Analysis

  • max time kernel
    174s
  • max time network
    185s
  • platform
    android_x86
  • resource
    android-x86-arm-20240514-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
  • submitted
    21-05-2024 22:23

General

  • Target

    64fadba52c0fd81244bb48fd4c5018b4_JaffaCakes118.apk

  • Size

    20.0MB

  • MD5

    64fadba52c0fd81244bb48fd4c5018b4

  • SHA1

    57a0461b02e60ac65358aa6768747f11bb0d06f3

  • SHA256

    97d4c96aa1cdfcb073848b5a60480c1718c28426f586aa9c57382fb7f185f6c2

  • SHA512

    ad2ec2864caf83c7457f8d7fa794d73f78c9e5adc201db67fd6b558c446055d61fd005b6446f6b0699dc9abd3863f9d107dc90eac29f470d58c71139b8699e13

  • SSDEEP

    393216:bKmqaLJkg6PIXkzvoeCjgChH21GVjlcT5MHlcT5MXLhTAK+LWYIswRV5:bOa9kJ/zwfgCZXC5MFC5MX1TAfWYIP

Malware Config

Signatures

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

  • Checks memory information 2 TTPs 1 IoCs

    Checks memory information which indicate if the system is an emulator.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 3 IoCs
  • Checks if the internet connection is available 1 TTPs 3 IoCs
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
  • Reads information about phone network operator. 1 TTPs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 3 IoCs

Processes

  • com.juheps.dingding
    1⤵
    • Checks CPU information
    • Checks memory information
    • Queries information about running processes on the device
    • Queries information about the current Wi-Fi connection
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4314
  • com.juheps.dingding:pushservice
    1⤵
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4439
  • com.juheps.dingding:pushservice
    1⤵
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4591

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.juheps.dingding/databases/pushext.db-journal

    Filesize

    512B

    MD5

    a8ffe1dd56bb7cabee077647c9d735ec

    SHA1

    cf18f129e13669be6442cdec919b4ce89b54c813

    SHA256

    779de9189bd5e09b1b7f1a11253523c70e4b6f21ff0d1310eb168a0404a18a40

    SHA512

    f42098dbb953e212c565bebd61b18e5ff6237bb7eb9759c3016f7b76175b961bcc3bb597d139ba9f450f7cc4b594d7b15880b508e4bc853741c860b1dc85c503

  • /data/data/com.juheps.dingding/databases/pushext.db-shm

    Filesize

    68KB

    MD5

    ca4919c223ea2aa07ffaac391be78d69

    SHA1

    412bdf7859c6d606d52a4964e1cb4968edf69ad1

    SHA256

    0c33e9d2a7728a34e39095ee5456bfeb9fc0a4a08a3a81ecd01d51050fc57daa

    SHA512

    1e86dd45c46c8d572c13ba6f971d2cacf075eef2018ca73dd9bd3cfe33b972e9b33f8578a46a73405e4708fdc1c43f57b6ae6475d19fc988999d1c320c12153f

  • /data/data/com.juheps.dingding/databases/pushext.db-wal

    Filesize

    48KB

    MD5

    79e5b2cba6eeef46ee45a9cd6a6e2cbc

    SHA1

    0a1e34c36b412a1100df61d354092e68167b745a

    SHA256

    a289e5f36a8236db337a50dc8ce273e64841f566a6148e5f9f44e37b6cdd1443

    SHA512

    e4e9398d1239de104a3ea98a6c4e64e9dc6508cf06483929921ccdb0c82a7313813623c514501e9320c6eaa9910c9f9b6f1b1acff0d13fd4e020a371909b8505

  • /data/data/com.juheps.dingding/databases/pushg.db

    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

  • /data/data/com.juheps.dingding/databases/pushg.db-journal

    Filesize

    512B

    MD5

    8373f3455f699390437e619966067e34

    SHA1

    e5745d1568922df65a09e701d6bd7e926d12f30f

    SHA256

    3c5df4c296d549444ba2c3b61360257a3877e91cb0dcd713eb07ccb852d90724

    SHA512

    aee20eb3d7aefff8e4879b76b5f570b7efcde7f8d00e2e4a07661aae19e2ce8a89d3fe7b07380ee27d49e99f3dd867ec05f2376e26bf076bfaa403dc72fb1cfe

  • /data/data/com.juheps.dingding/databases/pushg.db-shm

    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/com.juheps.dingding/databases/pushg.db-wal

    Filesize

    56KB

    MD5

    567aeddd03750f00e5b464cd8031080e

    SHA1

    a8f0f13be669c434bb28504a7c45ef9303a61f38

    SHA256

    9c1d8b702d327d3600aaca3a973fe3087522760ecddc7aec9032ceb04add7d10

    SHA512

    ffe355eec9156ab66c66e71e420d386070c0eea88136a055f3a012397425742fe3a26f1a48575fdca48a5d576c946fb758902f32cacf6c8287b5f88e3120949b

  • /data/data/com.juheps.dingding/databases/pushsdk.db

    Filesize

    213KB

    MD5

    9b7970b5d9f04b9baab3e3dde788d254

    SHA1

    1ef976be635ba401a68e12e0fa208b19cd0b6462

    SHA256

    1d11c4a2b0300096ea8d0e2cb4d5588a4fc098bfbdb9fa1fd18dab6a9873a861

    SHA512

    a1281e57d0035fa362abae0868fd174b637a648961fc9002a4123bc6af230fe4ba6a99b81621f0b1e90707f4eb50eeca608b01080a91de5565deef1f269d48c2

  • /data/data/com.juheps.dingding/databases/pushsdk.db-wal

    Filesize

    104KB

    MD5

    f93db28b375c3fe72d0a78ea8104a14d

    SHA1

    037bc9bf83db3bc60f6328d3f7044a15495a14bd

    SHA256

    5a22d292257178ddcc59580bd6c267f6de0a32d28cd7ed20780a495204237f9b

    SHA512

    d3e304ce0dc7b02da3685322807b47c482298683f70f2126f311bddf16507e23d6492b1a5170ee40eb7dfd4de7c4204055667ddb5ce36aab6e13ed3779f0feef

  • /data/data/com.juheps.dingding/files/.imei.txt

    Filesize

    32KB

    MD5

    0bc92d6e9104826daf1da980a081dbcb

    SHA1

    fdaecc8513cb98bcca8293409e3724d9adc7ff06

    SHA256

    ae3cb091e1952ad57b9e0c5b0145f653442da302ec0f83458af46b16dbc733b7

    SHA512

    4ec6a462bd047d7e638dbe93a6353cc270df6b2d50fcabdb46e1cbbf260b3b011ce92ef93ad9f938e7f3fad2d8b7b34b0997100bd4a9f6f212d9c83463cf66e9

  • /data/data/com.juheps.dingding/files/cnc3ejE6/eje3cnc

    Filesize

    32KB

    MD5

    1c4274aa7a9a5cac8c6d1df71e4588c6

    SHA1

    abaecd685e01cc68801292e3dc7085654a22feba

    SHA256

    3f6cd5f480ae69859b7841450f3d032c528ba385ebf9f371b9c8fdc6eb4231be

    SHA512

    1adb95935798607bd36cedcd183924d3068f50097d017b278da7caee7771532b61ec3606f6189b6dec8426eb038fe40be75079ce35894b1a8e0d1d815261150c

  • /data/data/com.juheps.dingding/shared_prefs_ext/test_app

    Filesize

    52KB

    MD5

    b9e2cf5c83dfcc143f565d5d171f3dfd

    SHA1

    e1dc3722f05dd9a06ae14164eb0d7ab82bbde6e3

    SHA256

    45ade8bd0c1984fd27c05ff3c397ca0bc2eb3c3c817da88e783f6f97eecd362c

    SHA512

    ee7b9ff39b8593e029f2c5cb1bccdfa6cdc3bdff1295b3a22e6640591241d4c97eaf162cc13b7c18cfe3ccfa6530ddd8021c3c43a734134078977060435792b6

  • /storage/emulated/0/.imei.txt

    Filesize

    32B

    MD5

    c02e1ea7ca2cc151a0fc0479d0316feb

    SHA1

    81c9e0578f99ab7652922a92ee105e9531f30b10

    SHA256

    f339b00990f1db0e60b799f2431b8c504d0749b70b18c46b894f73ae3ac78bc7

    SHA512

    77382eab320f9364a050c43f3723fab408112350e326a4358f945f400b623a19403fefe4850e131ba66e0b3262529bd2045e0831122d6f73d63e7904a816cc98

  • /storage/emulated/0/libs/com.juheps.dingding.bin

    Filesize

    79B

    MD5

    2bea906c6381e792dd616cf8aab6da28

    SHA1

    11302b0c8e518670a29daaa351c38e458a00399e

    SHA256

    23ec5914ad493380516c3a1925a172177e579ec107c7e33d1853245e2b510e48

    SHA512

    b2b45017febd4782f33582c2e8934a493aecdbd0474acad47376ee2236b08a41702d04ebbb635bfef7c62dd3df952b91c44a9048166d56a44d82cf6433358061