Analysis
- max time kernel
179s - max time network
190s - platform
android_x86 - resource
android-x86-arm-20240514-en - resource tags
- submitted
18/05/2024, 16:56
General
- Target 55cd50682d35e8df0f5ff44662077c34_JaffaCakes118.apk
- Size 25.1MB
- Sample240518-vfpblsdd7v
- SHA256 f73ee685d159cb5432ad675ff58565506d09ec90d0042e38676351e75249d612
Malware Config
Signatures
- Checks if the Android device is rooted. 1 TTPs 15 IoCs
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
- Checks Android system properties for emulator presence. 1 TTPs 5 IoCs
- Checks CPU information 2 TTPs 2 IoCs
Checks CPU information which indicate if the system is an emulator.
- Checks memory information 2 TTPs 2 IoCs
Checks memory information which indicate if the system is an emulator.
- Loads dropped Dex/Jar 1 TTPs 31 IoCs
Runs executable file dropped to the device during analysis.
- Queries account information for other applications stored on the device 1 TTPs 2 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
- Queries information about running processes on the device 1 TTPs 4 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
- Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
- Reads the content of photos stored on the user's device. 1 TTPs 1 IoCs
- Reads the content of the browser bookmarks. 1 TTPs 1 IoCs
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 7 IoCs
- Checks if the internet connection is available 1 TTPs 5 IoCs
- Reads information about phone network operator. 1 TTPs
- Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
- Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs
Processes
-
com.cleanmaster.mguard_cn1⤵
- Checks if the Android device is rooted.
- Checks Android system properties for emulator presence.
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Reads the content of photos stored on the user's device.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
-
com.cleanmaster.mguard_cn:service1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Registers a broadcast receiver at runtime (usually for listening for system events)
-
/system/bin/dex2oat --zip-fd=65 --zip-location=/data/user/0/com.cleanmaster.mguard_cn/files/storage/com.cm.plugin.core/version.1/bundle.zip --oat-fd=66 --oat-location=/data/user/0/com.cleanmaster.mguard_cn/files/storage/com.cm.plugin.core/version.1/bundle.dex --instruction-set=arm --instruction-set-features=default --runtime-arg -Xms64m --runtime-arg -Xmx512m --compiler-filter=verify-none --inline-max-code-units=0 --compact-dex-level=none2⤵
-
-
/system/bin/dex2oat --zip-fd=73 --zip-location=/data/user/0/com.cleanmaster.mguard_cn/files/storage/com.cm.plugin.junkplus/version.1/bundle.zip --oat-fd=74 --oat-location=/data/user/0/com.cleanmaster.mguard_cn/files/storage/com.cm.plugin.junkplus/version.1/bundle.dex --instruction-set=arm --instruction-set-features=default --runtime-arg -Xms64m --runtime-arg -Xmx512m --compiler-filter=verify-none --inline-max-code-units=0 --compact-dex-level=none2⤵
-
-
com.cleanmaster.mguard_cn:download1⤵
- Checks if the Android device is rooted.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
-
com.cleanmaster.mguard_cn:worker1⤵
- Checks if the Android device is rooted.
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
-
com.cleanmaster.mguard_cn:service1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Registers a broadcast receiver at runtime (usually for listening for system events)
-
/system/bin/dex2oat --zip-fd=60 --zip-location=/data/user/0/com.cleanmaster.mguard_cn/files/storage/com.cm.plugin.screensaver/version.1/bundle.zip --oat-fd=61 --oat-location=/data/user/0/com.cleanmaster.mguard_cn/files/storage/com.cm.plugin.screensaver/version.1/bundle.dex --instruction-set=arm --instruction-set-features=default --runtime-arg -Xms64m --runtime-arg -Xmx512m --compiler-filter=verify-none --inline-max-code-units=0 --compact-dex-level=none2⤵
-
-
com.cleanmaster.mguard_cn:service1⤵
- Checks if the Android device is rooted.
- Checks Android system properties for emulator presence.
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Reads the content of the browser bookmarks.
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Listens for changes in the sensor environment (might be used to detect emulation)
- Uses Crypto APIs (Might try to encrypt user data)
-
/system/bin/dex2oat --zip-fd=68 --zip-location=/data/user/0/com.cleanmaster.mguard_cn/files/storage/com.cm.plugin.internal/version.1/bundle.zip --oat-fd=69 --oat-location=/data/user/0/com.cleanmaster.mguard_cn/files/storage/com.cm.plugin.internal/version.1/bundle.dex --instruction-set=arm --instruction-set-features=default --runtime-arg -Xms64m --runtime-arg -Xmx512m --compiler-filter=verify-none --inline-max-code-units=0 --compact-dex-level=none2⤵
-
-
/system/bin/ndk_translation_program_runner_binfmt_misc /data/user/0/com.cleanmaster.mguard_cn/files/kwatchdog /data/user/0/com.cleanmaster.mguard_cn/files/kwatchdog2⤵
-
-
ls -l /system/xbin/su2⤵
- Checks if the Android device is rooted.
-
-
com.cleanmaster.mguard_cn:perms1⤵
- Checks if the Android device is rooted.
- Checks Android system properties for emulator presence.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
1User Evasion
1Virtualization/Sandbox Evasion
3System Checks
3Replay Monitor
Loading Replay Monitor...
Downloads
bspatch
cm_push_message_db.db-journal
cm_push_message_db.db-shm
cm_push_message_db.db-wal
db_downloader-wal
diskcache.db
diskcache.db-journal
diskcache.db-shm
diskcache.db-wal
dmc_report-journal
dmc_report-wal
downloads.db-journal
downloads.db-wal
gamecache.db-journal
gamecache.db-wal
memory_cache.db
memory_cache.db-journal
memory_cache.db-wal
timewall_cache.db-journal
timewall_cache.db-wal
webviewCache.db
webviewCache.db-journal
webviewCache.db-shm
webviewCache.db-wal
appcpu_hf_cn.db.bak
appmem_hf_cn.db.bak
ats2_sr_cn.dat.bak
ats2_wl_cn.dat.bak
autoinstall_acc.json
clearpath_other_5.9.6.db.bak
clearprocess_cn_5.10.1.filter.bak
clearprocess_cn_5.9.2.filter.bak
com.cleanmaster.mguard_cn:service
com.cleanmaster.mguard_cn:service
h_50.tmp
receiver_history_list.dat
cm_act_temp_1_1716051448494.ich
cm_cn_main_gift_box_1716051450941.ich
cm_cn_plugin_inst_state_1716051439776.ich
cm_cn_plugin_inst_state_1716051441353.ich
cm_cn_plugin_inst_time_1716051506944.ich
cm_cn_reddot_1716051451838.ich
cm_cube_failure_rate_1716051521059.ich
cm_task_onetapsuccess_1716051452564.ich
cm_cert_1716051523350.ich
cm_cn_act_mi_push_regid_1716051521402.ich
cm_cn_game_common_step_1716051516490.ich
cm_cn_main_gift_box_1716051450688.ich
cm_cn_plugin_inst_state_1716051439638.ich
cm_cn_plugin_inst_state_1716051441178.ich
cm_cn_plugin_inst_state_1716051506000.ich
cm_cn_plugin_inst_time_1716051506596.ich
cm_cn_reddot_1716051451621.ich
cm_cn_skinmarket_state_1716051567521.ich
cm_cube_failure_rate_1716051520369.ich
cm_cube_failure_rate_1716051520858.ich
cm_internal_platform_1716051525587.ich
cm_task_onetapsuccess_1716051452399.ich
cm_xiaofuction_1716051441463.ich
cm_xiaofuction_1716051445255.ich
cm_act_srv_1_1716051566570.ich
cm_cn_act_srv_new_1_1716051567351.ich
cm_cn_notification_active_1716051567772.ich
cm_cn_plugin_init_active_1716051517747.ich
cm_cn_plugin_maindata_v2_1716051523829.ich
cm_cn_shopping_reddot_1716051452142.ich
cm_nti_eat_srv_1716051566705.ich
junkwhite.db.bak
kctrl.dat
kfmt.dat
cm_cn_cpyy_permission_sdk_interface_1716051533840.ich
cm_cn_cpyy_permission_sdk_rom_match_1716051529865.ich
cm_game_owner_1716051525947.ich
cm_game_scan_1716051517942.ich
kwatchdog
libkcmlzma.so
libkcmutil.so
libkcmutil.so
libkcmutil.so
libkcmutil.so
libkcmutil.so
melib.dat.bak
pkgcache_hf_cn_5.11.6.db.bak
pkgquery_hf_cn_5.11.6.db.bak
plugin.apk
preinstall4_hf_cn.db.bak
process_tips2.db.bak
se_cloud_hf.db.bak
meta
bundle.zip
meta
meta
meta
bundle.zip
meta
meta
meta
meta
meta
bundle.zip
meta
meta
meta
meta
meta
meta
meta
strings2_other.db.bak
plugin.apk
bundle.zip
bundle.zip
bundle.zip
bundle.zip
bundle.zip
bundle.zip
bundle.zip
ContextData.xml
Alvin2.xml
.dmc_sdk_uuid.uuid
AppLockLog