Analysis
- max time kernel
177s - max time network
190s - platform
android_x64 - resource
android-x64-20240514-en - resource tags
- submitted
19/05/2024, 02:04
General
- Target 580766cbe79a51c64bb0cca2c2a18df9_JaffaCakes118.apk
- Size 19.5MB
- Sample240519-cha8nach5v
- SHA256 b2ee62b61b11945d3daf8f36ca9aeb706cadb292ca7efee41a7b39332ab0e720
Malware Config
Signatures
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
- Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
- Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
- Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
- Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
- Queries the mobile country code (MCC) 1 TTPs 1 IoCs
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
- Checks if the internet connection is available 1 TTPs 2 IoCs
- Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
- Reads information about phone network operator. 1 TTPs
- Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs
Processes
-
io.dcloud.H552E41F21⤵
- Checks CPU information
- Checks memory information
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
-
io.dcloud.H552E41F2:pushservice1⤵
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
cc.db
cc.db
cc.db-journal
cc.db-journal
cc.db-journal
cc.db-journal
cc.db-journal
cc.db-journal
pushext.db-journal
pushsdk.db
pushsdk.db-journal
.imei.txt
um_cache_1716084402087.env
exchangeIdentity.json
about.html
add_selling.html
allGame.html
app_info.html
buy_account.html
buy_account1.html
buy_pintm.html
buy_renyi.html
buy_shouch.html
checkUpdate.html
chongzhi.html
chongzhi_detail.html
chongzhi_info.html
chongzhi_list.html
community-info.html
community_newslist.html
SFUSwissBTRegular.TTF
iconfont.css
mobile.css
mui.min.css
reset.css
deal_xieyi.html
fenlei_list.html
filter.html
iconfont.eot
iconfont.svg
iconfont.ttf
iconfont.woff
mui-icons-extra.ttf
mui.ttf
pgzt.ttf
forgetPwd.html
game_list.html
game_newslist.html
guide.html
iconfont.css
iconfont.eot
iconfont.svg
iconfont.ttf
iconfont.woff
applogo.png
head.jpg
loading.gif
ydy01.png
ydy02.png
ydy03.png
ypplogo.png
introduce.html
invite_rule.html
app.js
dataform.js
jquery-1.11.3.min.js
mui.min.js
mui.previewimage.js
mui.zoom.js
kaifu.html
login.html
main.html
main_phb.html
manifest.json
missNet.html
my-deal.html
my_cardlist.html
my_invite.html
my_newslist.html
my_pintm.html
my_vip.html
mydeal_chengph.html
mydeal_icon.html
mydeal_pinth.html
new_game.html
pay.html
phb.html
pinglun_info.html
pintuan.html
pintuan_fail.html
pintuan_finish.html
pintuan_info.html
pintuan_success.html
pintuan_zhong.html
plat_list.html
pth_info.html
ptm_buy_list.html
ptm_use_list.html
publish.html
register.html
search.html
select_ptm.html
sell_info.html
selled.html
selled_info.html
selling.html
selling_info.html
set_password.html
set_phone.html
set_zhifubao.html
setting.html
share.html
system_newslist.html
tab-class.html
tab-community.html
tab-deal.html
tab-index.html
tab-user.html
user_desc.html
user_info.html
user_name.html
user_renz.html
user_xieyi.html
woyaopl.html
yigou_progress_info.html
yigou_sell_info.html
yigou_selling_info.html
yigoumai.html
yipintuan.html
eje3cnc
umeng_it.cache
test_app
ContextData.xml
Alvin2.xml
Alvin2.xml
Alvin2.xml
.imei.txt
226314870
934848543
AdEnable.dat