d95e890cfd512349c4bd0a703909cd51396f9f68bed2cc632d1ab0021919abbe

General

Target
552577e48393369fe396902ef5789950_JaffaCakes118.apk
Size 9.6MB
Sample240518-rmd8fafe77
SHA256 d95e890cfd512349c4bd0a703909cd51396f9f68bed2cc632d1ab0021919abbe
MD5 552577e48393369fe396902ef5789950
SHA1 bc9bb22a4f2b8eca108bd24eab32f838ce16bce5
SHA512 1cdfd90463a32104a385d3200678185c5367d43e7a06fcf95f1443cceb965bae98e931e02d331693b8e8e099b46b5cb3fae0031233fe6052669c5acb1568497c
SSDEEP 196608:YriVYQNFJmo64LukOscHE7T7WvgmYkw0534qOLL2BskZk9BJxHEVg+b4:+iKQN7LvT7+ghkw0513zZk3XEVg+b4
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection discovery evasion

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.kugou.fanxing

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.kugou.fanxing

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.kugou.fanxing
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.kugou.fanxing:pushservice

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.kugou.fanxing

Checks if the internet connection is available 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.kugou.fanxing
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.kugou.fanxing:pushservice

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.kugou.fanxing
1⤵
- Requests cell location
- Checks CPU information
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Checks if the internet connection is available
PID:5215

com.kugou.fanxing:pushservice
1⤵
- Queries information about running processes on the device
- Checks if the internet connection is available
PID:5257

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Execution Guardrails

1

T1627

Geofencing

1

T1627.001

Virtualization/Sandbox Evasion

1

T1633

System Checks

1

T1633.001

Credential Access

Discovery

Location Tracking

Process Discovery

Software Discovery

T1418

Security Software Discovery

1

T1418.001

System Information Discovery

1

T1426

System Network Configuration Discovery

2

T1422

System Network Connections Discovery

2

T1421

Lateral Movement

Collection

Location Tracking

1

T1430

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FxCfg.db

Path /data/data/com.kugou.fanxing/databases/FxCfg.db
Size 20KB
SHA256 87a5f74b593b731de0900281a87f226422a1814d02ee2d5aa23df28567c22849
MD5 bfab952bdc94419c0694cd09522101c4
SHA1 626946cb7cc9ad24516f49d005c8db94aa33e2a8
SHA512 624fec7849f90c35ade8775e92f9bc0c131f73c999144141d7355c10645f63eb3945ba0160508f5dff2fcfb3e248307b18b242090cb18cb8f98ae89e03e4cbab
SSDEEP 12:TLmEtKyNTSFbyNmxyYW69golhRmBEyPbAVOwG:TLxffYUSnAGSEG
MD5 SHA1 SHA512 SSDEEP

Submit Download

FxCfg.db-journal

Path /data/data/com.kugou.fanxing/databases/FxCfg.db-journal
Size 512B
SHA256 c0b34dcc4faf41579be1c4bd4f556349b23456b22b6ef84fe648aff94a35858e
MD5 302fd5c6dbefc7e3437f0fd2efcd8278
SHA1 1f879d4b5be91ba9e5f6f159d3bf98ea90acd9e3
SHA512 9c72ca844b6560376a7a6b5863527bb2c376dc4981d4cfc0f04c7604a82827ba21ed019f86a942d8c29aa1479bcf348164729739a0f7ab5446574205150c0501
MD5 SHA1 SHA512

Submit Download

FxCfg.db-journal

Path /data/data/com.kugou.fanxing/databases/FxCfg.db-journal
Size 8KB
SHA256 98182ab8d6bd4a4640aed6cc365f8a58b98b21c1d2bd94cb9ab86727dc980f75
MD5 31e282f1612f5a6c0e3be0b59603f145
SHA1 6ea26a3bc237cb7aba70dc694ddc96eccbe1bb80
SHA512 139b1af8fade818448cb34ed92b54d3e044325f79b946ed44b93ef85f0588ad2caad02b52c841caccb65281ba48a3745d371b2c6934aaf46adaf701a567c84cd
SSDEEP 6:7+/l9Cn1Ng9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKS:7+tgqLiuWdwRmBEyPbh
MD5 SHA1 SHA512 SSDEEP

Submit Download

FxCfg.db-journal

Path /data/data/com.kugou.fanxing/databases/FxCfg.db-journal
Size 8KB
SHA256 79503e970f9779d18d5cfaeec43a44143e0170f982c98112f5de713858e7c52c
MD5 d86b100493db7b1704920bfedb09053a
SHA1 8a5d8d78f352de2df73639d1463b58eda6329f2b
SHA512 29bcd3d6841a2d4f82c7caa8e666aa81c7dce844bd6b0fb93eb055aa9ae2b8a5e016667cfa24b6bdbed1604af50cbcff417cccd2cae0378e81dc3b93b4af0659
SSDEEP 6:7+/l9Yn4Pg9bNFlLdrlOERX4PBX4ogLugMBX4suuKa//G:7+t3qLJdTRmBEyPb5G
MD5 SHA1 SHA512 SSDEEP

Submit Download

mobclick_agent_sealed_com.kugou.fanxing

Path /data/data/com.kugou.fanxing/files/mobclick_agent_sealed_com.kugou.fanxing
Size 521B
SHA256 a56ee889fc1060436f62a7d80bd7cb1dc3898a405c18f89ced143e516968e05d
MD5 91f462b2864ba270cd95b0868f97f9bf
SHA1 10e6f45ca4a4f5cb7ea4d96b0eaec8d785940c1e
SHA512 6eb539bcee3d92d9a723875e69a368651a6ad8229ed1f78656119c65bff9645192c401e7c7136fe0f9a227e47873816c2759864ba6a67875349b9089d73c3924
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/data/com.kugou.fanxing/files/umeng_it.cache
Size 148B
SHA256 ffa9e096e1833477f6f9fab694e5d0ad6f07e3105b7e804a273f3ddd85a4d45e
MD5 a9655c6cc20fcb3a5055e296553bf767
SHA1 705dc8a477409dc3921438a146f089d39d4b6306
SHA512 75220d70c9ad713f63b0a998a67ca45a47609aeaf3552fcb1e4e9a6f680c30741e49a74033e93d70dd8cb040167dd5ec67d6e328d81487c34ba0384d3df5c79b
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads