Analysis
-
max time kernel
174s -
max time network
183s -
platform
android_x86 -
resource
android-x86-arm-20240514-en -
resource tags
-
submitted
21/05/2024, 06:53
General
-
Target
6267098a1fb05b9c607b1d790a27e69b_JaffaCakes118.apk
-
Size
31.0MB
-
MD5
6267098a1fb05b9c607b1d790a27e69b
-
SHA1
7366f2abbf716becf7be949d511018c1043ca6bb
-
SHA256
ea5fcabc93fd26c3f06f561e40dc8831db250d6a715dfd78b7ec7eafee78b4ef
-
SHA512
dc07b2abfd529e68a8352d3d1b3f7bef864e47fb594146b3de4cbb5031d6152242956a733c2b406d24fddebdaea07d365758083565c5340e6cd9383797d1b3c3
-
SSDEEP
786432:NAJRN2cDixrvcfuD2PgfpquUutwuLqOJabXwyAEbUt37C+mJrlxm8Lr6L:GQc4rvc2RhquUutfqgTB37C9JBxm8m
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 1 IoCs
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Checks Android system properties for emulator presence. 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
-
Checks known Qemu files. 1 TTPs 3 IoCs
Checks for known Qemu files that exist on Android virtual device images.
-
Checks known Qemu pipes. 1 TTPs 2 IoCs
Checks for known pipes used by the Android emulator to communicate with the host.
-
Checks memory information 2 TTPs 2 IoCs
Checks memory information which indicate if the system is an emulator.
-
Loads dropped Dex/Jar 1 TTPs 9 IoCs
Runs executable file dropped to the device during analysis.
-
Queries information about running processes on the device 1 TTPs 2 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
-
Checks if the internet connection is available 1 TTPs 2 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs
Processes
-
com.gxgov.ssqx1⤵
- Checks Android system properties for emulator presence.
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.gxgov.ssqx/.jiagu/tmp.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/data/com.gxgov.ssqx/.jiagu/oat/x86/tmp.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
cat /sys/class/net/wlan0/address2⤵
-
-
getprop ro.product.cpu.abi2⤵
-
-
sh -c ps -ef2⤵
-
-
ps -ef2⤵
-
-
com.gxgov.ssqx:pushcore1⤵
- Checks if the Android device is rooted.
- Checks known Qemu files.
- Checks known Qemu pipes.
- Checks memory information
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
-
cat /sys/class/net/wlan0/address2⤵
-
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Virtualization/Sandbox Evasion
5System Checks
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.1MB
MD5dc94edafe543f6806b24b0318668e5f4
SHA105d591cb70e0692f1bddaf4e783e5a1c5c112c69
SHA2563c39fbc8e64e0abc9e544a831fe0a42699cc49b26c962fd44bc50c36c926b910
SHA512b594143612c0e526be8c39ac69683a8d3d0ce07c84e2af90fb393fa4b213b4616fb7f70ba67a743ee1f789b90d72e5dac00f6fa8d9a8c29742a7689b63b0b61a
-
Filesize
5.6MB
MD551c5380abfd17561796446b964aa7538
SHA1b4bea331eba47735e5344a73c887860ac6dc1a1a
SHA256f1be23f381390da010da70469d8489d012f8b1a6fe334326117aee1a7704e88f
SHA512b173ffcfab7c747f107bafff43dae8bf2ea862d227f7f0518f6814e83063b29410d9c9f1e912c2ae10ea682399351844679fa6be6f25cc6f85d0bfda24a2868c
-
Filesize
487KB
MD5610a895c4a71bbeeaea16eddb1422bbf
SHA19f919de42ed1e80bfadfef48f8202b202166f869
SHA256baa349e9b5a47be21b6ea00ef2e0c0c5dc203c0e4c391dac46df07ca9d333217
SHA512ef4173ba32309ef1257b75bcff28fd44ab14398577b4fb3b6b95323035c964201ed39546cda3b7115ba5025781f3b9c018443e7932edd50a25b1be60359f80f2
-
Filesize
284B
MD5f1771b68f5f9b168b79ff59ae2daabe4
SHA10df6a835559f5c99670214a12700e7d8c28e5a42
SHA2569f8898ce35a47aeafced99ea0d17c33e73037bb2307c7688e50819966f4ae939
SHA512dae27d19727b89bec49398503baa6801640540355688dfabbe689c97545295c2c2d9b0f0dcd7cbc4cfbf701d0c0c3289e647a152f49ff242d1ecc741efe4145d
-
Filesize
223B
MD5c41e9dce095b0c420529ad9bb2378c9b
SHA19db8e0ead384081036522d657aebe5a5087b7dee
SHA256d3ecb912917d129c88270dbb0f9dc3149372e00e1dce9549f1930f652e192f77
SHA512af4541b3980100f5e2896da14cdb0f6cc2a351fcf343bb1e1ab3cb93cc6b56f307d5b4c9b5bd3fb05555d64fae1580d51882248afdec2946114556f75b5eebe7
-
Filesize
58B
MD50d210bfb2a0e1f1b4c082a6a0f79de07
SHA1bb8ed9e364db79d1d9f2fcde3f15091893222faa
SHA256988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
SHA512536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1
-
Filesize
84B
MD5213773cbec5cb20a42bec18c877bc0c4
SHA1a81f288a10c14188abceb7b0ada95132941c99b8
SHA256e822c8dd22a4d5a5f313181d331eca2918bc7b699fe89d316c88ce74e6c16cea
SHA512394b6721068b55d4805ecbe7e13118bd66fe7619b2ecc2a4851cbc744b2d5775c5d979b0894413b30925c7ba32790dafc1def0255e1e404d5c05bbccd6da8f4f
-
Filesize
56B
MD52eae2011562ffd20409375183533b8d8
SHA1c4f05433453336bf1d4056bfa7b5a2ecc33861fe
SHA256b5907243f196d23c6f11dc5933780e32102cb73004f90dba7b8a8e8b28cfb0a7
SHA51278f5df62fb8a2f749278c3309fa3fcac375fa63dd3ba5ce06d6fbc15e8124e7101aab2506627381dc7075c40da93b7e2bd2d5636717f697d477ffae714390888
-
Filesize
56B
MD579a3485f7a1447ce60a94e363c55ebc7
SHA13c4537b04b5251123626ef299bd2f973152497dc
SHA2568a05b36a85823f3d7be0eccd1522cf048a312da8a7440f18355155bba4283a2f
SHA512d507b2409ea24db01eb146ae1625eae8e36c38130f83b452ca5d5fb6d72b9fe6514a4b300ba1ee565e8797ba00f6a965f02766273aa5a560ad065e5d6db31193
-
Filesize
84B
MD52b3a291d7b9a4906f5a13029cf02f333
SHA15db0f6ae08909097c4f5503f894550324993111f
SHA2568821fb2989b9f2834721eda624ce67115b6f277d2b6bffad7614c98d8eb11769
SHA512e6fe8d629afa9f2dba0219dfdd820c2685565f8c92f767fa21bc562b5831ac84bf2c0cde8c80f118b4ce045e24fc19570cdce3e80e087a7e740ba562ed2d0ecd
-
Filesize
84B
MD5b9015d368cb4f8027f6ba83317828ec2
SHA1c77c60516acc7bdc37c7ba5e4c2f4d9dee4a7641
SHA2561c54b39ec21bfba4bb4d767b412d5fd4a486c4f244d2b0adc58e8b91548577e2
SHA512b926de69bd6fc00fe84df8f27811a3e205fb6b5597cf0cf75ebfcd67ed520e9d6283ba42444417d0ca3c37e50a0140df4567269587f36c99aab9a1e3178c439b
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
76KB
MD54997629c60e2f816348923ce348008ae
SHA1b3465289df849118d92a71d40c90fc77a1553731
SHA256c50d19d9d52d3582896d3f6234180e6017aeb937f4e5be0b1d54ea735b569502
SHA512957b8d617aeb469c783af9ad1283d76c84d1b0f26a9e7be1f6e57434ffb90205b66cee73fda2d58efb5d8e7280418284691a4ddd7a3b507b7be877e0cd311733
-
Filesize
80KB
MD5bcf7a494326b63cbae73bb1cc26bf3ac
SHA10672702c26735369b73cd46cf280fde09d1bde90
SHA25660bebc01ba41877a86d5a4b85da147b00b331c215270d8416c9a15d815c9114b
SHA5126fddaa09aa9d4b4ad4178ade582f653a503608b8f8e9e4f289274fc3fc51ce48eb7308efff76929849bed5ede6e179050221e92113f664b327d1e2b04363cdb7
-
Filesize
512B
MD59e760eed757331f72f357a0fbe4ade55
SHA1efd4e2104156126e51a217d944c9bab41655d1be
SHA2563dd76299864b5470136af457847950151aaca0f63293e4cea2954b292a2c2f74
SHA512706bf6cfb95a26bc6223eb3f5e4e032294688bce89ffbbc015636a84d131376d960822eec58af239058890d470a40b5710c71bd0e723b47fb96f7ad9cfb079d6
-
Filesize
56KB
MD5ba4b34d4cf308c1cc08aff98883741af
SHA1e66116d6ab37e663f0f1220e6651868635ea9a45
SHA256e950f5f009834de7110d2474114520d0b3118123296445cf3a8db585836e1c3a
SHA5127dfbddf4ea40335c9329edcea62ab0e1076bbfd73e52dab204d94d55d2afef33ca153d3f576268fde79506d19b7341934903a5cbcb9b19e065168be223502a07
-
Filesize
32B
MD5f743e716da7a029431510e47e4a6a79e
SHA1f2dcc46ffe53b7a2215d7baa75f14b3af325f980
SHA256afed7bf309ca6c41951c188e3d28bf3fce1ec426abd7293b8d82b6e77758e486
SHA512df863dbdc0e7dca3fd8fa29d29cf219bc5487637acd958dec9f5bc17ab08c7537389fb1c8b2276c728c6636d614bcdfcb0729bc3497911004dae918d26d8cd6f
-
Filesize
32B
MD5c100dfce38856cc8aedf223f53f6bc9d
SHA1cbb55bc587cb6546548925fb40ea6017b2a99aa0
SHA25650b35329d6f390fe23d21811a7bcefc92ec09f902d56d5b35f582501caa2dcbf
SHA512a8a6f13aaeb03575d16a800ca9383bebc71fbe5af2c8065bfbc1c0acb1b9615bd8df9fb66cbecc306ffe98566837c64a1a1c04473a1ff0c3cf40b569492bc432
-
Filesize
32B
MD53fb81a95314cf385b1d1d3ff713fab00
SHA1bb972fdef5ee50808106bca814ee34b99b1c962d
SHA256d78940939262171386d8ad626965afb2c52b25819fed3a06878c14e1b30df4f8
SHA51259022f6c068605db31086696156900a5dcf81ea8c0881eaba119be5771f77762007c176d42b1fb2a5497c78ceb24c1dc88d713ac799b743f408e7bda698b2c95
-
Filesize
84B
MD5aeb6b3cb19f8e09fe31347d07eab7ecd
SHA1ce3074cff1c141f32c3f9568941a2f7fede41a94
SHA256b61e48332c5863e6dbb06bc274a3a000772dcb86671afc52d917f50f0a87151f
SHA512aec63307c4382a224da05841c0b4ec6d75218d88e6c3ca4e1869aa783a388497f8c8199d564b329f0401300f3837515ffa16aef1d44451b3ffeb465ac23e67df
-
Filesize
26KB
MD572c74eeae37f7173175fc53878795e9c
SHA17eaebaa655bea83dd4a7d05e6da4a88935975df7
SHA256c2946e17ba3f26555ca642ef5e0e35ee381714fe21ffbcf3c43cb685a5c2cf7a
SHA5129fcdd76f746e9e26070b7e31ca7d6ff7a3491801366f12352978ab6a837e50da9202bea0c7a5582074e7320fbd667d5054c005d803b7f1fb2f1520221811384a
-
Filesize
314B
MD5ae4b863797baf5ea98c8667891d9aaf7
SHA1a3a424091e3948849cacdd38f5819425f1770374
SHA2565071a07a5203357bb012d0c2517ce4adbfc6726f73504194335bfa566f11c273
SHA512e4f555f571b1789544cd88a63dca90361a03c3b7241b0a3f471d635e93b3a1f3e64110a0c1cf0d549e847142c17be522cf88dc1b128e5705dbe798fd6717f045
-
Filesize
307B
MD5b8493321b7331a42304480ca743f09a8
SHA1060432be1b1c89a1ac3d02a0d5b6b4fd2eb1f48b
SHA2561db25e4f8994fa9a47413dc44e95c7a55a08531bfa89cbcb330db1000899793c
SHA512abf81ca04a643cf1ae76b3ea2a318f5d4446450592be2cb911277110e15c261660e3e4b869a952ad750b2de6a4ade75d6e2dd5df9d100eb3ac3f108c5e927cff
-
Filesize
232B
MD573411f473c26ce8a8db1faae2c535f61
SHA17f803a29730df219bf20f69370733e11d5071f79
SHA2565cbcace4061fb3d35d4218c4ec118d9c467e2069a80cd71c1f454f1a3064b623
SHA5129679d9ab9b59fea9ec0c8e3ff4f76fa0e78291d0e38c50a6c5f7f4db644f872889c83138ebc75307161fc69380876daf6c2e27c8a7fecb29d052bdde47bff5d2
-
Filesize
54B
MD59ab4e8d8353621c44ceb2509c08c3582
SHA191d8c07390962909665c8944d1e9d4134b5127a2
SHA25626fd4d75b9223fb7d55acea860a477eaba94b37111fb2988e961936e46b7182c
SHA5127b7d7418b6a83f63a623cdf012c0f19521c1ba9ca67c4a19141ff2992a9a7fbc0a01e060e7157e1fc7cc1aec10317d611932f3a86737d554c0fa7a6ff17c3655
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
54B
MD5033d07cf1e27176f0bd163fb289f170d
SHA16d6c8d541505f2c246a9345ec564f4cf82d63e70
SHA256b043cf6b270bdcaaa36f01a08f760df6fe81978d87ffba9bbedcbb62a54ac22e
SHA5122c813266cf10b4e4ab351b2f921a14ecf72c9f1c585051ae9c341d2c8639ba19ecb6cc67dcedcec6e7955d12a028c55ede86b8a6ab7ed952c05c2dee1f757287
-
Filesize
512B
MD5aa7e3289f9a74866e3fca1da0df2708d
SHA1f4a730a3aaf138e4338027e599cc37fa323cd3da
SHA256f1ea9f17a7a61a442e843e7e688bacfb604e8b73592ea0c877ae2b60d5c9acf6
SHA512d46f412bdd4db9ecdcc1628f4d888939238a30cfd04342d7525f35ead9c61f8d3c04d9f234519ddf60f3f12ad5aae77a462ade3dfdb00243d51533c3a6694891
-
Filesize
84B
MD505eb5336a08ac38311af8f9a087c4c1a
SHA19e55753deb751bb94a6791f06aeea9a0db8ec5d3
SHA256ca0d5621ccdc4eb2ba1538ddfec28471dd0cb394e2417b9ce3ce7c76414bc841
SHA5123d2cfec6adba90e30ef52baf3e99aa7885039cc70b9ffc5766b836b464a490f2c4361e66103898f69b33743c8bacf1048ea7999138ed7a8a435e9ca86af4b186
-
Filesize
119B
MD598e868da83295ffc0f7abcb7eddadc50
SHA1a2348d68bea082ba76ae8d275d3addbc1133dcfa
SHA256f087b094ab75ed48041ef2b3d85aefb111b26b37711ffdbc070fdddf77e53e41
SHA5129251568f38e2114e5086d8c21d47d1b8cfd9982e08fdb7461fcd369d4656803404f8143c99cc4b33cbed8070bf3cf6386d8ba37312dc6efc26c4dedb82fb9ad3
-
Filesize
159B
MD555553a689d4922c467a37b880e9d0a7d
SHA1f6e294eb02fe9be544b819858b78ef8665595eff
SHA256d86bb60a9e83c7880c2022824368b267b047d0c16e3fbf5423d5b9213f1ceee5
SHA51201554a2e3b58dec03c80220d214bc9180cb68f544e50aedcaf8dbe4c1168bb0af7adfce6d3e729b4cfa9390432a86d87e919b4abe2be9ef688224b9820591635
-
Filesize
129B
MD5c12953c27792f9a5b291fdb6a78f0d24
SHA14912f60bee3c91f6a07ffb156a3f174b486e3178
SHA2565fac8516ba980255875bf0ff5f6ad82d49274d93d822e0706842ff9c2c107efd
SHA512b8308e1740880ca7db227d2e9091510a05c1ed98d89f9f4d71b1a797a42b13f5e03360c5f4bc6c1120a804c938b6043ddc774ed9d32f188af80b415354a76923
-
Filesize
26KB
MD5d8089c9ef0c93d69bc9aa0b0e06a1b3b
SHA1ae4a83a7853dfd34d76e5c9fdd2f3b38cdc9a9c4
SHA2569992c40da695df3e9ee387cfcb07c93e4b9e36751cad0e321e88bbfc56fa4857
SHA512eec3bbbd3c12e3db5ea92531d8424ec87084a4b2c2c6ffd0f56fd63e550ad30dc59c2807011df38e7caeb484d3777a7167648aa416d75a79f2dcada1ffa05908
-
Filesize
202B
MD57c65c8d82bc71679d31b7a62a38500c4
SHA197f5436774c38995f33938be2eb3eba8c7f99b81
SHA256b28a49ae45b22514d247504f712598dce08cd93f242dd64b04b59578f41129c8
SHA5121b12dc772322d676391ca85f132fca43e76ce829ab479909b4d49136b4608b00034809e4ff2a46f5b90e7949a20882da93a5361791e02a95255af61582f330ba
-
Filesize
32B
MD509c78d13bb34498098e0010ccc964d69
SHA1f2707f061bb17db117e1e9238afe920637a8b53f
SHA256bc39b8db06e2cc28606e1d26f625cf3bc0b5790655944ab84a2281d735aceb5e
SHA5128546bce5faa8e43704cc1eccd51613162561935bf511e9f74bcf22b623a9862213ca0cbbf2800dfac6cba92e27e5b51e185c716f26d7d0a94d40560c0aef7ae8