b021a76caa38f15d796bc242a19dd7f536c575859e9d46150531c5e59a1f4c59

Analysis

max time kernel
11s
max time network
149s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
21/05/2024, 03:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
61e9c8982b95219c7a044cc1f05cfa68_JaffaCakes118.apk
Size 31.2MB
Sample240521-d8frhagg2w
SHA256 b021a76caa38f15d796bc242a19dd7f536c575859e9d46150531c5e59a1f4c59
MD5 61e9c8982b95219c7a044cc1f05cfa68
SHA1 ad3b049bbdaa345be628c0065769c71aa79185c0
SHA512 387fa10e831c25e88cb74a02e443764c77b6fe18ea09d939ee1caf8e4d107efc69ba7324bf7489d49675b87bedaf6d9965b708688c37c47cb7ba46b6c2286dda
SSDEEP 786432:wlI67O6gNSmRWzZ9boyNIdX9ns/0sQ5uxVhdvZIws:wCp69gWd1x+tscAJDIP
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.futurefleet.pandabus.ui

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.futurefleet.pandabus.ui

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/data/com.futurefleet.pandabus.ui/mix.dex	5139	com.futurefleet.pandabus.ui
/data/data/com.futurefleet.pandabus.ui/mix.dex	5139	com.futurefleet.pandabus.ui

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.futurefleet.pandabus.ui

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

com.futurefleet.pandabus.ui
1⤵
- Checks if the Android device is rooted.
- Checks memory information
- Loads dropped Dex/Jar
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:5139

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rqd_record.eup

Path /data/data/com.futurefleet.pandabus.ui/app_bugly/rqd_record.eup
Size 376B
SHA256 b2c71ce6be3f627402f574a118a29a85fbe0054ddd1d9eff5fe95bdf87a8abb8
MD5 3f33a1464ae8f48a45321b414ba06536
SHA1 1d10d99c6ce37d7a34eeb5cd25aa0cb1bf46046f
SHA512 fda2c239ef09e742f9cc3c867e083ac9eccc4b9d2ce499fde5cf1f064d28961355902784f5081e1f019027aa4b1f22fe072b41bad2cf8ace7e4d98f127125626
MD5 SHA1 SHA512

Submit Download

rqd_record.eup

Path /data/data/com.futurefleet.pandabus.ui/app_bugly/rqd_record.eup
Size 1KB
SHA256 dda6f3955736be228a7af3dff3971703d8f45c29a90f7f0c3a9d6528896a07b6
MD5 aaa249751953344fb37e644e5fb8164d
SHA1 05bb19479a0478d5bedc432ed5ab3615a15ed327
SHA512 18562e3e96ae0433612aadb89172dfd44d1d41f18f2c37b5f534cc2f3d251195824b30c9a327d3c46cad3bf18eeb4be3703606e86bc9bcee163c16e6235cfc5d
MD5 SHA1 SHA512

Submit Download

tomb_1716262855625.txt

Path /data/data/com.futurefleet.pandabus.ui/app_bugly/tomb_1716262855625.txt
Size 19KB
SHA256 1ae20eda2bd04f31c8e471fb33d04b75988832e1d5e66aad5e09e1186cba15b7
MD5 da42ef0e91390f86696f5a52ce960d0b
SHA1 d0e5d54cba263d332176f5bf7c20c3833778037d
SHA512 340912263f5fdfdddb5166ba3c512b30961ac13defaab54ba6fedef2aa0066de9fea9d4eb3c0d64219ccf962b83b75d42a0a23879cfd42ab8cd1c9d4becfd225
SSDEEP 192:Kt+jITSx1jEHZT1AMcFuARp/lCoW16l28fqkeZt6/N5:1Dx4dcFua1llzkt6T
MD5 SHA1 SHA512 SSDEEP

Submit Download

tomb.zip

Path /data/data/com.futurefleet.pandabus.ui/cache/tomb.zip
Size 4KB
SHA256 12f0165e0ea260719dca893e48920a672c345410d547859c06ba0d05a14d58c1
MD5 8084a40035dccc5bf3bcfd73b63405bd
SHA1 9ed5cbcdaff989507195d8d73290187007c34821
SHA512 2ccf3f40be53bd26fb9f01e5d242a553de50fc96a9beee36359bbd2675c925f46afe08e4650ceaa9b228859365649115fc28874980260344424374d7677f9097
SSDEEP 96:AH3IDc9G5QZNZEVHH6P3zsD3CoYpr4aj/rxeJB+RH8L9++QYBkSi:iIAU5BV6vzcIrXu+W5++vBkSi
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu

Path /data/data/com.futurefleet.pandabus.ui/databases/bugly_db_legu
Size 132KB
SHA256 74912060fe97cf354d7d5b80474922a415020f3d3e351e2e123b8b11aba3a143
MD5 4bc58c677ff73ba48c1cc90917093b18
SHA1 237e16024eee2fd8cd1698bca3769bb6b99669ac
SHA512 1eaeb3f8ae917ff73fb2e97231e2b0aade92958bcb9eb469f89b1d6651b39b565a2d694df9ba9cff4b339fb587e3d3cd680b4aeec59962fc77d886d62d8ea2aa
SSDEEP 768:i+PpcgQAemPA1oV4kgfOjw62odrjwYtn1DRAjwx27AxTqy9ZQF9pilizERy7YIq5:iA8w/vf
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/data/com.futurefleet.pandabus.ui/databases/bugly_db_legu-journal
Size 12KB
SHA256 9bc65ef9829381a9d1e6ef4c8a09f5e8d0a09e9f4ee5b83a609c5ecd86c6ea26
MD5 e0b12f57b7497a4eef16099a7e71b6ee
SHA1 3acb466c620d06502ce0ad5b50f964d301ae5589
SHA512 5216988e32243444da65b1f6a34fd0c0594248618a56f8447c5df197329a388bba264fa65bf64d09dd7fed6c3f9832b29c6526a8c6dc717c16e34311704a9d53
SSDEEP 96:7Ht4m70aaS9SGZEvfZdZnZ93tu2tES8MtdGX7yw:7Ham/YoozZ93Tk0cryw
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/data/com.futurefleet.pandabus.ui/databases/bugly_db_legu-journal
Size 512B
SHA256 d5c445d63bf15f1fdf06a884d022ec668f888e5d8608661aa48449752ce851fa
MD5 599d98b731270f8fe6911bbc89f55972
SHA1 7233605b55b3f6c33b2973f15e50496628643f08
SHA512 93779f79133999961879c2242195c8b191f0064c5405746cabaa7da9b575c8d7c122f08807b502dd40847ba7af40686b720670f69765d317ee5938bf08ea9005
MD5 SHA1 SHA512

Submit Download

bugly_db_legu-journal

Path /data/data/com.futurefleet.pandabus.ui/databases/bugly_db_legu-journal
Size 8KB
SHA256 ef0df46447c7c00e22586abb9f14e8ff5a786632b8df0b42a5142c33aa3d2ba4
MD5 193d2e606c01a99919bfbd05a9bbad22
SHA1 4117a38dc4d177ec61c4a90b7d81cdc066c7b2e6
SHA512 a8fd2fc1f0821e915a284626fb795fdeaeb421dc9df5df914909f2ce4c5c8d7531ebd32ab0f0a75ef4603df1bc7e231b19b4a79700d73b2f216afa48b7b47733
SSDEEP 6:7+/l9vHn1U+2vg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuK9:7+tpivqLiuWdwRmBEyPby
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/data/com.futurefleet.pandabus.ui/databases/bugly_db_legu-journal
Size 8KB
SHA256 8bed976d454021e96c44873c62cae604dae29f07d4b22754aa1e7f4a9c8c4fb9
MD5 278ad7c3f8a64039fe71c736b69b2926
SHA1 50b7ec6438508026cd73fb7da2deb70be6bfb827
SHA512 92f2a0b8247f33dc5e21452281b4f417f3f835414917920cb1b1f0866daa522715ae4d49709f4c5f8c5dc31eebf43c755637fbf4e99dda03ebeeadc44f51ea01
SSDEEP 6:7+/l9I/0FPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKDd/Gt/axn:7+tO6qLJdTRmBEyPbK81Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/data/com.futurefleet.pandabus.ui/databases/bugly_db_legu-journal
Size 8KB
SHA256 3edb18a66f0d3a320bb6ad66b65a5185bb4c9aa0495432849f83ba5a40c24cf9
MD5 a41e3d3ea3420573271cd0b404362449
SHA1 8b8f2e9943341288b49bfd283fbfdb859b8667c9
SHA512 9b905c1e92f050e7050da0dc452bcec2b83d67f10ae1e19e8cebe5aa377cd6bcaebb26c295778fc7c11469bc3dc2984ce9ddce2d0b478942b2fdaa6afc3365f9
SSDEEP 24:7+ttqLTt/qqn26VnrQiVicXX+MgeRKkYBg72m/mpLwBpGSkn:7MtqDfrQiw6uMg6/YBg72meposSkn
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/data/com.futurefleet.pandabus.ui/databases/bugly_db_legu-journal
Size 12KB
SHA256 047a58327b3eed5debbb48aae1fcb8beb404d634ea2a4383a5f497021bbf96e1
MD5 823c774108fff5a96b21361dd5440169
SHA1 47b8aff4730bd34d292457fe33810aa67c0edbe6
SHA512 6de7deeb80f304594f78cc04366f4f532cf94f305989ae239abd3376234a530f8ebc91397f831bf17b720460da468ac99e6d8fdfb8a14f9a7e0069ff9a4142d0
SSDEEP 24:7+tQZZfqLMvtslqqn26VnrQiVicXX+MgeRKkYBg72m/mpLwBpGS9:7MQTq3DfrQiw6uMg6/YBg72meposS9
MD5 SHA1 SHA512 SSDEEP

Submit Download

mix.dex

Path /data/data/com.futurefleet.pandabus.ui/mix.dex
Size 292B
SHA256 4c76a3af64cdd2f8713ffe2733dea50dbe714d0ca41c17d1847ee5b62a7ca615
MD5 63f77f99bd2c2b772a479923bde11974
SHA1 c7632e7d301e4463fafce85f84e9c3d7da3fdbbe
SHA512 3aae4a89d1ed51fdd911cb367eb10afe3c2264e4222085891b18a60d5412f85d10bf5c8f3c6642db70abb9aa42732bac5c42c42ee32d587100f53c21b5beb16c
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads