Analysis
-
max time kernel
152s -
max time network
173s -
platform
android_x86 -
resource
android-x86-arm-20240514-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system -
submitted
19-05-2024 19:29
Behavioral task
behavioral1
Sample
5b1146f96fd42b235d2be644bcb4f77d_JaffaCakes118.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral2
Sample
5b1146f96fd42b235d2be644bcb4f77d_JaffaCakes118.apk
Resource
android-x64-20240514-en
Behavioral task
behavioral3
Sample
tcore.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral4
Sample
tcore.apk
Resource
android-x64-20240514-en
Behavioral task
behavioral5
Sample
tcore.apk
Resource
android-x64-arm64-20240514-en
General
-
Target
5b1146f96fd42b235d2be644bcb4f77d_JaffaCakes118.apk
-
Size
5.7MB
-
MD5
5b1146f96fd42b235d2be644bcb4f77d
-
SHA1
4e14ad04f12d0d3dc67b3e00e33cc9e0326a4f9f
-
SHA256
e001c0dfe6363347f3fcec884bc561029b0913a236afbb885fb61c4ba8a8132d
-
SHA512
2b23f8a36b07ae05bb74025eb01a3519b38062e91212eec32deee0f548fec5677fc5f7c59ea7d132343e1eaca850c90a0c9dc070a8870fd3f062c5ba84273a60
-
SSDEEP
98304:w0+I1S00AE5jKoxCwHLD723aByAMIUoe4SwrGcwZiTQ4U1MLRDRjBr93uL:7JBXEwo8e3723zJIUoxdqFq/N4
Malware Config
Signatures
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
Processes:
com.yangmaodi.appdescription ioc process File opened for read /proc/cpuinfo com.yangmaodi.app -
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
Processes:
com.yangmaodi.appdescription ioc process File opened for read /proc/meminfo com.yangmaodi.app -
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
Processes:
com.yangmaodi.appdescription ioc process Framework service call android.app.IActivityManager.getRunningAppProcesses com.yangmaodi.app -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
Processes:
com.yangmaodi.appdescription ioc process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.yangmaodi.app -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
Processes:
com.yangmaodi.appdescription ioc process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.yangmaodi.app -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 5 IoCs
Processes:
com.yangmaodi.appcom.yangmaodi.app:pushservicecom.yangmaodi.app:pushservicecom.yangmaodi.app:pushservicecom.yangmaodi.app:pushservicedescription ioc process Framework service call android.app.IActivityManager.registerReceiver com.yangmaodi.app Framework service call android.app.IActivityManager.registerReceiver com.yangmaodi.app:pushservice Framework service call android.app.IActivityManager.registerReceiver com.yangmaodi.app:pushservice Framework service call android.app.IActivityManager.registerReceiver com.yangmaodi.app:pushservice Framework service call android.app.IActivityManager.registerReceiver com.yangmaodi.app:pushservice -
Checks if the internet connection is available 1 TTPs 5 IoCs
Processes:
com.yangmaodi.appcom.yangmaodi.app:pushservicecom.yangmaodi.app:pushservicecom.yangmaodi.app:pushservicecom.yangmaodi.app:pushservicedescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.yangmaodi.app Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.yangmaodi.app:pushservice Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.yangmaodi.app:pushservice Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.yangmaodi.app:pushservice Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.yangmaodi.app:pushservice -
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 5 IoCs
Processes:
com.yangmaodi.app:pushservicecom.yangmaodi.app:pushservicecom.yangmaodi.app:pushservicecom.yangmaodi.app:pushservicecom.yangmaodi.appdescription ioc process Framework API call javax.crypto.Cipher.doFinal com.yangmaodi.app:pushservice Framework API call javax.crypto.Cipher.doFinal com.yangmaodi.app:pushservice Framework API call javax.crypto.Cipher.doFinal com.yangmaodi.app:pushservice Framework API call javax.crypto.Cipher.doFinal com.yangmaodi.app:pushservice Framework API call javax.crypto.Cipher.doFinal com.yangmaodi.app
Processes
-
com.yangmaodi.app1⤵
- Checks CPU information
- Checks memory information
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4264
-
com.yangmaodi.app:pushservice1⤵
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4393
-
com.yangmaodi.app:pushservice1⤵
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4583
-
com.yangmaodi.app:pushservice1⤵
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4681
-
com.yangmaodi.app:pushservice1⤵
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4759
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD5facbb554bedb1e03e0c6588e99811c86
SHA19f6c581858597954223d09c8982ae37cab2d9d61
SHA256bab0ac083c9f569cff1b93e7a8636ba7af9b8851a1624279357afa977018d359
SHA5128be133946c2309922e8e0169f194303da6dd51bacf224af44f3a6e694fe5749468cf5894a7fa6edf98388b839e1792a282a3fcba8ef3076ca81922c04d61947a
-
Filesize
36KB
MD5ce6135aa1b1fe4f2c2db2a546d2a5558
SHA179b59582154017aadab783dc266fcb158c252940
SHA2567b45f576c08c7f78220168cca4a0e33198b13e9bdc8b1da406ddb6887412000c
SHA5122839075fe374c8567c839ae35ce2d33ec72fdaebf170aa7d224b555e5b0e74d4a43f2f67d17ed806dae841da883e9620d788ea052d06152678afa927307c7ce4
-
Filesize
512B
MD527d399db63334e3c6b9cd2297a7e3d13
SHA1f2b53bef9d6994edaac0a4730bb5e0f9251cf8c5
SHA256e3b01f7a196f36b0b6a6ca5a022a03512849568c579078a9f2a08b3cae188f1c
SHA5121119bbc5d3250ab8e2a31ce88526d8148c87b7424a660079660a2f5615d6904225bab033d6002f67dc94c459f96b97b37da06ca4fdf81933237de627ad443771
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
48KB
MD5f5cf8043591c6c790d92ad7b55b1c6a3
SHA1255c24d50af7bcde413b1c444d11799d226abf20
SHA25655db511683b2ec124a9f9649a772f2019d11a3029a47bf82ad65ab2521c5a5ee
SHA5129f13f855619d916344124ae8c30af7d563622f95e07ecabbf0dad90400b7b5328cba0ca592f29a29e6baa82656b4da2f832620ef6ceea48531c5a875ef7293c9
-
Filesize
16KB
MD575f9f3d9d48dd3116976e38c3c7edad7
SHA1a90b617c80192299f0551a0b75495f0e3426945f
SHA256dda0161ab9f1e2196922fa9098247e5c257447b9af8a99a4bfc9a27969e55143
SHA512c50d5e82d611c4e5a39a64dba2f1acb8cabb5e517dcff3ce968d5237dc699eb3e136f21114d3c7c54da0779ae2d7a4d7d3a048d89bb0b93fb80aca3d8aa5e6c2
-
Filesize
213KB
MD595296f49cac59a7a89e62601cfec4965
SHA1fd0b772b8852399da10f1d71b52d1fc0208586c0
SHA256c432c9d6abb0df9d2eb5e9549f42dca20216efae71ed27e50e1b5f85c952194a
SHA51279dfc7bc5deae9e46ee7de447ee7b9fdf5228bf26b1ecea5e2cd867993483448657009c00038145c7856e230230359cb8413422ec69fcbd83eeb30d327b47cae
-
Filesize
32KB
MD51eb592342fd0a5c439bf1eb05159295f
SHA135f48555990ea8acccd705bf502943d2a72e08ef
SHA2562dcf67375366b262dee1422e0e3e5b41d13a73de725173f2a79e402add93c70c
SHA5127a52c348076a1ce50bf293da9de78ee0f64343d614014c05b9a61c1244c95aeeaf5a6452e5e7eae9f2e16115ce70678e8cf6615c14f9dcf3ae273b82464e489d
-
Filesize
1KB
MD53e536cf180b7dfa4f071ccf275ca777d
SHA13476c5b73ff6cc65bb086c80cb420aa7728118dc
SHA2564be3b2efe137639c1518bf7c85db8bc50d086d6d0835802199eb802db0480756
SHA512305b3352ed5b4ff68277321d9aafbd6170cb98ae0ac6a25125cd171e4d15570e4aeced5e0b5204a4fb862fb40e24f4329a742a4f6d9562bdd059541b50548c4a
-
Filesize
162B
MD5daf7775a1353bf1e013c848300d15072
SHA162de89717ed0271610bd53dd8a3e176149501517
SHA2562dab85c1a94aa9714c862d6c7cf2d50d71090aa11802dc09616aa2654ac1a7fe
SHA5126b08a4fccce78cbc13cfa52e47a20b66f5efd1d004906249f1856a9ed5f667e7cf4839f21323611ed7fac3c97f6621919b12c89899720a36f128a50ce6343be9
-
Filesize
104KB
MD58de9e3d24f2f2e93973a53e837191b1c
SHA147c7ed45c39ad3cf674a27cfa615f8c4e3466d24
SHA256d202074c2c8bec44e741d64c1713f2aaa6ffa6cfcc28fa71f70834370ed97145
SHA512add4ce527b923842d08fd775305230d906e13adb6682181b08b06dedc9aa93a84c326b7cbc271c07284dd6e5a8d8eb6ab7b693467676f53640c676533de357e3
-
Filesize
32KB
MD5d99f140889aee11242a6e10617d4602b
SHA18e1e6c84ea52d90c26244af821c5b1fad71564de
SHA25636d0b35b89ce7b956b4480a279e4e640faacc1f82f20b7b4e195148c38cae5b5
SHA512fa2f1b6644e948c614a664bee7ca16dd65c47ce93e921965772dfea5c2fd1f10e795646681ffdd20a17f084e1f0cb0fdbedeb627ab0be055637dd81b79963341
-
Filesize
210KB
MD5875525c14a557d6e6d7d3e3e11664af2
SHA17ca8b92bfb1e406546f756d30b93f6f99fe0b5a6
SHA2562390994799eaf64e9c5e5fd4488f7e128e39d473696b1c0266425cae45099977
SHA512e9cbf5cf71191d655e911bb826dd18db91810d61129572632dce2e293e506d4e783f93e968284f58d60273a5b877b616453510bc7daa439839b30550bfdecae0
-
Filesize
2KB
MD53ec8d78fddecec43eb6eefc219b8f3e0
SHA10bbe450670eb45739d0fe5a67252ff90ac446e28
SHA256f40568056690a59ed3711f964aaadd814ccf17c6a94fd10923845384cfb11286
SHA512e835ee9d20132b3408d4c2f0dd164a793b5f411d9bc2aa1c79abd64c4be24c9425b554b99d5b1767310e89f585ccec3c3a99899632b8ea8f2da47ee32d814a93
-
Filesize
48KB
MD56117b8a8892dab7c563bc3dae3741469
SHA171d9bb861894984d3f77980492277039ecab93fe
SHA256827e489207a890943463c1b47a518c20204dede9ba5857528b6d6cc00463e279
SHA51272607555842acb984652325a2c4a0607c45342047fd77106350141233ef4ef37f99fa934c063e6f6fdb1a70a7d9483009ec6aedb26caf43fb47fbea6d8454026
-
Filesize
92KB
MD5ee0bb9d19d5ecf028a9bb02414c9a6cf
SHA10f797ad94bf35fd1fc3266d75a7762712b087197
SHA256ae8edfe7402b355b517b173af03891964625aad2524d3d57ee4438f935606617
SHA5126f072a726997031966ff7a05de94ff3244dc96a08afe44f72dad94c8fd1ee725069abddbec7662c49528ae233d7cf42c7de7064a0b35170fca686235393757ad
-
Filesize
32KB
MD571103aa33b32ffd98904e68c0e088f38
SHA1484766fa41bf87d2d35f2daea1ecf55db8767060
SHA256d75c2270ef69dd736f75e0e53719974d38a7d94f31868333d1e76ac7d69bf46b
SHA5124293dade18691140ffc304a9110df284b24672f233e2431c20e85ce0e6d5a117f0b1fab336ee4d055dfeb74cf764f40b9ed4a93a592eb1897cd38ea979624b9a
-
Filesize
26KB
MD54e8f48204fef8253b1469f18c7b294aa
SHA12ae7359ec4e30a2db17b43549df93aab8d2fac85
SHA2561b11466b6126225bfe830b781f11df6d1b33ed0ef72a4ff7486a96d7719398e2
SHA512bec3c756d26b4e0d3188279777661151e5f1be3e3c43ee64d01c30450f543c6b803e1922584d5fdd1a2e865d9d14e5309fc438a25fb257fd7cd3c41833961141
-
Filesize
10KB
MD5f0216f4cb761d71e6138ec12a91fda05
SHA1df124bc52ef2074c20d6e4f66ed0da5bece418a1
SHA25614e60163c4fa62729e35223e21e8069d87c49e7c7b39494c759729954b5d3f8e
SHA5122926104498012b7db3cd673e157ebe426d837d334c597ce19dd317dbfea2898b1d8be851ddcc1fa2fe051ea0295e8af4cc8c5f220917e78ea9df28530b1e903e
-
Filesize
46KB
MD5eb5f938650308c63a3f082a5b1e3382a
SHA108ddcdf824e285921f1b43faaebc817514fc9345
SHA25672d7ce0d6e3b6ded505bdd9f279ecc3262027d40d6222fdee2749c9850f46d65
SHA51250a8859f1f3c7f71a1c03d3e547d53a189916f4574c61be834bd877f6a6f52e1e07863eab2a7a9387d1f52569eca2784de90898b3fbfdfdfab1239f3f5094961
-
Filesize
1KB
MD552dbbeb73ea1eb43eae20cce83abf9c9
SHA1945c26255dda4d4f1dc53e080bbed91484d87a9b
SHA256e613d71151b2c01b697f662e3f194bcd60265c767bef9bd49766bbd54f24b019
SHA5127cbd9a4f3cb3a70d0b487aad9043b357dfddfdc975d830d8e2bee8363a96263c885671a72adc98bf64e2627108bb47bfdb03b27003ba2b24233b41c49017c30a
-
Filesize
56KB
MD5418ae300c438817bb57aab46f9245959
SHA1814f8f0a7f212ac71197f63132814cd6e454819b
SHA2560a193525e5251c00315aa68640eec78cb49af7e97552e2eb0a1b465f2ea7eecd
SHA512bd07d12edebb9ea4f10d1986047cef92c62a662a8bd9b8c9edfdee67f00d20b0aeddfcccfed71ba29d03c45a74007cc9f75d00febaf11102dbf738b3799d2bad
-
Filesize
335B
MD5585839d66722cfd02e40cb740cccb633
SHA1374c19200fee201b26d0153487a281a934615884
SHA25686a9bb4985cca6c9636c4fd071bef4b70ba7b3a5eb51af869a1299dc2b1574a8
SHA51209bbe1bf1455861fd4732f2d1945c84bac34090906ac2fab75d144c22ffcf6bc585c8209e94a2b1919c8402df53966081a1af2993e12261ae4c4ac5568667d88
-
Filesize
498B
MD5031fd2086ef5fe0afd04051bdc7fb5b2
SHA12a00b9bd9a324e57f78ab8c8ed77b7f089740c49
SHA2567bd77e2bc9448513d3f9ab80206fddddfc033ac382b423808aa2bf3760ec60c2
SHA512d737cf284e8172f0a2f0c54d3a22568b60b908d3dd4dd13789e84af605c05250421f701169943828745a0e92e255ba2847e2797f8d8d636c9dbbad33d732cb64
-
Filesize
111B
MD51fba4ec45e457ed5ee3e4a37aa90fec4
SHA1e87996c4d91e7a466581d34c49fed34a2a3e20f8
SHA2568a64b01971984f469f21f23be7c21b2529713c1f76a626715b2efffcd12d20f6
SHA512bce1993a506247bc4c2a311521dad6b56a2a4e740fa4cb359069ad1c3ae5b6cef399014560225d38a64ea4a73469453cebbc056f40ad85ec05a56f0b39127245
-
Filesize
65B
MD59781ca003f10f8d0c9c1945b63fdca7f
SHA14156cf5dc8d71dbab734d25e5e1598b37a5456f4
SHA2563325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793
SHA51225a9877e274e0e9df29811825bd4f680fa0bf0ae6219527e4f1dcd17d0995d28b2926192d961a06ee5bef2eed73b3f38ec4ffdd0a1cda7ff2a10dc5711ffdf03
-
Filesize
111B
MD5e35f95c4e6bc3560d343f5e46ea844e4
SHA19a21914e83de1ac2b61099fb9df740b4f13107bd
SHA256c50d6a83d4677562ff626257393f99bbf9a7ecbf93f948e7e3972c6c89f8a9bc
SHA5121e9b5a3fae44b7fa053883ded32b3633951d745dce5532cb2eb6cdbd41108786ccbb670c2f36c06a07591e7ab09efc58eb32f5c9a82435ed15d2ce8207c2a175
-
Filesize
381B
MD52073e4d5dbd6c914dfaa7c44674c71b3
SHA180b997b97ad513baaa562dc7efb6020fef47abeb
SHA25634d7850fbe35d1b6e84281b2b7de65dd1ffc098d70e6cbdf27a922ad30c57b91
SHA512c0c578a2633769eb572522d98c03460909a5a752d91466730a64cd6ca632679edea07a2f5810ac9564a4bfc1c03ad2c26447956dd16d26b32c412ea841c00160
-
Filesize
32B
MD5f96373310861d8a8d00e7d6381ce9804
SHA1e77f94729b9ce37f56834793340f7849cc9f6d98
SHA256601fab484f3de11d751b401c0e8165ac14bb8ee0614926575afad440fabb07a0
SHA512667bfc074fc212a490deb4e41c698e5b92c6b1f987a973fff35a1e32d80e64f757ab4ed4fdfb175ace55fcd49c086cdf556bcef8823b08c9a4f82b3471e8e253