Analysis
- max time kernel
7s - max time network
149s - platform
android_x86 - resource
android-x86-arm-20240514-en - resource tags
androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system - submitted
19/05/2024, 01:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
57fe5de790332044d6de2ae25d1098c6_JaffaCakes118.apk
Resource
android-x86-arm-20240514-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
QvodPlayerPlugForEasou_V1.0.15_v7neon.apk
Resource
android-x86-arm-20240514-en
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
jackson.apk
Resource
android-x86-arm-20240514-en
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
jackson.apk
Resource
android-x64-20240514-en
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
jackson.apk
Resource
android-x64-arm64-20240514-en
0 signatures
150 seconds
General
- Target QvodPlayerPlugForEasou_V1.0.15_v7neon.apk
- Size 5.9MB
- Sample240519-cb6qzscf57
- SHA256 ed12e447ee2004de2638ece78a071e73a04a4df98009681eb96b2ae925f0aca0
- MD5 29f9e4be6237bb807e4c2c7a0b09522a
- SHA1 35c18df4fe4fabc0531ed4ce310c119fc70c2427
- SHA512 0431217ee54094ccb664f8bc91723c3180ee2a4445ba560309efc51f401197aa45f9eb1dcf060e145f7832a62a02c8255a6583f3b872f94d06f492d6148e4aaf
- SSDEEP 98304:wKJa+m1zLgG3aWANa8g3yMD+tHkg8TZ4kRxBYs8q5wRvG1tysAxD6qlBfwa9kZ:n9Kd8I3+tl8TZbxBYFqGFLBf9SZ
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
description ioc Process File opened for read /proc/cpuinfo com.qvod.plugin.for_easou - Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.qvod.plugin.for_easou/app_dex/jackson.jar 4331 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.qvod.plugin.for_easou/app_dex/jackson.jar --output-vdex-fd=46 --oat-fd=47 --oat-location=/data/user/0/com.qvod.plugin.for_easou/app_dex/oat/x86/jackson.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/com.qvod.plugin.for_easou/app_dex/jackson.jar 4301 com.qvod.plugin.for_easou
Processes
-
com.qvod.plugin.for_easou1⤵
- Checks CPU information
- Loads dropped Dex/Jar
PID:4301 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.qvod.plugin.for_easou/app_dex/jackson.jar --output-vdex-fd=46 --oat-fd=47 --oat-location=/data/user/0/com.qvod.plugin.for_easou/app_dex/oat/x86/jackson.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4331
-
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.qvod.plugin.for_easou/app_dex/jackson.jar
- Size 315KB
- SHA256 738fc4594e5bf80283d85e29715f32db98a131b1692ff87d89cbb38d1ece2cd3
- MD5 9b6567218482a878808e85a12a0840e6
- SHA1 9d3cb8de3c8a45868ce58ef5e8fca3c2f9bdaa07
- SHA512 5abdd1da3b13f02c3c83d76de7190c9f28f61c285b696d1e9a46d88ecd1c3e78481dcb17cc23e8034354d535f6db74571411358279c177224247ef80f09f2957
- SSDEEP 6144:uXfRhAx/seEOVeP1aUZ+iOT/hpxzhaeCItdC78XYmbE1zl2DR3nWlsMZ1MjwCsZx:uvRhKZ4P1ixjhXzSIW4I9OR3n65Ly8Zx
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/com.qvod.plugin.for_easou/app_dex/jackson.jar
- Size 747KB
- SHA256 c1642349a3376c7fc5e368912a8c702738565c6db16646b4d5afde7659688ca4
- MD5 fc53a5cffa53e4bb19bf748abaa60919
- SHA1 3878edcaefac9489cb46516c253af71cf4409bdc
- SHA512 63cea51c3fdf6d19a99287aedf64ab0830426fa9f6ff71e3db7e3696ca1604882504ecac680490f09b71357003193e14caa774454d2e68b5e5992a98f59a16c4
- SSDEEP 12288:Ex5wStgV9B+YChwRtJVhY0UUZuvLaqtOpOmhS:SwE85quO
- MD5 SHA1 SHA512 SSDEEP
- Path /data/user/0/com.qvod.plugin.for_easou/app_dex/jackson.jar
- Size 747KB
- SHA256 acabec1e9855095b0c072aa70434e1980a73742b71c637dedcd84d70191818f1
- MD5 3e0b75cb3c78a6dbe732625ccb5855d0
- SHA1 31923f1ebc0f42f560b17dc98e1cb60d5ebb6813
- SHA512 6ff2d6a074c9e9ecd3e9d49398f802e35c80378509842a915be98ca20641b9b8a049b73d2e3f39b308b654bbf2c2a5c7b66c9a3787d1665c2f6b09e31d00fc22
- SSDEEP 12288:Ex5wStL9ZnovH47NPKdfuwJfI5Wmy50UUZuvLaqtOpOmhS:SB9ZNGVM/quO
- MD5 SHA1 SHA512 SSDEEP