Analysis

  • max time kernel
    179s
  • max time network
    181s
  • platform
    android_x64
  • resource
    android-x64-20240514-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
  • submitted
    20-05-2024 22:41

General

  • Target

    612bbfbfe1acc6b3a4c94bd322929c09_JaffaCakes118.apk

  • Size

    1.3MB

  • MD5

    612bbfbfe1acc6b3a4c94bd322929c09

  • SHA1

    74d21ddc51cb37346f67009ec9f95c3cb7b5d380

  • SHA256

    477d5262ee3a49ffcb3585602d188f7069f66dd8cf4a06e89e36c96482a53f33

  • SHA512

    bcf57c0f213755780ffb6c20d69c30088f7eb538a87aa91764096fde74fdde4ffc43e880e89a036eee2c5b9726b0ee318ae854261dc586f7d40ca0e32af18282

  • SSDEEP

    24576:ssQXoL0otaYtXMKCnEOn8wB7PvQGjXo+Fgjh8bq/13tdHbZKm51Ob83k:soQ7YtBCnEQfB7PvQGjrGjh8bq/1XHNS

Malware Config

Signatures

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Removes its main activity from the application launcher 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries account information for other applications stored on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect account information stored on the device.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Checks if the internet connection is available 1 TTPs 1 IoCs
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
  • Reads information about phone network operator. 1 TTPs

Processes

  • com.cwut.bpbp.pvmx
    1⤵
    • Removes its main activity from the application launcher
    • Checks CPU information
    • Loads dropped Dex/Jar
    • Queries account information for other applications stored on the device
    • Queries information about running processes on the device
    • Queries information about the current Wi-Fi connection
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    PID:5108
  • com.cwut.bpbp.pvmx:daemon
    1⤵
    • Loads dropped Dex/Jar
    PID:5196

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.cwut.bpbp.pvmx/app_mjf/ddz.jar

    Filesize

    105KB

    MD5

    23ba0b249042b7ba33e92c0199b0ea4a

    SHA1

    99b13ee9f7307316c2337953fceed87e9942b794

    SHA256

    1ed0751a141b17c80a921f5e8ba90c66a56b8e73156f5cbe133b57d550ca4ef2

    SHA512

    0cc88e2b7c2ffa4db274d690e3bf12098ec804b9fcd9e92b57d2fa0c4161031d2e84c91d86ba8e2b6e8b4837852defa099333f76bcd454c67b31632d0cdd4861

  • /data/data/com.cwut.bpbp.pvmx/app_mjf/oat/dz.jar.cur.prof

    Filesize

    724B

    MD5

    df1ff980a354417d0c471130c49de84a

    SHA1

    ec6f5a0c8501b74abb9b35ee5e72cc245be59a6f

    SHA256

    8628b7439382f5cf1d2ffc743a19cfb34ab6444186c21755c919b23586967cad

    SHA512

    4b1761a91eb352dcafad7e33405e9416028ad859e975a16d8a72cda68e9f6a10ba09de0e77e9a6d7518dc747d33546d31f9aa63803b319676bf0fa092e19e889

  • /data/data/com.cwut.bpbp.pvmx/app_mjf/tdz.jar

    Filesize

    105KB

    MD5

    293ea5f01e27975bed5179ba79d80eac

    SHA1

    c5b0806a537fd1cb753e11f1a9684933317716b8

    SHA256

    8d86de68978e859c8262c0d0e932d3a1d57457b57ce88940620befab1bcead5b

    SHA512

    c7cd2881367fdf95ec4151449b359decdae1adf136388edbaaa9880c7ebd14fb3579e7a15600a856988c55d207f7ba1fd7d938f4d9168aba8a7ff1c3029d6b53

  • /data/data/com.cwut.bpbp.pvmx/databases/lezzd

    Filesize

    28KB

    MD5

    dae68dcffc3d522a79f98ebbc3b6d457

    SHA1

    6df5dce9a50f12044a2d20b8d1742ae47b82ee03

    SHA256

    56cf91ca198812e0ef9ba4af0e96c08a32e24c917bcf2250bdebdfd7fd6f5286

    SHA512

    23b76f988399e9c9e4f5a7e8d19ecb765abdb115b0beee35f8ca9d221bbc5ee79f0152fac4261cc91eb9e7f874b5c6e9bff2dbb1812d31412d506cf83c16adcd

  • /data/data/com.cwut.bpbp.pvmx/databases/lezzd-journal

    Filesize

    8KB

    MD5

    31c8cb3ce6a07a3e2d9b5a58b91eec56

    SHA1

    cb219f0a331235c342c4b0a1857d5b537841aa47

    SHA256

    bd996d6c369671982c9853a6bdb5d9e19a1ffdb5b031df7af3adaf4eb6c1800c

    SHA512

    1ffaf90d396efe97b6c4bf788c2c71b7915dac6f47a39c91afe61e7885fdb847e0561f85800011c65c780b801a82a1e05657e44e5fd230b82dc429c6188ec87c

  • /data/data/com.cwut.bpbp.pvmx/databases/lezzd-journal

    Filesize

    512B

    MD5

    43b42c18318f8aff5cabf30250456f52

    SHA1

    3eec7ba686c5df9fb6ee03ef71a68a08276c53dc

    SHA256

    ce9f7fb96cb1654aa30d6dfcf682d88de79a930808e1684d4057e569a573c757

    SHA512

    9784bb23cd4ce70fdb20b776f8763bd175837899547f4f350a4fda79d0dfc8b10d2e1e648c19b3653aec17de2adb0cda0dd25567c93328495d1d7b4942f7a591

  • /data/data/com.cwut.bpbp.pvmx/databases/lezzd-journal

    Filesize

    8KB

    MD5

    322432635247e6e5d35505283ece1b1b

    SHA1

    c80042ef9e8306f9b0d60b8585851a35c9718516

    SHA256

    e065980b5fd603edc14a10b1431f222ebcaffcb75fe1a294e8dc48c41e19abc1

    SHA512

    5ee5826a906e5d8cca1645f644425eaaf980a999982775e5ba0e77a8b09802c158f7055b9357a92fed8da712b3bc9cd9d77e005e61eb7c835b75d331b43c5153

  • /data/data/com.cwut.bpbp.pvmx/databases/lezzd-journal

    Filesize

    4KB

    MD5

    0e973db48a374961d1ae130e75fe9163

    SHA1

    fb8908b1f1e7af333b5fb7cda6a485d756dd381c

    SHA256

    430b735b3aae6e9b2acff84c82893ea79d7a398abe60ee79029d7b90165987d9

    SHA512

    3b90d6d44a7be248d7962f7a2bd7a4268ccc351795973634e07da33e568f3631c46718c71624985d53b3b035111c32ff6101bc21cf0c3d8e6e867ce8e47d6fce

  • /data/data/com.cwut.bpbp.pvmx/databases/lezzd-journal

    Filesize

    8KB

    MD5

    f1b91faeead131668f25f02fe69aaa5f

    SHA1

    aad96cdacc63635c3db2fba380d50b558638fb2c

    SHA256

    96102d63e087889bb9c35171300caba1c843bf20ab0fdc44e6b91af19c0bc4b3

    SHA512

    3d21c3d82131a1da1a40e9d29fd8dfb0837876979598722faf222f3fa3fbd50b1b82eeb93a43bfaf015f2cc2f60414a9b54e5f63eab9b3ebf89f71c40adcd341

  • /data/data/com.cwut.bpbp.pvmx/databases/lezzd-journal

    Filesize

    8KB

    MD5

    627f5ac36365b2e7afa0c551791d504d

    SHA1

    625a6de923d30bfc6cffc33a08a11fc59f14291b

    SHA256

    a98218891458f24f6664544a805d962c3036601f510137eda0d611506cbef66d

    SHA512

    14888472d8ea8fb103df1ceef092bd3c54da12863e9c863c52d1ea0a9c9bc4c2c35a0afc3bd1c046ab8fd51cc55c34bc0d7824400747bc1ca8a21401040ee105

  • /data/data/com.cwut.bpbp.pvmx/files/.imprint

    Filesize

    945B

    MD5

    9cfa130ffc5e58261efbbb72d30f7ae9

    SHA1

    fbb95672f2d21a5bae5192d09def44193e979d08

    SHA256

    899bde61deb1cc6db85121862c995d343bd6ab9649d9402f9bdc88387a4bf373

    SHA512

    135cbaf3a0b05e6ecd15dfdcea5b48b01c7904d798f895fca8f316ca15a242f0c188d168eac617b5ca58523f7a0f2293d070515bfedb77ac1c7d57407d057439

  • /data/data/com.cwut.bpbp.pvmx/files/.um/um_cache_1716245100101.env

    Filesize

    1KB

    MD5

    4a0c798cb71e814eb2acb7ad078a13ca

    SHA1

    5568a50ad49e33b29621c3aa72ff844fadb2e563

    SHA256

    e99cedbdc20e4cddbd797fbe41bcc537c2f95f0108f41678ef959a261d230729

    SHA512

    40bbceffda73b17e8491a8c75dea6ef11b7027f95674f48893482bad5b10bcd419dc6b19de06559268c238fb6099dcf4fb0f480e4819e48bbc62b3d7b098de3a

  • /data/data/com.cwut.bpbp.pvmx/files/.umeng/exchangeIdentity.json

    Filesize

    162B

    MD5

    2bf7aa8877499a3dd964ab00f33087ad

    SHA1

    079ff0a9af06979a8607be54fb2379754cb41a44

    SHA256

    f5167b2ae8e087235c3800f030b54cf9c5b267b67f11e1fc39b4d259b4ad4f5e

    SHA512

    1e31c0f907cd2193201b4484f673e7cdd5956603154adf5acb9ee5aa220ce27d0b65c4e53b1680411ff4afe0ebbe86eb19534213f06dd22b05af515f9ffd89f4

  • /data/data/com.cwut.bpbp.pvmx/files/.umeng/exchangeIdentity.json

    Filesize

    204B

    MD5

    a70c1a6acf22b4abac7d5733c48eae4a

    SHA1

    d031b7d780046e91b94ad15db201b99a612670c4

    SHA256

    9cc047f6596465c457b4d80a26ff87fb25d9008118cbe104041f2fff71c68984

    SHA512

    f923d5c87ddbc5bdf3877dc8271d9eea4d423cdafd1cf3f5c8704aa3ffed2baed9eae3e2ece2f79efade0ed99b5efd79b9353899d2c915a63645922cb55e03b1

  • /data/data/com.cwut.bpbp.pvmx/files/umeng_it.cache

    Filesize

    352B

    MD5

    957d07a64f499d29052adbba16b732bb

    SHA1

    2d2c83043816627461ca662df4fe4be9c374565e

    SHA256

    3126db9a632f03c48854ce961acca6a5f186c5d80c8e5cbc0fdd2e43311a99a6

    SHA512

    c2becab4dabaeafa24db3de0ec0e4b4c8c560761fe934024d4d8293424e06a15b1b5eef7c0547a7721fd06f3e304009b80697e5999b5338f2d4fe02f863f07af

  • /data/data/com.cwut.bpbp.pvmx/files/umeng_it.cache

    Filesize

    179B

    MD5

    f7087e9223ca04419d0091e2f883eccc

    SHA1

    3fcf26254e4540408a40d585d245e878738a69cb

    SHA256

    91ce18fbdc43c48cd955c5af811131edc3b495c228de08741acbb898593f8bfa

    SHA512

    352cb930afdbd64bac0b270ae6e98d793f086fa85e40ade055a16129d4addf3ebad7abfd0c070604359fd3ec1282879b0b28b9257fe217665a2b8eb72a29dcd4

  • /data/user/0/com.cwut.bpbp.pvmx/app_mjf/dz.jar

    Filesize

    248KB

    MD5

    a54a18b58c6720991c021f433dfb2a46

    SHA1

    d2ffa07919f92b6e04914e39843f08fdb2a75b68

    SHA256

    3dd88e4418bd4271af728fc6436c873a55e6b6f5c8ed241ee2cb0ee24fe3f7f3

    SHA512

    e4a51b2462b247b1e5fbd947d06a2eba334f18398daadacbabcb4185f4255f05c22d656a8837a6088ffbdcaedfbdfbd8281c5dad4880c4e5021571e3fefc88cc