Analysis

  • max time kernel
    152s
  • max time network
    173s
  • platform
    android_x86
  • resource
    android-x86-arm-20240514-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
  • submitted
    19-05-2024 19:29

General

  • Target

    5b1146f96fd42b235d2be644bcb4f77d_JaffaCakes118.apk

  • Size

    5.7MB

  • MD5

    5b1146f96fd42b235d2be644bcb4f77d

  • SHA1

    4e14ad04f12d0d3dc67b3e00e33cc9e0326a4f9f

  • SHA256

    e001c0dfe6363347f3fcec884bc561029b0913a236afbb885fb61c4ba8a8132d

  • SHA512

    2b23f8a36b07ae05bb74025eb01a3519b38062e91212eec32deee0f548fec5677fc5f7c59ea7d132343e1eaca850c90a0c9dc070a8870fd3f062c5ba84273a60

  • SSDEEP

    98304:w0+I1S00AE5jKoxCwHLD723aByAMIUoe4SwrGcwZiTQ4U1MLRDRjBr93uL:7JBXEwo8e3723zJIUoxdqFq/N4

Malware Config

Signatures

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

  • Checks memory information 2 TTPs 1 IoCs

    Checks memory information which indicate if the system is an emulator.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 5 IoCs
  • Checks if the internet connection is available 1 TTPs 5 IoCs
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
  • Reads information about phone network operator. 1 TTPs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 5 IoCs

Processes

  • com.yangmaodi.app
    1⤵
    • Checks CPU information
    • Checks memory information
    • Queries information about running processes on the device
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4264
  • com.yangmaodi.app:pushservice
    1⤵
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4393
  • com.yangmaodi.app:pushservice
    1⤵
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4583
  • com.yangmaodi.app:pushservice
    1⤵
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4681
  • com.yangmaodi.app:pushservice
    1⤵
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4759

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.yangmaodi.app/databases/cc/cc.db

    Filesize

    36KB

    MD5

    facbb554bedb1e03e0c6588e99811c86

    SHA1

    9f6c581858597954223d09c8982ae37cab2d9d61

    SHA256

    bab0ac083c9f569cff1b93e7a8636ba7af9b8851a1624279357afa977018d359

    SHA512

    8be133946c2309922e8e0169f194303da6dd51bacf224af44f3a6e694fe5749468cf5894a7fa6edf98388b839e1792a282a3fcba8ef3076ca81922c04d61947a

  • /data/data/com.yangmaodi.app/databases/cc/cc.db

    Filesize

    36KB

    MD5

    ce6135aa1b1fe4f2c2db2a546d2a5558

    SHA1

    79b59582154017aadab783dc266fcb158c252940

    SHA256

    7b45f576c08c7f78220168cca4a0e33198b13e9bdc8b1da406ddb6887412000c

    SHA512

    2839075fe374c8567c839ae35ce2d33ec72fdaebf170aa7d224b555e5b0e74d4a43f2f67d17ed806dae841da883e9620d788ea052d06152678afa927307c7ce4

  • /data/data/com.yangmaodi.app/databases/cc/cc.db-journal

    Filesize

    512B

    MD5

    27d399db63334e3c6b9cd2297a7e3d13

    SHA1

    f2b53bef9d6994edaac0a4730bb5e0f9251cf8c5

    SHA256

    e3b01f7a196f36b0b6a6ca5a022a03512849568c579078a9f2a08b3cae188f1c

    SHA512

    1119bbc5d3250ab8e2a31ce88526d8148c87b7424a660079660a2f5615d6904225bab033d6002f67dc94c459f96b97b37da06ca4fdf81933237de627ad443771

  • /data/data/com.yangmaodi.app/databases/cc/cc.db-shm

    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/com.yangmaodi.app/databases/cc/cc.db-wal

    Filesize

    48KB

    MD5

    f5cf8043591c6c790d92ad7b55b1c6a3

    SHA1

    255c24d50af7bcde413b1c444d11799d226abf20

    SHA256

    55db511683b2ec124a9f9649a772f2019d11a3029a47bf82ad65ab2521c5a5ee

    SHA512

    9f13f855619d916344124ae8c30af7d563622f95e07ecabbf0dad90400b7b5328cba0ca592f29a29e6baa82656b4da2f832620ef6ceea48531c5a875ef7293c9

  • /data/data/com.yangmaodi.app/databases/cc/cc.db-wal

    Filesize

    16KB

    MD5

    75f9f3d9d48dd3116976e38c3c7edad7

    SHA1

    a90b617c80192299f0551a0b75495f0e3426945f

    SHA256

    dda0161ab9f1e2196922fa9098247e5c257447b9af8a99a4bfc9a27969e55143

    SHA512

    c50d5e82d611c4e5a39a64dba2f1acb8cabb5e517dcff3ce968d5237dc699eb3e136f21114d3c7c54da0779ae2d7a4d7d3a048d89bb0b93fb80aca3d8aa5e6c2

  • /data/data/com.yangmaodi.app/databases/pushsdk.db

    Filesize

    213KB

    MD5

    95296f49cac59a7a89e62601cfec4965

    SHA1

    fd0b772b8852399da10f1d71b52d1fc0208586c0

    SHA256

    c432c9d6abb0df9d2eb5e9549f42dca20216efae71ed27e50e1b5f85c952194a

    SHA512

    79dfc7bc5deae9e46ee7de447ee7b9fdf5228bf26b1ecea5e2cd867993483448657009c00038145c7856e230230359cb8413422ec69fcbd83eeb30d327b47cae

  • /data/data/com.yangmaodi.app/files/.imei.txt

    Filesize

    32KB

    MD5

    1eb592342fd0a5c439bf1eb05159295f

    SHA1

    35f48555990ea8acccd705bf502943d2a72e08ef

    SHA256

    2dcf67375366b262dee1422e0e3e5b41d13a73de725173f2a79e402add93c70c

    SHA512

    7a52c348076a1ce50bf293da9de78ee0f64343d614014c05b9a61c1244c95aeeaf5a6452e5e7eae9f2e16115ce70678e8cf6615c14f9dcf3ae273b82464e489d

  • /data/data/com.yangmaodi.app/files/.um/um_cache_1716147131426.env

    Filesize

    1KB

    MD5

    3e536cf180b7dfa4f071ccf275ca777d

    SHA1

    3476c5b73ff6cc65bb086c80cb420aa7728118dc

    SHA256

    4be3b2efe137639c1518bf7c85db8bc50d086d6d0835802199eb802db0480756

    SHA512

    305b3352ed5b4ff68277321d9aafbd6170cb98ae0ac6a25125cd171e4d15570e4aeced5e0b5204a4fb862fb40e24f4329a742a4f6d9562bdd059541b50548c4a

  • /data/data/com.yangmaodi.app/files/.umeng/exchangeIdentity.json

    Filesize

    162B

    MD5

    daf7775a1353bf1e013c848300d15072

    SHA1

    62de89717ed0271610bd53dd8a3e176149501517

    SHA256

    2dab85c1a94aa9714c862d6c7cf2d50d71090aa11802dc09616aa2654ac1a7fe

    SHA512

    6b08a4fccce78cbc13cfa52e47a20b66f5efd1d004906249f1856a9ed5f667e7cf4839f21323611ed7fac3c97f6621919b12c89899720a36f128a50ce6343be9

  • /data/data/com.yangmaodi.app/files/cnc3ejE5/wap2app__template/__shortcut.js

    Filesize

    104KB

    MD5

    8de9e3d24f2f2e93973a53e837191b1c

    SHA1

    47c7ed45c39ad3cf674a27cfa615f8c4e3466d24

    SHA256

    d202074c2c8bec44e741d64c1713f2aaa6ffa6cfcc28fa71f70834370ed97145

    SHA512

    add4ce527b923842d08fd775305230d906e13adb6682181b08b06dedc9aa93a84c326b7cbc271c07284dd6e5a8d8eb6ab7b693467676f53640c676533de357e3

  • /data/data/com.yangmaodi.app/files/cnc3ejE5/wap2app__template/__template.json

    Filesize

    32KB

    MD5

    d99f140889aee11242a6e10617d4602b

    SHA1

    8e1e6c84ea52d90c26244af821c5b1fad71564de

    SHA256

    36d0b35b89ce7b956b4480a279e4e640faacc1f82f20b7b4e195148c38cae5b5

    SHA512

    fa2f1b6644e948c614a664bee7ca16dd65c47ce93e921965772dfea5c2fd1f10e795646681ffdd20a17f084e1f0cb0fdbedeb627ab0be055637dd81b79963341

  • /data/data/com.yangmaodi.app/files/cnc3ejE5/wap2app__template/__wap2app.js

    Filesize

    210KB

    MD5

    875525c14a557d6e6d7d3e3e11664af2

    SHA1

    7ca8b92bfb1e406546f756d30b93f6f99fe0b5a6

    SHA256

    2390994799eaf64e9c5e5fd4488f7e128e39d473696b1c0266425cae45099977

    SHA512

    e9cbf5cf71191d655e911bb826dd18db91810d61129572632dce2e293e506d4e783f93e968284f58d60273a5b877b616453510bc7daa439839b30550bfdecae0

  • /data/data/com.yangmaodi.app/files/cnc3ejE5/wap2app__template/__wap2app.ttf

    Filesize

    2KB

    MD5

    3ec8d78fddecec43eb6eefc219b8f3e0

    SHA1

    0bbe450670eb45739d0fe5a67252ff90ac446e28

    SHA256

    f40568056690a59ed3711f964aaadd814ccf17c6a94fd10923845384cfb11286

    SHA512

    e835ee9d20132b3408d4c2f0dd164a793b5f411d9bc2aa1c79abd64c4be24c9425b554b99d5b1767310e89f585ccec3c3a99899632b8ea8f2da47ee32d814a93

  • /data/data/com.yangmaodi.app/files/cnc3ejE5/wap2app__template/__wap2appbrowser.html

    Filesize

    48KB

    MD5

    6117b8a8892dab7c563bc3dae3741469

    SHA1

    71d9bb861894984d3f77980492277039ecab93fe

    SHA256

    827e489207a890943463c1b47a518c20204dede9ba5857528b6d6cc00463e279

    SHA512

    72607555842acb984652325a2c4a0607c45342047fd77106350141233ef4ef37f99fa934c063e6f6fdb1a70a7d9483009ec6aedb26caf43fb47fbea6d8454026

  • /data/data/com.yangmaodi.app/files/cnc3ejE5/wap2app__template/__wap2appcontext.html

    Filesize

    92KB

    MD5

    ee0bb9d19d5ecf028a9bb02414c9a6cf

    SHA1

    0f797ad94bf35fd1fc3266d75a7762712b087197

    SHA256

    ae8edfe7402b355b517b173af03891964625aad2524d3d57ee4438f935606617

    SHA512

    6f072a726997031966ff7a05de94ff3244dc96a08afe44f72dad94c8fd1ee725069abddbec7662c49528ae233d7cf42c7de7064a0b35170fca686235393757ad

  • /data/data/com.yangmaodi.app/files/cnc3ejE5/wap2app__template/__wap2apperror.html

    Filesize

    32KB

    MD5

    71103aa33b32ffd98904e68c0e088f38

    SHA1

    484766fa41bf87d2d35f2daea1ecf55db8767060

    SHA256

    d75c2270ef69dd736f75e0e53719974d38a7d94f31868333d1e76ac7d69bf46b

    SHA512

    4293dade18691140ffc304a9110df284b24672f233e2431c20e85ce0e6d5a117f0b1fab336ee4d055dfeb74cf764f40b9ed4a93a592eb1897cd38ea979624b9a

  • /data/data/com.yangmaodi.app/files/cnc3ejE5/wap2app__template/__wap2appplayer.js

    Filesize

    26KB

    MD5

    4e8f48204fef8253b1469f18c7b294aa

    SHA1

    2ae7359ec4e30a2db17b43549df93aab8d2fac85

    SHA256

    1b11466b6126225bfe830b781f11df6d1b33ed0ef72a4ff7486a96d7719398e2

    SHA512

    bec3c756d26b4e0d3188279777661151e5f1be3e3c43ee64d01c30450f543c6b803e1922584d5fdd1a2e865d9d14e5309fc438a25fb257fd7cd3c41833961141

  • /data/data/com.yangmaodi.app/files/cnc3ejE5/wap2app__template/__wap2appquit.js

    Filesize

    10KB

    MD5

    f0216f4cb761d71e6138ec12a91fda05

    SHA1

    df124bc52ef2074c20d6e4f66ed0da5bece418a1

    SHA256

    14e60163c4fa62729e35223e21e8069d87c49e7c7b39494c759729954b5d3f8e

    SHA512

    2926104498012b7db3cd673e157ebe426d837d334c597ce19dd317dbfea2898b1d8be851ddcc1fa2fe051ea0295e8af4cc8c5f220917e78ea9df28530b1e903e

  • /data/data/com.yangmaodi.app/files/cnc3ejE5/wap2app__template/__wap2appswiper.html

    Filesize

    46KB

    MD5

    eb5f938650308c63a3f082a5b1e3382a

    SHA1

    08ddcdf824e285921f1b43faaebc817514fc9345

    SHA256

    72d7ce0d6e3b6ded505bdd9f279ecc3262027d40d6222fdee2749c9850f46d65

    SHA512

    50a8859f1f3c7f71a1c03d3e547d53a189916f4574c61be834bd877f6a6f52e1e07863eab2a7a9387d1f52569eca2784de90898b3fbfdfdfab1239f3f5094961

  • /data/data/com.yangmaodi.app/files/cnc3ejE5/wap2app__template/__wap2apptabbar.css

    Filesize

    1KB

    MD5

    52dbbeb73ea1eb43eae20cce83abf9c9

    SHA1

    945c26255dda4d4f1dc53e080bbed91484d87a9b

    SHA256

    e613d71151b2c01b697f662e3f194bcd60265c767bef9bd49766bbd54f24b019

    SHA512

    7cbd9a4f3cb3a70d0b487aad9043b357dfddfdc975d830d8e2bee8363a96263c885671a72adc98bf64e2627108bb47bfdb03b27003ba2b24233b41c49017c30a

  • /data/data/com.yangmaodi.app/files/cnc3ejE5/wap2app__template/__wap2apptabbar.js

    Filesize

    56KB

    MD5

    418ae300c438817bb57aab46f9245959

    SHA1

    814f8f0a7f212ac71197f63132814cd6e454819b

    SHA256

    0a193525e5251c00315aa68640eec78cb49af7e97552e2eb0a1b465f2ea7eecd

    SHA512

    bd07d12edebb9ea4f10d1986047cef92c62a662a8bd9b8c9edfdee67f00d20b0aeddfcccfed71ba29d03c45a74007cc9f75d00febaf11102dbf738b3799d2bad

  • /data/data/com.yangmaodi.app/files/cnc3ejE6/eje3cnc

    Filesize

    335B

    MD5

    585839d66722cfd02e40cb740cccb633

    SHA1

    374c19200fee201b26d0153487a281a934615884

    SHA256

    86a9bb4985cca6c9636c4fd071bef4b70ba7b3a5eb51af869a1299dc2b1574a8

    SHA512

    09bbe1bf1455861fd4732f2d1945c84bac34090906ac2fab75d144c22ffcf6bc585c8209e94a2b1919c8402df53966081a1af2993e12261ae4c4ac5568667d88

  • /data/data/com.yangmaodi.app/files/umeng_it.cache

    Filesize

    498B

    MD5

    031fd2086ef5fe0afd04051bdc7fb5b2

    SHA1

    2a00b9bd9a324e57f78ab8c8ed77b7f089740c49

    SHA256

    7bd77e2bc9448513d3f9ab80206fddddfc033ac382b423808aa2bf3760ec60c2

    SHA512

    d737cf284e8172f0a2f0c54d3a22568b60b908d3dd4dd13789e84af605c05250421f701169943828745a0e92e255ba2847e2797f8d8d636c9dbbad33d732cb64

  • /storage/emulated/0/.DataStorage/ContextData.xml

    Filesize

    111B

    MD5

    1fba4ec45e457ed5ee3e4a37aa90fec4

    SHA1

    e87996c4d91e7a466581d34c49fed34a2a3e20f8

    SHA256

    8a64b01971984f469f21f23be7c21b2529713c1f76a626715b2efffcd12d20f6

    SHA512

    bce1993a506247bc4c2a311521dad6b56a2a4e740fa4cb359069ad1c3ae5b6cef399014560225d38a64ea4a73469453cebbc056f40ad85ec05a56f0b39127245

  • /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

    Filesize

    65B

    MD5

    9781ca003f10f8d0c9c1945b63fdca7f

    SHA1

    4156cf5dc8d71dbab734d25e5e1598b37a5456f4

    SHA256

    3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793

    SHA512

    25a9877e274e0e9df29811825bd4f680fa0bf0ae6219527e4f1dcd17d0995d28b2926192d961a06ee5bef2eed73b3f38ec4ffdd0a1cda7ff2a10dc5711ffdf03

  • /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

    Filesize

    111B

    MD5

    e35f95c4e6bc3560d343f5e46ea844e4

    SHA1

    9a21914e83de1ac2b61099fb9df740b4f13107bd

    SHA256

    c50d6a83d4677562ff626257393f99bbf9a7ecbf93f948e7e3972c6c89f8a9bc

    SHA512

    1e9b5a3fae44b7fa053883ded32b3633951d745dce5532cb2eb6cdbd41108786ccbb670c2f36c06a07591e7ab09efc58eb32f5c9a82435ed15d2ce8207c2a175

  • /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

    Filesize

    381B

    MD5

    2073e4d5dbd6c914dfaa7c44674c71b3

    SHA1

    80b997b97ad513baaa562dc7efb6020fef47abeb

    SHA256

    34d7850fbe35d1b6e84281b2b7de65dd1ffc098d70e6cbdf27a922ad30c57b91

    SHA512

    c0c578a2633769eb572522d98c03460909a5a752d91466730a64cd6ca632679edea07a2f5810ac9564a4bfc1c03ad2c26447956dd16d26b32c412ea841c00160

  • /storage/emulated/0/.imei.txt

    Filesize

    32B

    MD5

    f96373310861d8a8d00e7d6381ce9804

    SHA1

    e77f94729b9ce37f56834793340f7849cc9f6d98

    SHA256

    601fab484f3de11d751b401c0e8165ac14bb8ee0614926575afad440fabb07a0

    SHA512

    667bfc074fc212a490deb4e41c698e5b92c6b1f987a973fff35a1e32d80e64f757ab4ed4fdfb175ace55fcd49c086cdf556bcef8823b08c9a4f82b3471e8e253