Overview

overview

7

Static

static

6

55c71b5674...18.apk

android-9-x86

7

yap.apk

android-9-x86

yap.apk

android-10-x64

yap.apk

android-11-x64

Analysis

  • max time kernel
    138s
  • max time network
    143s
  • platform
    android_x86
  • resource
    android-x86-arm-20240514-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
  • submitted
    18/05/2024, 16:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    55c71b56745abd161f1b8779f8afb872_JaffaCakes118.apk
  • Size 4.9MB
  • Sample240518-vcd2gadd67
  • SHA256 b5fd9587a5725a83a2916811d47178f9077c89d5259ff5223151799e99b2c99d
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
discoveryevasionimpactpersistence

Malware Config

Signatures

  • Checks memory information 2 TTPs 12 IoCs

    Checks memory information which indicate if the system is an emulator.

    evasiondiscovery
  • Loads dropped Dex/Jar 1 TTPs 27 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Queries information about running processes on the device 1 TTPs 14 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 3 IoCs
    persistence
  • Checks if the internet connection is available 1 TTPs 13 IoCs
    discovery
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
    discovery
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 12 IoCs
    impact

Processes

  • com.excelliance.dualaid:olle
    1⤵
    • Queries information about running processes on the device
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    PID:4283
  • com.excelliance.dualaid
    1⤵
    • Checks memory information
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4387
    • chmod 755 /data/user/0/com.excelliance.dualaid/.platformcache/kxqpplatform2.jar
      2⤵
        PID:4440
      • chmod 755 /data/user/0/com.excelliance.dualaid/.platformcache/main.jar
        2⤵
          PID:4455
        • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.excelliance.dualaid/.platformcache/main.jar --output-vdex-fd=53 --oat-fd=54 --oat-location=/data/user/0/com.excelliance.dualaid/.platformcache/oat/x86/main.odex --compiler-filter=quicken --class-loader-context=&
          2⤵
          • Loads dropped Dex/Jar
          PID:4479
        • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.excelliance.dualaid/.platformcache/kxqpplatform2.jar --output-vdex-fd=46 --oat-fd=47 --oat-location=/data/user/0/com.excelliance.dualaid/.platformcache/oat/x86/kxqpplatform2.odex --compiler-filter=quicken --class-loader-context=&
          2⤵
          • Loads dropped Dex/Jar
          PID:4552
      • com.excelliance.dualaid:lebian
        1⤵
        • Checks memory information
        • Loads dropped Dex/Jar
        • Queries information about running processes on the device
        • Checks if the internet connection is available
        • Uses Crypto APIs (Might try to encrypt user data)
        PID:4637
      • com.excelliance.dualaid:lbcore
        1⤵
        • Loads dropped Dex/Jar
        • Makes use of the framework's foreground persistence service
        • Queries information about running processes on the device
        • Queries information about the current Wi-Fi connection
        • Registers a broadcast receiver at runtime (usually for listening for system events)
        • Checks if the internet connection is available
        PID:4719
      • com.excelliance.dualaid:lebian
        1⤵
        • Checks memory information
        • Loads dropped Dex/Jar
        • Queries information about running processes on the device
        • Checks if the internet connection is available
        • Uses Crypto APIs (Might try to encrypt user data)
        PID:4846
      • com.excelliance.dualaid:lebian
        1⤵
        • Checks memory information
        • Loads dropped Dex/Jar
        • Queries information about running processes on the device
        • Checks if the internet connection is available
        • Uses Crypto APIs (Might try to encrypt user data)
        PID:4893
      • com.excelliance.dualaid:lebian
        1⤵
        • Checks memory information
        • Loads dropped Dex/Jar
        • Queries information about running processes on the device
        • Checks if the internet connection is available
        • Uses Crypto APIs (Might try to encrypt user data)
        PID:5015
      • com.excelliance.dualaid:lebian
        1⤵
        • Checks memory information
        • Loads dropped Dex/Jar
        • Queries information about running processes on the device
        • Checks if the internet connection is available
        • Uses Crypto APIs (Might try to encrypt user data)
        PID:5067
      • com.excelliance.dualaid:lebian
        1⤵
        • Checks memory information
        • Loads dropped Dex/Jar
        • Queries information about running processes on the device
        • Checks if the internet connection is available
        • Uses Crypto APIs (Might try to encrypt user data)
        PID:5109
      • com.excelliance.dualaid:lebian
        1⤵
        • Checks memory information
        • Loads dropped Dex/Jar
        • Queries information about running processes on the device
        • Checks if the internet connection is available
        • Uses Crypto APIs (Might try to encrypt user data)
        PID:5176
      • com.excelliance.dualaid:lebian
        1⤵
        • Checks memory information
        • Loads dropped Dex/Jar
        • Queries information about running processes on the device
        • Checks if the internet connection is available
        • Uses Crypto APIs (Might try to encrypt user data)
        PID:5292
      • com.excelliance.dualaid:lebian
        1⤵
        • Checks memory information
        • Loads dropped Dex/Jar
        • Queries information about running processes on the device
        • Checks if the internet connection is available
        • Uses Crypto APIs (Might try to encrypt user data)
        PID:5341
      • com.excelliance.dualaid:lebian
        1⤵
        • Checks memory information
        • Loads dropped Dex/Jar
        • Queries information about running processes on the device
        • Checks if the internet connection is available
        • Uses Crypto APIs (Might try to encrypt user data)
        PID:5385
      • com.excelliance.dualaid:lebian
        1⤵
        • Checks memory information
        • Loads dropped Dex/Jar
        • Queries information about running processes on the device
        • Checks if the internet connection is available
        • Uses Crypto APIs (Might try to encrypt user data)
        PID:5432

      Network

            MITRE ATT&CK Mobile v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            kxqpplatform2.jar
            • Path /data/data/com.excelliance.dualaid/.platformcache/kxqpplatform2.jar
            • Size 1.0MB
            • SHA256 bc9cf30cbc95cb5dc069f13fee8eb3f0db0d7001c15433996f2a36575a76767e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            libkxqpplatform.sinfo
            • Path /data/data/com.excelliance.dualaid/.platformcache/lib_kxqpplatform/libkxqpplatform.sinfo
            • Size 238B
            • SHA256 b4e8cc2176e274e1be43c043296cbeb761cc41cd688a96266102bbfceaf7b58c
            • MD5 SHA1 SHA512
            Submit Download

            main.jar
            • Path /data/data/com.excelliance.dualaid/.platformcache/main.jar
            • Size 1.1MB
            • SHA256 56649d8d6cc810be827d3522748dcd5b586c3a2af05fd48f31e96d465215f4c2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            airpushitemnew.db-journal
            • Path /data/data/com.excelliance.dualaid/databases/airpushitemnew.db-journal
            • Size 512B
            • SHA256 7e95d56d42638ab9afd81bc3c041233a53327574cc182291b75bfc92746b268e
            • MD5 SHA1 SHA512
            Submit Download

            airpushitemnew.db-wal
            • Path /data/data/com.excelliance.dualaid/databases/airpushitemnew.db-wal
            • Size 32KB
            • SHA256 d0cb088534a12461955394a867893a30ca1523752745ef413977b060994e999e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            lio_statistics.db
            • Path /data/data/com.excelliance.dualaid/databases/lio_statistics.db
            • Size 4KB
            • SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
            • MD5 SHA1 SHA512
            Submit Download

            lio_statistics.db-journal
            • Path /data/data/com.excelliance.dualaid/databases/lio_statistics.db-journal
            • Size 512B
            • SHA256 534db1a31f345568faa6b4622c26126e30d483a36e40195714e3245de2962e3f
            • MD5 SHA1 SHA512
            Submit Download

            lio_statistics.db-wal
            • Path /data/data/com.excelliance.dualaid/databases/lio_statistics.db-wal
            • Size 88KB
            • SHA256 2406c8d2c340c90e63c4c3da5e0bd4213da9794b625e9b0cb6a7b91930e6132a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            lb_packages
            • Path /data/data/com.excelliance.dualaid/gameplugins/lb_packages
            • Size 252B
            • SHA256 7ea275b32ce6690eb780442c660e0389cdd2f2515dcdabb3c7b8b9737ea7bbb3
            • MD5 SHA1 SHA512
            Submit Download

            kxqpplatform2.jar
            • Path /data/user/0/com.excelliance.dualaid/.platformcache/kxqpplatform2.jar
            • Size 1.2MB
            • SHA256 01ebbca2e10721bce9ae9d56a28e012f90bc4a277e95af16e3e5884202d5ea8d
            • MD5 SHA1 SHA512 SSDEEP
            Download

            kxqpplatform2.jar
            • Path /data/user/0/com.excelliance.dualaid/.platformcache/kxqpplatform2.jar
            • Size 1.2MB
            • SHA256 57fe9057d049a16136146caf0d8b6f4613e9c193673f1c0cae57e1714c797143
            • MD5 SHA1 SHA512 SSDEEP
            Download

            main.jar
            • Path /data/user/0/com.excelliance.dualaid/.platformcache/main.jar
            • Size 2.7MB
            • SHA256 c5ef5cb9c61554f299f6955634329e8ba5f3566fa12bd8dbeef8b3b0c9a508fe
            • MD5 SHA1 SHA512 SSDEEP
            Download

            main.jar
            • Path /data/user/0/com.excelliance.dualaid/.platformcache/main.jar
            • Size 2.7MB
            • SHA256 13ca9ba2d1a9d871b3789e09d133a97db5bb9de49c1f85e7850196a507c6d5d6
            • MD5 SHA1 SHA512 SSDEEP
            Download

            .idcard
            • Path /storage/emulated/0/.android/.systems/.idcard
            • Size 41B
            • SHA256 7663575509dcb1c20abbf2a8621863940c26502c110e9b46f1489e06a836834c
            • MD5 SHA1 SHA512
            Submit Download

            compVersion
            • Path /storage/emulated/0/.com.excelliance.dualaid/game_res/compVersion
            • Size 990KB
            • SHA256 63b7756e5150b027fc137cff04cb3743fda56ee3fd90ad7cf2ece6515e745bd5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            verinfo.cfg
            • Path /storage/emulated/0/.com.excelliance.dualaid/game_res/verinfo.cfg
            • Size 9KB
            • SHA256 1e8540fc4ea9b9ba1f3ae495b8d0c9e4ded10b2afea8fdbecbde28bdbdca93f5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            verinfo.cfg
            • Path /storage/emulated/0/.com.excelliance.dualaid/game_res/verinfo.cfg
            • Size 82B
            • SHA256 ae1d573642fb9ed81d3a3dad0f9dc30323ef399f918ac832e50349872c17aec3
            • MD5 SHA1 SHA512
            Submit Download