Analysis
-
max time kernel
174s -
max time network
185s -
platform
android_x86 -
resource
android-x86-arm-20240514-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system -
submitted
21-05-2024 22:23
Behavioral task
behavioral1
Sample
64fadba52c0fd81244bb48fd4c5018b4_JaffaCakes118.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral2
Sample
64fadba52c0fd81244bb48fd4c5018b4_JaffaCakes118.apk
Resource
android-x64-20240514-en
Behavioral task
behavioral3
Sample
amap_resource1_0_0.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral4
Sample
amap_resource1_0_0.apk
Resource
android-x64-20240514-en
Behavioral task
behavioral5
Sample
amap_resource1_0_0.apk
Resource
android-x64-arm64-20240514-en
General
-
Target
64fadba52c0fd81244bb48fd4c5018b4_JaffaCakes118.apk
-
Size
20.0MB
-
MD5
64fadba52c0fd81244bb48fd4c5018b4
-
SHA1
57a0461b02e60ac65358aa6768747f11bb0d06f3
-
SHA256
97d4c96aa1cdfcb073848b5a60480c1718c28426f586aa9c57382fb7f185f6c2
-
SHA512
ad2ec2864caf83c7457f8d7fa794d73f78c9e5adc201db67fd6b558c446055d61fd005b6446f6b0699dc9abd3863f9d107dc90eac29f470d58c71139b8699e13
-
SSDEEP
393216:bKmqaLJkg6PIXkzvoeCjgChH21GVjlcT5MHlcT5MXLhTAK+LWYIswRV5:bOa9kJ/zwfgCZXC5MFC5MX1TAfWYIP
Malware Config
Signatures
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
description ioc Process File opened for read /proc/cpuinfo com.juheps.dingding -
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
description ioc Process File opened for read /proc/meminfo com.juheps.dingding -
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.juheps.dingding -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.juheps.dingding -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.juheps.dingding -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 3 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.juheps.dingding Framework service call android.app.IActivityManager.registerReceiver com.juheps.dingding:pushservice Framework service call android.app.IActivityManager.registerReceiver com.juheps.dingding:pushservice -
Checks if the internet connection is available 1 TTPs 3 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.juheps.dingding Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.juheps.dingding:pushservice Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.juheps.dingding:pushservice -
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 3 IoCs
description ioc Process Framework API call javax.crypto.Cipher.doFinal com.juheps.dingding:pushservice Framework API call javax.crypto.Cipher.doFinal com.juheps.dingding Framework API call javax.crypto.Cipher.doFinal com.juheps.dingding:pushservice
Processes
-
com.juheps.dingding1⤵
- Checks CPU information
- Checks memory information
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4314
-
com.juheps.dingding:pushservice1⤵
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4439
-
com.juheps.dingding:pushservice1⤵
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4591
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512B
MD5a8ffe1dd56bb7cabee077647c9d735ec
SHA1cf18f129e13669be6442cdec919b4ce89b54c813
SHA256779de9189bd5e09b1b7f1a11253523c70e4b6f21ff0d1310eb168a0404a18a40
SHA512f42098dbb953e212c565bebd61b18e5ff6237bb7eb9759c3016f7b76175b961bcc3bb597d139ba9f450f7cc4b594d7b15880b508e4bc853741c860b1dc85c503
-
Filesize
68KB
MD5ca4919c223ea2aa07ffaac391be78d69
SHA1412bdf7859c6d606d52a4964e1cb4968edf69ad1
SHA2560c33e9d2a7728a34e39095ee5456bfeb9fc0a4a08a3a81ecd01d51050fc57daa
SHA5121e86dd45c46c8d572c13ba6f971d2cacf075eef2018ca73dd9bd3cfe33b972e9b33f8578a46a73405e4708fdc1c43f57b6ae6475d19fc988999d1c320c12153f
-
Filesize
48KB
MD579e5b2cba6eeef46ee45a9cd6a6e2cbc
SHA10a1e34c36b412a1100df61d354092e68167b745a
SHA256a289e5f36a8236db337a50dc8ce273e64841f566a6148e5f9f44e37b6cdd1443
SHA512e4e9398d1239de104a3ea98a6c4e64e9dc6508cf06483929921ccdb0c82a7313813623c514501e9320c6eaa9910c9f9b6f1b1acff0d13fd4e020a371909b8505
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD58373f3455f699390437e619966067e34
SHA1e5745d1568922df65a09e701d6bd7e926d12f30f
SHA2563c5df4c296d549444ba2c3b61360257a3877e91cb0dcd713eb07ccb852d90724
SHA512aee20eb3d7aefff8e4879b76b5f570b7efcde7f8d00e2e4a07661aae19e2ce8a89d3fe7b07380ee27d49e99f3dd867ec05f2376e26bf076bfaa403dc72fb1cfe
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
56KB
MD5567aeddd03750f00e5b464cd8031080e
SHA1a8f0f13be669c434bb28504a7c45ef9303a61f38
SHA2569c1d8b702d327d3600aaca3a973fe3087522760ecddc7aec9032ceb04add7d10
SHA512ffe355eec9156ab66c66e71e420d386070c0eea88136a055f3a012397425742fe3a26f1a48575fdca48a5d576c946fb758902f32cacf6c8287b5f88e3120949b
-
Filesize
213KB
MD59b7970b5d9f04b9baab3e3dde788d254
SHA11ef976be635ba401a68e12e0fa208b19cd0b6462
SHA2561d11c4a2b0300096ea8d0e2cb4d5588a4fc098bfbdb9fa1fd18dab6a9873a861
SHA512a1281e57d0035fa362abae0868fd174b637a648961fc9002a4123bc6af230fe4ba6a99b81621f0b1e90707f4eb50eeca608b01080a91de5565deef1f269d48c2
-
Filesize
104KB
MD5f93db28b375c3fe72d0a78ea8104a14d
SHA1037bc9bf83db3bc60f6328d3f7044a15495a14bd
SHA2565a22d292257178ddcc59580bd6c267f6de0a32d28cd7ed20780a495204237f9b
SHA512d3e304ce0dc7b02da3685322807b47c482298683f70f2126f311bddf16507e23d6492b1a5170ee40eb7dfd4de7c4204055667ddb5ce36aab6e13ed3779f0feef
-
Filesize
32KB
MD50bc92d6e9104826daf1da980a081dbcb
SHA1fdaecc8513cb98bcca8293409e3724d9adc7ff06
SHA256ae3cb091e1952ad57b9e0c5b0145f653442da302ec0f83458af46b16dbc733b7
SHA5124ec6a462bd047d7e638dbe93a6353cc270df6b2d50fcabdb46e1cbbf260b3b011ce92ef93ad9f938e7f3fad2d8b7b34b0997100bd4a9f6f212d9c83463cf66e9
-
Filesize
32KB
MD51c4274aa7a9a5cac8c6d1df71e4588c6
SHA1abaecd685e01cc68801292e3dc7085654a22feba
SHA2563f6cd5f480ae69859b7841450f3d032c528ba385ebf9f371b9c8fdc6eb4231be
SHA5121adb95935798607bd36cedcd183924d3068f50097d017b278da7caee7771532b61ec3606f6189b6dec8426eb038fe40be75079ce35894b1a8e0d1d815261150c
-
Filesize
52KB
MD5b9e2cf5c83dfcc143f565d5d171f3dfd
SHA1e1dc3722f05dd9a06ae14164eb0d7ab82bbde6e3
SHA25645ade8bd0c1984fd27c05ff3c397ca0bc2eb3c3c817da88e783f6f97eecd362c
SHA512ee7b9ff39b8593e029f2c5cb1bccdfa6cdc3bdff1295b3a22e6640591241d4c97eaf162cc13b7c18cfe3ccfa6530ddd8021c3c43a734134078977060435792b6
-
Filesize
32B
MD5c02e1ea7ca2cc151a0fc0479d0316feb
SHA181c9e0578f99ab7652922a92ee105e9531f30b10
SHA256f339b00990f1db0e60b799f2431b8c504d0749b70b18c46b894f73ae3ac78bc7
SHA51277382eab320f9364a050c43f3723fab408112350e326a4358f945f400b623a19403fefe4850e131ba66e0b3262529bd2045e0831122d6f73d63e7904a816cc98
-
Filesize
79B
MD52bea906c6381e792dd616cf8aab6da28
SHA111302b0c8e518670a29daaa351c38e458a00399e
SHA25623ec5914ad493380516c3a1925a172177e579ec107c7e33d1853245e2b510e48
SHA512b2b45017febd4782f33582c2e8934a493aecdbd0474acad47376ee2236b08a41702d04ebbb635bfef7c62dd3df952b91c44a9048166d56a44d82cf6433358061