5b0d1208bb67c2ff9a7351032ecf76e3ffb38e96c341ae01844a011515016eb4

Analysis

max time kernel
93s
max time network
130s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
20/05/2024, 12:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5f1519fd59f245f32144acec253036f3_JaffaCakes118.apk
Size

14.3MB
MD5

5f1519fd59f245f32144acec253036f3
SHA1

94797409153d3d2c8db4f04cf1d4e95083c0a1fb
SHA256

5b0d1208bb67c2ff9a7351032ecf76e3ffb38e96c341ae01844a011515016eb4
SHA512

3210d472e106bd1ee05d93bf83e17bf3f77bdd3f87207e3551e533992cb74f6597ea70350aa2e0d91ec77ae85fcbed8d474c9234f794de0a451b361f1f765bc1
SSDEEP

393216:NzYDRVx4ndOFGkncw0zfa7LAQQvkaxSMLnu8oS:VWFY8cw0zfdQQcaxSMLnuW

Score

8^/10

banker discovery evasion impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.yunmei.dkb
/sbin/su	/system/bin/sh -c type su

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.yunmei.dkb

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.yunmei.dkb

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/data/com.yunmei.dkb/mix.dex	4320	com.yunmei.dkb
/data/data/com.yunmei.dkb/mix.dex	4413	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.yunmei.dkb/mix.dex --output-vdex-fd=56 --oat-fd=57 --oat-location=/data/data/com.yunmei.dkb/oat/x86/mix.odex --compiler-filter=quicken --class-loader-context=&
/data/data/com.yunmei.dkb/mix.dex	4320	com.yunmei.dkb

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.yunmei.dkb

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.yunmei.dkb

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.yunmei.dkb

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.yunmei.dkb

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.yunmei.dkb

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Checks the presence of a debugger
evasion

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.yunmei.dkb

com.yunmei.dkb
1⤵
- Checks if the Android device is rooted.
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4320
- sh -c getprop ro.yunos.version
  2⤵
  PID:4387
- getprop ro.yunos.version
  2⤵
  PID:4387
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.yunmei.dkb/mix.dex --output-vdex-fd=56 --oat-fd=57 --oat-location=/data/data/com.yunmei.dkb/oat/x86/mix.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4413
- /system/bin/sh -c getprop ro.miui.ui.version.name
  2⤵
  PID:4639
- getprop ro.miui.ui.version.name
  2⤵
  PID:4639
- /system/bin/sh -c getprop ro.build.version.emui
  2⤵
  PID:4663
- getprop ro.build.version.emui
  2⤵
  PID:4663
- /system/bin/sh -c getprop ro.lenovo.series
  2⤵
  PID:4691
- getprop ro.lenovo.series
  2⤵
  PID:4691
- /system/bin/sh -c getprop ro.build.nubia.rom.name
  2⤵
  PID:4716
- getprop ro.build.nubia.rom.name
  2⤵
  PID:4716
- /system/bin/sh -c getprop ro.meizu.product.model
  2⤵
  PID:4741
- getprop ro.meizu.product.model
  2⤵
  PID:4741
- /system/bin/sh -c getprop ro.build.version.opporom
  2⤵
  PID:4766
- getprop ro.build.version.opporom
  2⤵
  PID:4766
- /system/bin/sh -c getprop ro.vivo.os.build.display.id
  2⤵
  PID:4790
- getprop ro.vivo.os.build.display.id
  2⤵
  PID:4790
- /system/bin/sh -c getprop ro.aa.romver
  2⤵
  PID:4814
- getprop ro.aa.romver
  2⤵
  PID:4814
- /system/bin/sh -c getprop ro.lewa.version
  2⤵
  PID:4839
- getprop ro.lewa.version
  2⤵
  PID:4839
- /system/bin/sh -c getprop ro.gn.gnromvernumber
  2⤵
  PID:4863
- getprop ro.gn.gnromvernumber
  2⤵
  PID:4863
- /system/bin/sh -c getprop ro.build.tyd.kbstyle_version
  2⤵
  PID:4888
- getprop ro.build.tyd.kbstyle_version
  2⤵
  PID:4888
- /system/bin/sh -c getprop ro.build.fingerprint
  2⤵
  PID:4912
- getprop ro.build.fingerprint
  2⤵
  PID:4912
- /system/bin/sh -c getprop ro.build.rom.id
  2⤵
  PID:4939
- getprop ro.build.rom.id
  2⤵
  PID:4939
- /system/bin/sh -c type su
  2⤵
  - Checks if the Android device is rooted.
  PID:4963

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.yunmei.dkb/databases/bugly_db_legu

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.yunmei.dkb/databases/bugly_db_legu-journal

Filesize
512B

MD5
4aab5de015720f25988fd03ad312c687

SHA1
7287c61fcec0671251be4d1ad0f64629bbdfe2c7

SHA256
d8934a6e822a2795f95ed82f8750961fc23a01495e07f1b0533b6ca142dd2094

SHA512
9b1e57eccdeab61bdc48f2d6edefc81cc745fe05c8abcf741204bb2cbdede2365e2792c26a3f2bf70ecefd14c88c393e901e414ae7a1c03160ea119e9c5dbf30

Download Submit
/data/data/com.yunmei.dkb/databases/bugly_db_legu-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.yunmei.dkb/databases/bugly_db_legu-wal

Filesize
144KB

MD5
93cd00333ede3f01987779e40ec8920e

SHA1
0238dd8052d41a047186779cd2990f2b43a3077f

SHA256
08520fee254a5c818a87336882efd78e7250b8aff25af1c30991b7533841c0ac

SHA512
9c5e638ca63f5d7db5ebf7545b88471ac666a130cc315cba8fc1c3f42ca39f9d4616e872460f235f54b07066b9da2cff8156a51427efc839ae13be7e531f8758

Download Submit
/data/data/com.yunmei.dkb/files/cnc3ejE6/eje3cnc

Filesize
335B

MD5
585839d66722cfd02e40cb740cccb633

SHA1
374c19200fee201b26d0153487a281a934615884

SHA256
86a9bb4985cca6c9636c4fd071bef4b70ba7b3a5eb51af869a1299dc2b1574a8

SHA512
09bbe1bf1455861fd4732f2d1945c84bac34090906ac2fab75d144c22ffcf6bc585c8209e94a2b1919c8402df53966081a1af2993e12261ae4c4ac5568667d88

Download Submit
/data/data/com.yunmei.dkb/files/libcuid.so

Filesize
129B

MD5
70a9b0d47050536cddab91908ed7b107

SHA1
4e0d45d53b1611051889ce9e83cd1e38cf0f16a7

SHA256
cd7ba3820353fbdc989a95fc0f1737ae39cb4211965d570393fe28b0131cf367

SHA512
ea6f8ec57a494ec4ad7d3817a365a756509d5340f8d85b43fe92a911e9d1fa6ed598d4460303ecf59f45a8e1063a1dc9605cd8e48b7d95e51af4967e376d4824

Download Submit
/data/data/com.yunmei.dkb/mix.dex

Filesize
292B

MD5
63f77f99bd2c2b772a479923bde11974

SHA1
c7632e7d301e4463fafce85f84e9c3d7da3fdbbe

SHA256
4c76a3af64cdd2f8713ffe2733dea50dbe714d0ca41c17d1847ee5b62a7ca615

SHA512
3aae4a89d1ed51fdd911cb367eb10afe3c2264e4222085891b18a60d5412f85d10bf5c8f3c6642db70abb9aa42732bac5c42c42ee32d587100f53c21b5beb16c

Download Submit
/data/data/com.yunmei.dkb/shared_prefs_ext/test_app

Filesize
29B

MD5
58b2600c86dd3c23284ed0850bbae9c0

SHA1
52549fa65df24af9b7332448a5d07df18f86eec4

SHA256
e42e74c5a2b4e1b8966370d973328e64f813c85fbeb13dbbe9dbe6d29b8a0b4b

SHA512
1d1de8c417aeb06a2f5b33c53cc8030eb49a35f4997bd8b3c5c7e3358ec96d4dd14a2d2a82467dcd94ceeb1b701b16bc878ea45f786cc367cb5f54a598295e2f

Download Submit
/storage/emulated/0/.imei.txt

Filesize
32B

MD5
d3f9dca7e6f76b4b2e7dc3b6be53b826

SHA1
6adf517a73de9f97308f94ab49786fe090d4b3a3

SHA256
703c6af50fc9607a2507b5ea889df7a0ff229483100641b91cd54c27ea85434c

SHA512
bff8efdbf8ac9f2f850d73b0619af8905424783863645e4b7b88a85dc60483c1e03a2590684ca9176f3afb2378c33e4660fe2182f4f4108ad7937693a36bdfeb

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads