb91adf5bd09230
SHA512 7e3cbfb180c963ec6d3ab67445cc3bd7fca192c88a3872c1aeb1834c82d71a8edfa4954b48b963a5a2af2597b75c7cda2953b2373e3b6a409b29bd857f8d806f
MD5 SHA1 SHA512

Submit Download

accs.db-journal

Path /data/data/com.hzzc.jiewo/databases/accs.db-journal
Size 48KB
SHA256 ead50e6d7e99935fa29dc39f64a9d6e8be7cf633a465455a61eb6fbbe473108a
MD5 56cfe34b71a5d4c5545917e318e1beaa
SHA1 ed36cff46084fa8e5b8bea76875baf6554314639
SHA512 c5edc9f7c7bcc9e7bd5bad29ff6182e3d67395ca2335ebc22e4b81bf74fd3d2da0d8ed95802a17285a5e5eeccf7cc065a1e31e2ef612fc4cf01edacc2dabc504
SSDEEP 24:KS/zyGSP/EsLCwhCUqYVvJ0fiyts/fuLBzbx6JNGGSP/+LDH:lzNSP/EsLCwgUHJHUySP/+
MD5 SHA1 SHA512 SSDEEP

Submit Download

accs.db-shm

Path /data/data/com.hzzc.jiewo/databases/accs.db-shm
Size 32KB
SHA256 1011cdec597ce788b6c853ca30988d8610c4c7aa09198e3d8e5ebae2fe37a2de
MD5 b25036668730f9b578b94f0a50a4e64e
SHA1 cf6b4d146b8b3f849168d405333feecc95b9d2f5
SHA512 a803f54ef665bec430b7ec2d4dfe0bf944fa3c57082685658702ee2f5e2d6c031f7c3c9c2d764bd5c2a81afe218bb9b8a9ce73b3772d251a59fec104a052ee87
SSDEEP 24:TIM3R1Nm+Kzf+gtQZKpbuf+TQ6zC+XQolMS+V:UgRqxtQQ9VQ6zrQUc
MD5 SHA1 SHA512 SSDEEP

Submit Download

accs.db-wal

Path /data/data/com.hzzc.jiewo/databases/accs.db-wal
Size 32KB
SHA256 6d0ed3dc9a566faff4d0cc45718066e65e5d4a3ff9593456bee5489d45c3bfb9
MD5 891214ad2c3fbad7db1211c8261bcca1
SHA1 0eb21a23fd5821273d0918341ca48e0763af19b7
SHA512 a2ecb7770f68bfe8bfa9215af2e5b55960750ea017e6f522c0c5a533f09cfe53615271fc5d6ba3379ee2a5dc49d4f6a989bf5f35be075285cba58b9fb9f8e434
SSDEEP 24:KgANzYwSP/fXGMn8DBBqj0pyVD/GSP/4w7J:tANzjSP/aDBBu0p3SP/1d
MD5 SHA1 SHA512 SSDEEP

Submit Download

message_accs_db

Path /data/data/com.hzzc.jiewo/databases/message_accs_db
Size 36KB
SHA256 5644a250fa6cef16c2c802b98275656a5fc39dcf89bcc22193742d85c7313f57
MD5 486e2bac2b3e9e1cb411d2838a4854bd
SHA1 81dd0a7537f4af319b830ae834908986be85da8b
SHA512 c146789563dae163e373489b3df53f22efebd32b69643992969241eb5ad5eec668de67e7cd2aaf5c3a8af57b0842115d00183825734f57643d3fdb09835fe681
SSDEEP 12:TUBSOPvEFT0fVzjJ0zLVkyts/fuQ/k1zdvBxBb6RARwFTbOwNndRmBEyPb8FOwI:TUqYVvJ0fiyts/fuLBzbx6JNGGSgI
MD5 SHA1 SHA512 SSDEEP

Submit Download

ContextData.xml

Path /storage/emulated/0/.DataStorage/ContextData.xml
Size 780B
SHA256 9573c317dab83c2c53eb65fe9b054b7888c116aa35f487ab26746e3ec383c9b3
MD5 7e053b9ff60cae27ae8ad21d21632932
SHA1 674652aeea091ccc87e35cbe782b4c597c5e305f
SHA512 75dafacaf80780cb0140f5320234af957ed75a3af837069b52b1dbc44e67bb2e08f14dfafe1c3ca276e75b228c47b39f62a5d482fbdfb943d99f7e22ce5f4c8e
MD5 SHA1 SHA512

Submit Download

ContextData.xml

Path /storage/emulated/0/.DataStorage/ContextData.xml
Size 111B
SHA256 8e1d118862c72392256303d4b318d84653c9f30443d8f517aca7da49e8aa260a
MD5 653e445c17ba7250d6a55395a4ca1de7
SHA1 9c75b57e468ebd6e4233ddc434cda89c348ea895
SHA512 1e345ce892556ec926c7c2eb99cf96b3252ca890f7ef19dc5386cb8c993694d5c70ab34a1f3c66d38936794bc349e1aa1db4aab7aa3416f0302c32d2a53c45dd
MD5 SHA1 SHA512

Submit Download

ContextData.xml

Path /storage/emulated/0/.DataStorage/ContextData.xml
Size 213B
SHA256 6530f8b66f1dcdeae867afdec30f9609c1c3f6ca201cbe70403f9084b36dc27c
MD5 66bfe2891f49daaa6b657ca0853030f4
SHA1 0b2964165fa11eef4a3abdf4a6e7a46a1b3a9108
SHA512 55ec7738fb9c0983f475d7d98f566d660ade040f986d62683ccc97ce3f5f619ab8b8f0addcdb71f5094053cd17cc4f619acf0acca77f91188d416f4df5daef8b
MD5 SHA1 SHA512

Submit Download

Alvin2.xml

Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Size 793B
SHA256 adf8a6d3d66d2ac30994ef6cce7c32675625163252acdc44e13d77f4f60586bb
MD5 282ae3496a14ba631fae4554c66adea2
SHA1 45dc11cf7a9a8bca40d0187ad77951d818b98d43
SHA512 37a18bf6c10e87b87544931410b5fd314444bc0e57f3ef3ef9eeb44aa912f27190e0841aeeb085d17e1ef886396476d109f8c1cc3830714302ef9768292fb564
MD5 SHA1 SHA512

Submit Download

Alvin2.xml

Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Size 111B
SHA256 a472cec6b42355c2ad4b25bca82e56ff7fa5d1538a1cf4cac0da5f2f6abef162
MD5 713fc9339ffbc8bed551da5490a845db
SHA1 9fcb87de4ae19f38824420840546a248089b676c
SHA512 b47addb46ea37edc5e8ed98de20ba4896eab4cd4b0b49b8458afc11c9c81b0aa430a906e571dae23abe0e398742725c5e557ab1e2013646fb299720627030a37
MD5 SHA1 SHA512

Submit Download

Alvin2.xml

Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Size 167B
SHA256 d81ff7a45e664a7841658e6ccf4e3ce120b7bfb061a59f2f484d7039a68b9e61
MD5 2c3f60c226b11df52332f1db3e31578d
SHA1 be7740f91360c8cea66f43a4b0fdbb12d6cfb921
SHA512 3d037c5439ec668fbd2de463fa17214e39afff8dcc337ec53493ab01b40d7a9b20fd1aac0b08d7f877b88c66407469bd276c221178f30db7607ed42e1062f0c5
MD5 SHA1 SHA512

Submit Download

ae3ba89e6a024511a72d8ca0c178c53b

Path /storage/emulated/0/Android/data/com.hzzc.jiewo/cache/ae3ba89e6a024511a72d8ca0c178c53b
Size 5KB
SHA256 8b008958c413fb724af19776dd69681e2a630bcc7f82f6d8df63450a3e52bf54
MD5 7f16d1b618ce2eafc298604d2ab035e7
SHA1 dc2fd0525c911cecbd22c298b69760386f200a45
SHA512 54a2b717dfc36824ca231bb8287f2d91119e80f0fa1d17a03608f378c52d2cddab8aa0eccb405649c10ad68fba82192e2df439f54b38e4c6b875dfbbc4d95678
SSDEEP 96:6FKKXL1C5PS4h8MUpllme8m8FbG7otp7nKYLNdDCqE+QMnBP:/MkoJ8mYB
MD5 SHA1 SHA512 SSDEEP

Submit Download

fe845deecced4d678de2f3d4d004ad7a

Path /storage/emulated/0/Android/data/com.hzzc.jiewo/cache/fe845deecced4d678de2f3d4d004ad7a
Size 1KB
SHA256 8592bbbcb58d5d04cd7358acbda5fe0488fcb60a101ca6a36e9f7f0f2f0ec00e
MD5 4013f922d6e2b5127df7532c533abfa3
SHA1 d2c113e1b1527a8525d50ac571499d2cfb04eb1e
SHA512 99103ad0ed45dceae56810e570ffc612d69a7713fbd85208301fdd0cca77dcb12e4d61699b9431836e6cc239375eb22d5499fcd16802e60d2ac0c49c168709d4
MD5 SHA1 SHA512

Submit Download

tbslog.txt

Path /storage/emulated/0/Android/data/com.hzzc.jiewo/files/tbslog/tbslog.txt
Size 8KB
SHA256 a28dfd2915340820db2545ebd1f9d3c94af7b217130d24bcd11695cbd7ae7511
MD5 c0cfa788ecc987b623eb4561374e4084
SHA1 275b0feaebbf50fd875a66802293d7005d141294
SHA512 483194a38f336e1adf4023bd8422a0c4acbd0b3e6631e6a531fc31440c14e81b8df1b1c5722e58cfcf647715172aec7ba2a8bc62a6a4569c94d06a2063bef329
SSDEEP 192:2MPaBFFa1/lJqsgJW8kFuxlR4wAkFu80D55c7oMRo2yRo2UJ32bKBzUPe5W792zw:2Mi7w1/lJqsgJW8yuxlR4wAyu80D55ui
MD5 SHA1 SHA512 SSDEEP

Submit Download

inapp_20240518.log

Path /storage/emulated/0/Android/data/com.hzzc.jiewo/files/tnetlogs/inapp_20240518.log
Size 71KB
SHA256 580881b77191d6764f59d5dd5f8fed915d5c7a9fd29628af35e5822442ed7c4a
MD5 28c4757e572239cf4531eed0c074c1ca
SHA1 8dbea1e16a5d479e5620b9d2fff0d1b395328b9a
SHA512 a7841f81dd1ad8cf190cbbe8e3bbcc4c0b5b85fd741588ad578140693478c54f64c627e1852cf4c6389ac5a0a586ba77aadd37d8411cb88c05df148e6feea9fd
SSDEEP 96:oELepVq5HYTSiYfKXY+uwlif68zIqv8RJO9wBSybU0Ryv:fefq2Tif5w1qv8GmHgWyv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads