Overview
overview
10Static
static
105e5fba142b...18.apk
android-9-x86
8CommonPlugin-4.1.apk
android-9-x86
1CommonPlugin-4.1.apk
android-10-x64
1CommonPlugin-4.1.apk
android-11-x64
1FrameworkP....2.apk
android-9-x86
1FrameworkP....2.apk
android-10-x64
1FrameworkP....2.apk
android-11-x64
1LoopImageP....4.apk
android-9-x86
1LoopImageP....4.apk
android-10-x64
1LoopImageP....4.apk
android-11-x64
1WelcomePlugin-2.7.apk
android-9-x86
1WelcomePlugin-2.7.apk
android-10-x64
1WelcomePlugin-2.7.apk
android-11-x64
1Analysis
-
max time kernel
9s -
max time network
160s -
platform
android_x86 -
resource
android-x86-arm-20240514-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system -
submitted
20-05-2024 09:34
Behavioral task
behavioral1
Sample
5e5fba142b81f9a6bd10404ffcfd023e_JaffaCakes118.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral2
Sample
CommonPlugin-4.1.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral3
Sample
CommonPlugin-4.1.apk
Resource
android-x64-20240514-en
Behavioral task
behavioral4
Sample
CommonPlugin-4.1.apk
Resource
android-x64-arm64-20240514-en
Behavioral task
behavioral5
Sample
FrameworkPlugin-3.2.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral6
Sample
FrameworkPlugin-3.2.apk
Resource
android-x64-20240514-en
Behavioral task
behavioral7
Sample
FrameworkPlugin-3.2.apk
Resource
android-x64-arm64-20240514-en
Behavioral task
behavioral8
Sample
LoopImagePlugin-2.4.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral9
Sample
LoopImagePlugin-2.4.apk
Resource
android-x64-20240514-en
Behavioral task
behavioral10
Sample
LoopImagePlugin-2.4.apk
Resource
android-x64-arm64-20240514-en
Behavioral task
behavioral11
Sample
WelcomePlugin-2.7.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral12
Sample
WelcomePlugin-2.7.apk
Resource
android-x64-20240514-en
Behavioral task
behavioral13
Sample
WelcomePlugin-2.7.apk
Resource
android-x64-arm64-20240514-en
General
-
Target
5e5fba142b81f9a6bd10404ffcfd023e_JaffaCakes118.apk
-
Size
24.5MB
-
MD5
5e5fba142b81f9a6bd10404ffcfd023e
-
SHA1
cea2d35031731b97c4f9549bdb4c101eb40f2d5c
-
SHA256
00c1851b4d6be5c70241c9c0268e1a623ab9ccd5913399a870a6c64bb65f608e
-
SHA512
94613301ce630ca7bc8994e40a57efb4a7928f20dc45701ee2756f2ef5ba4eea0dfe55c94826974dfbc30988067ed1b64bc70c4f5d299b80b268befd8580082a
-
SSDEEP
786432:sJuvJLqZvnOt1PaqJOrDFGPKbHMhWbv9Be/E9lJFX4cws/xSO7HGZpug6f/Mhz+G:vvJLqFEerUqmju//e7
Malware Config
Signatures
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Checks CPU information 2 TTPs 2 IoCs
Checks CPU information which indicate if the system is an emulator.
description ioc Process File opened for read /proc/cpuinfo fm.xiami.main:pushservice File opened for read /proc/cpuinfo fm.xiami.main -
Checks memory information 2 TTPs 2 IoCs
Checks memory information which indicate if the system is an emulator.
description ioc Process File opened for read /proc/meminfo fm.xiami.main File opened for read /proc/meminfo fm.xiami.main:pushservice -
Queries information about running processes on the device 1 TTPs 2 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses fm.xiami.main Framework service call android.app.IActivityManager.getRunningAppProcesses fm.xiami.main:pushservice -
Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo fm.xiami.main Framework service call android.net.wifi.IWifiManager.getConnectionInfo fm.xiami.main:pushservice -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver fm.xiami.main Framework service call android.app.IActivityManager.registerReceiver fm.xiami.main:pushservice -
Checks if the internet connection is available 1 TTPs 2 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo fm.xiami.main Framework service call android.net.IConnectivityManager.getActiveNetworkInfo fm.xiami.main:pushservice -
Reads information about phone network operator. 1 TTPs
Processes
-
fm.xiami.main1⤵
- Checks CPU information
- Checks memory information
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:4335
-
fm.xiami.main:pushservice1⤵
- Checks CPU information
- Checks memory information
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:4449
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
539KB
MD5eb913b5d92b796eb399b125ae87548cf
SHA1dfb945d92b1311086f9b8edce92687cf694c0252
SHA256d6eb1e7a24c2a9f893cfdf6d863498027b936bcb0f12edc2575031ee003e63cf
SHA512bf9e1464d8e1e5fecdd2775e6b8956384ee7d3d7aa62d0f4515b345208d5279b51ba1c2c7108c4807b7b42624410b4b24eb1de6381c302ae4fd9f05b979548a7
-
Filesize
20KB
MD5afb0fe03dd3c6285f687bd8eeac67bc9
SHA1a4835ac3a1378963f9b8b9f477ef9c5d9e53c47d
SHA256b76f6f58bcfbe88904beb38e06d4dead94fb5be46397d82d0e9c7fc8b5ed23a0
SHA512d2adb89b9dcc26873b40632ac0958d175dbee030bda357f32da06954b8e7183dc2186242a3f4c03f1325b860c859f19b846c0c31ccba7e1817b1d4a9b85de849
-
Filesize
512B
MD532f5a9440d7d31391ca8141f36599552
SHA1218f0df27dff1d5704d677c9f4dbd82d3ce72a6e
SHA2566f81fb33ddc2f816e5049a99d4a4ffb9f40bdaa80bb3bbb0fd3c7ee9078721a2
SHA512d8811db7a4bd552a23ff043f117a65cf451c45fb0cdfa1bac6362f84754d6501198838d45edf7118fdb4dd1c384d1b30ed596bb30b1e9359f89b9e2ac7678180
-
Filesize
28KB
MD5cf845a781c107ec1346e849c9dd1b7e8
SHA1b44ccc7f7d519352422e59ee8b0bdbac881768a7
SHA25618619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
SHA5124802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
-
Filesize
32KB
MD58c1836c3302e0070b411d46ef13a5b83
SHA1c91e403a3fdd593964cfb50470ade99a637a5826
SHA256a73a5790642c7e8ca9be9b569cb8e875b135e31093560fa3b7221061a0905e77
SHA512e1ac21e9f27cf863a3443e554a254164c6ffbd7c6803ba66561cc77b1e088b6c7c1f236d9725561135f440ae0352ac9fb584cbf1e10265eaf3fdd847412b609c
-
Filesize
93KB
MD50a21f11e7873c000cd3d984fabfb24f9
SHA1b48d9555abb23635993539bb0dc3cf8740dd6f21
SHA25637a578616e6eb5e50bf17b95599b177bb5de0728bad87b7bdc996abe965ac9b3
SHA51222b9f0cc34ff0fcb47a322718f2afc6de41d796ed09546edf8cfebbcb6d08f127d5c5165f8bea6631475dcedca1dd2cc20a7faea030bc06b7f90373b1f2e351b
-
Filesize
1024B
MD5c99d70f662dd0938b3df317e8b6834a8
SHA15f13be92862aa0cc9c2d1e44e1454fd1bf903e1f
SHA25617cc759ab10bef7e5f8a6eeb029d4fdd1b8016617ef847fbb1b12e538287dc3d
SHA512f5458b3c168545b3264b2dd8b446f8f5aa217e977fd96378f23c8ecc8a51a43b23430a089b6707496e0f73b7362481e6d60972164bc2233dda948f687e3ecb61
-
Filesize
94KB
MD593cfd529da3ac31d41bf57e4fe01100d
SHA1064d2358587938bebd5a361efb565d6d75f9311d
SHA256df9a7d2b2b9a852e2f33b2ec5c6f598a397fc3c3212b62b9981d950819b39cbc
SHA51228365e924302c646eddc226770f318be385d9a7bf3b48ab9b8b17d367a808930e4b584c501cebdbdaa0f1dca875ae1c36fa4fe6175d95e8228abb5c8ff76d2e4
-
Filesize
1KB
MD523fac34d2dc851338aecadb9539e96fe
SHA15690253b466bee26751674e4ab064bc359e1adc5
SHA2560462c82fbe414199d73d5a175f96410d4d156fa638870b7f4e699d568e56013e
SHA5127c64ebe15238b6129b7bb1904d84ad1929315257c7cba8d9ff18ebd3d6c8e0ce098a961c9708a86215425bd769875ab687f0ce5ea1595c3a09802b718a317b97
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
5KB
MD597d9887361491afe8696a12b6785b71b
SHA17f7977a64b2df4931d7e06571ce1fae177e7be57
SHA2569d039e99f9ee276e090dd73e7dcef8759d682d40ed67ec7753169608a9e14fa7
SHA512ef87e9a4d0ed3e99c4509e29f5c0afdb91bacd95c0754fc888a7bf90fba3098a7f9758c52ffc4d1a1d49687525ce91c551b4b275a029957b396e4eb88c6b9b18
-
Filesize
1KB
MD5d1f01be8ab968df493fdffd6d5d6eae1
SHA101cabbfdadace20496fcba409330d48814f18afd
SHA2568736e8ec52f87dda6b81c602ab949ef1a25f7d6287b6c56369981d25f925aae6
SHA51232e8402a9a88ea9402ba17226c0ec865276286493c6f4cff05013374a49a2cea835d7a94a66dfb7fc58a52597b510007973a1ea697903e913fa080bd8106ba9f
-
Filesize
15KB
MD50f11367fac4a6b0f4e365d6172fd61bf
SHA10f0b58749d90e29916aa8a6af7ef7e286b7ae64d
SHA256c84b80450f732a794ac242a056533af7f4c865266354ab469a688117d23bbd03
SHA512f39ab5cc23c4fc8d341a4df4e9ba9461a10484dbf8bcbed214e9538f9063ed91fce4e3aeb32d316b13dcea0df608dcca84300b0d61441347ca6dcd6cd88a8f45
-
Filesize
167B
MD53e3360cd4eed9551e897d9ed8162720b
SHA1940e3810cdab62845973330e154e26320ccaccea
SHA256ebbabc90377a7584ca9540abb73cdf5e1cfa28308455db6b33a11ddd68ab6fef
SHA512f236bf5bfc3d3ae805e56898f3ba8ecb5f01d1a8d8bed555939a1dc9531cdf57cd1e21bf5bd837764ea84c3a49619e8a534d54dbb3a0adebdb7f0c554401e2a7
-
Filesize
167B
MD57a6d6e53e8ea8048f945560b1543b7cc
SHA1cc14ae9be43fd515661b9f25c89697a5307779f8
SHA25646025e85d35923ed713f6deea429e7690e17c10e756f99a4fbf8cc356731d974
SHA5121c962259fb95539c7455bded57ce1e8f461d851514544f72089d75af76b518b6fdd537968f3d7ba1c5d59caedf2fdc9c186aa562e254b289cb3044e79b10e99a
-
Filesize
111B
MD5a35e58c5128a2f9dc00a3424e141b324
SHA18bb932f84ee8da148063ed2029e32490f184fed2
SHA25601708fd6137cd12c330cd4d11413cc1ea505b2e0b752e32d18180634113787f9
SHA512e002f2c15fd05c37280d7f6382df54cceb1bc4089733c7f2cdd4f56ba3281b15ea8a6de0351862d8c49abab734908eb12f14024ab2d2d7b596edbc24b1b53777
-
Filesize
111B
MD5cf3ed7c185a887daa41659d616f29050
SHA1449018464e61697a32e0ef25cfd9883b3d65ca10
SHA2569d00945452b48b1c3cc5ad62db9b244ac258427c44f7fef3a4a97a1c99a58886
SHA5122276395d887fb588ca041ca810761bb6a229437f2e0c56d86d02a7cf962ed45cad40900256f82c8bbf3e59396e66b3e0acdcb6e811360279839635ca2812ed68