Overview

overview

8

Static

static

8

5806cebacf...18.apk

android-9-x86

8

5806cebacf...18.apk

android-13-x64

8

gdtadv2.apk

android-9-x86

Analysis

  • max time kernel
    174s
  • max time network
    191s
  • platform
    android_x64
  • resource
    android-33-x64-arm64-20240514-en
  • resource tags

    androidarch:arm64arch:x64image:android-33-x64-arm64-20240514-enlocale:en-usos:android-13-x64system
  • submitted
    19/05/2024, 02:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    5806cebacf767492da3612216e23cc36_JaffaCakes118.apk
  • Size 31.1MB
  • Sample240519-cgybssda48
  • SHA256 9003085a97494fb60031783d8c79ea83b902fdab7dc329ce02ead81074814e58
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
bankercollectiondiscoveryevasionexecutionimpactpersistence

Malware Config

Signatures

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Requests cell location 2 TTPs 1 IoCs

    Uses Android APIs to to get current cell location.

    collectiondiscoveryevasion
  • Queries information about running processes on the device 1 TTPs 4 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Reads the content of photos stored on the user's device. 1 TTPs 4 IoCs
    collection
  • Checks if the internet connection is available 1 TTPs 2 IoCs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs
    impact

Processes

  • com.account.book.quanzi
    1⤵
    • Requests cell location
    • Queries information about running processes on the device
    • Reads the content of photos stored on the user's device.
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4377
  • com.account.book.quanzi:pushservice
    1⤵
    • Queries information about running processes on the device
    • Reads the content of photos stored on the user's device.
    PID:4445
  • com.account.book.quanzi:remind
    1⤵
    • Queries information about running processes on the device
    • Reads the content of photos stored on the user's device.
    • Schedules tasks to execute at a specified time
    PID:4699
  • com.account.book.quanzi:pushservice
    1⤵
    • Queries information about running processes on the device
    • Reads the content of photos stored on the user's device.
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4746

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        pushsdk.db-journal
        • Path /data/user/0/com.account.book.quanzi/databases/pushsdk.db-journal
        • Size 8KB
        • SHA256 1b8337d0cd5cb912f8cb9f8687304d93b2402ad6aab9db8df0c9d11f066398b7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        pushsdk.db-journal
        • Path /data/user/0/com.account.book.quanzi/databases/pushsdk.db-journal
        • Size 8KB
        • SHA256 2e0ad1982933befe35345a18c03e13c4547c4791620730fb49f5e36ba34361ab
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        pushsdk.db-journal
        • Path /data/user/0/com.account.book.quanzi/databases/pushsdk.db-journal
        • Size 4KB
        • SHA256 b1a500a365ef16340eaa09c6272d15cf74550e29adccff5c7b112b02c7ca8e6f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        pushsdk.db-journal
        • Path /data/user/0/com.account.book.quanzi/databases/pushsdk.db-journal
        • Size 8KB
        • SHA256 a19c121035458e13faf81d4f5a3290dcc11d1922401212ee6854f0e9ded15411
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        pushsdk.db-journal
        • Path /data/user/0/com.account.book.quanzi/databases/pushsdk.db-journal
        • Size 8KB
        • SHA256 1fdfe2da11ace2673ef96ca59166822d2b2e481421c187d842e44b08ab360eaa
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        init_c1.pid
        • Path /data/user/0/com.account.book.quanzi/files/init_c1.pid
        • Size 14B
        • SHA256 de2ae7d914431e6050de0fbd7d054c2b7e43576d3b3ee5028213d5506d72cd35
        • MD5 SHA1 SHA512
        Submit Download

        init_c1.pid
        • Path /data/user/0/com.account.book.quanzi/files/init_c1.pid
        • Size 14B
        • SHA256 3bb1a6ba6fd731ef096403a88a521afed6b69b7e906e0003186b9c38362c6c1c
        • MD5 SHA1 SHA512
        Submit Download

        dso_deps
        • Path /data/user/0/com.account.book.quanzi/lib-main/dso_deps
        • Size 424B
        • SHA256 619600b5a7fa95bc6c46663305d339669917345003e89ab1f1c4f85b458cf848
        • MD5 SHA1 SHA512
        Submit Download

        dso_manifest
        • Path /data/user/0/com.account.book.quanzi/lib-main/dso_manifest
        • Size 14B
        • SHA256 ab3ef731f38f9a76ba9176b61fe760da6e3e8f84957f94b62d88a6e7a038c1a9
        • MD5 SHA1 SHA512
        Submit Download

        dso_state
        • Path /data/user/0/com.account.book.quanzi/lib-main/dso_state
        • Size 14B
        • SHA256 acd5c8ecaf4cb9112b21ee700bfbbe8b1c69ec5845de6b131ba525c691aaa2b1
        • MD5 SHA1 SHA512
        Submit Download

        dso_state
        • Path /data/user/0/com.account.book.quanzi/lib-main/dso_state
        • Size 48KB
        • SHA256 647a0ed7ea60171e278db861d1aa9aa7fe83baa82302d30cd560a654b27698e1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        tbslog.txt
        • Path /storage/emulated/0/Android/data/com.account.book.quanzi/files/tbslog/tbslog.txt
        • Size 15KB
        • SHA256 eddac6ace9a17a174815a10f22f44da2f6e2f24b65d549618151ce2cb047b682
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        tbslog.txt (deleted)
        • Path /storage/emulated/0/Android/data/com.account.book.quanzi/files/tbslog/tbslog.txt (deleted)
        • Size 1KB
        • SHA256 b53feba23f1b641a7911b16cf4d09f6919b6b2e29ecedf039d3810b43a47a9d0
        • MD5 SHA1 SHA512
        Submit Download

        com.account.book.quanzi.bin
        • Path /storage/emulated/0/libs/com.account.book.quanzi.bin
        • Size 77B
        • SHA256 58933ed05e23c48e8ae144a37e747d52858d7bc35b000fd24150402788efa66e
        • MD5 SHA1 SHA512
        Submit Download

        com.account.book.quanzi.bin
        • Path /storage/emulated/0/libs/com.account.book.quanzi.bin
        • Size 77B
        • SHA256 8b1ceac770a0599217b10422907dd215daed94dcec881ecf8d21f8d2f6138911
        • MD5 SHA1 SHA512
        Submit Download

        com.account.book.quanzi.bin
        • Path /storage/emulated/0/libs/com.account.book.quanzi.bin
        • Size 77B
        • SHA256 6c845013fba69e395e60a651b0f9dd29d16bedd7866d3311c6cb8eb99c54a580
        • MD5 SHA1 SHA512
        Submit Download

        com.account.book.quanzi.bin
        • Path /storage/emulated/0/libs/com.account.book.quanzi.bin
        • Size 77B
        • SHA256 fe9e45cf2bd3a1543cc9219b30be0c65c2c3a9e59c075272e255787646aa875c
        • MD5 SHA1 SHA512
        Submit Download

        com.account.book.quanzi.bin
        • Path /storage/emulated/0/libs/com.account.book.quanzi.bin
        • Size 77B
        • SHA256 bfff84c73dbd35226f328c253a73a595dfb96649a41101e070bf6b1d243d2d20
        • MD5 SHA1 SHA512
        Submit Download