Analysis
-
max time kernel
179s -
max time network
184s -
platform
android_x86 -
resource
android-x86-arm-20240514-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system -
submitted
21-05-2024 14:23
Static task
static1
Behavioral task
behavioral1
Sample
63999ffe7ec47cf3b06e715d6d1540f2_JaffaCakes118.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral2
Sample
63999ffe7ec47cf3b06e715d6d1540f2_JaffaCakes118.apk
Resource
android-x64-20240514-en
Behavioral task
behavioral3
Sample
mobile7_pluginapk_20140920.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral4
Sample
mobile7_pluginapk_20140920.apk
Resource
android-x64-20240514-en
Behavioral task
behavioral5
Sample
mobile7_pluginapk_20140920.apk
Resource
android-x64-arm64-20240514-en
General
-
Target
63999ffe7ec47cf3b06e715d6d1540f2_JaffaCakes118.apk
-
Size
4.5MB
-
MD5
63999ffe7ec47cf3b06e715d6d1540f2
-
SHA1
378571b9a4b1a2b11d23140f00a34139a10aa988
-
SHA256
2a303767fa79577935a2f4b790cab3cfaf19c086d06a70de59b375f69c313800
-
SHA512
6ea8b106f28e183f70b3811257c3d5fa9b497c66dd7a015718cee4db12e530ee264c62f9d61ab46b5315875a62bb18927b2f4b666e71be2ad72523da7fe066c1
-
SSDEEP
98304:/LgSe/Noi6GzW2QH62Ceb0+LCHPdr5nmlVpW6dCDV0nAAPPUM:kS8qiXaFHrbRaPSlVxCDin7
Malware Config
Signatures
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Requests cell location 1 TTPs 5 IoCs
Uses Android APIs to to get current cell information.
Processes:
com.zhaowifi.freewificom.zhaowifi.freewifi:remotecom.zhaowifi.freewifi:locationdescription ioc process Framework service call com.android.internal.telephony.ITelephony.getAllCellInfo com.zhaowifi.freewifi Framework service call com.android.internal.telephony.ITelephony.getAllCellInfo com.zhaowifi.freewifi:remote Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.zhaowifi.freewifi:remote Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.zhaowifi.freewifi:location Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.zhaowifi.freewifi -
Checks CPU information 2 TTPs 2 IoCs
Checks CPU information which indicate if the system is an emulator.
Processes:
com.zhaowifi.freewificom.zhaowifi.freewifi:remotedescription ioc process File opened for read /proc/cpuinfo com.zhaowifi.freewifi File opened for read /proc/cpuinfo com.zhaowifi.freewifi:remote -
Queries information about running processes on the device 1 TTPs 4 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
Processes:
com.zhaowifi.freewifi:pushservicecom.zhaowifi.freewifi:locationcom.zhaowifi.freewificom.zhaowifi.freewifi:remotedescription ioc process Framework service call android.app.IActivityManager.getRunningAppProcesses com.zhaowifi.freewifi:pushservice Framework service call android.app.IActivityManager.getRunningAppProcesses com.zhaowifi.freewifi:location Framework service call android.app.IActivityManager.getRunningAppProcesses com.zhaowifi.freewifi Framework service call android.app.IActivityManager.getRunningAppProcesses com.zhaowifi.freewifi:remote -
Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
Processes:
com.zhaowifi.freewifi:remotecom.zhaowifi.freewifidescription ioc process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.zhaowifi.freewifi:remote Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.zhaowifi.freewifi -
Queries information about the current nearby Wi-Fi networks 1 TTPs 2 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
Processes:
com.zhaowifi.freewifi:locationcom.zhaowifi.freewifidescription ioc process Framework service call android.net.wifi.IWifiManager.getScanResults com.zhaowifi.freewifi:location Framework service call android.net.wifi.IWifiManager.getScanResults com.zhaowifi.freewifi -
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 3 IoCs
Processes:
com.zhaowifi.freewificom.zhaowifi.freewifi:remotecom.zhaowifi.freewifi:locationdescription ioc process Framework service call android.app.IActivityManager.registerReceiver com.zhaowifi.freewifi Framework service call android.app.IActivityManager.registerReceiver com.zhaowifi.freewifi:remote Framework service call android.app.IActivityManager.registerReceiver com.zhaowifi.freewifi:location -
Checks if the internet connection is available 1 TTPs 4 IoCs
Processes:
com.zhaowifi.freewifi:locationcom.zhaowifi.freewificom.zhaowifi.freewifi:remotecom.zhaowifi.freewifi:pushservicedescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.zhaowifi.freewifi:location Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.zhaowifi.freewifi Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.zhaowifi.freewifi:remote Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.zhaowifi.freewifi:pushservice -
Reads information about phone network operator. 1 TTPs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
Processes:
com.zhaowifi.freewifi:locationdescription ioc process Framework API call android.hardware.SensorManager.registerListener com.zhaowifi.freewifi:location -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 3 IoCs
Processes:
com.zhaowifi.freewifi:remotecom.zhaowifi.freewifi:locationcom.zhaowifi.freewifidescription ioc process Framework API call javax.crypto.Cipher.doFinal com.zhaowifi.freewifi:remote Framework API call javax.crypto.Cipher.doFinal com.zhaowifi.freewifi:location Framework API call javax.crypto.Cipher.doFinal com.zhaowifi.freewifi
Processes
-
com.zhaowifi.freewifi1⤵
- Requests cell location
- Checks CPU information
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries information about the current nearby Wi-Fi networks
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4280
-
com.zhaowifi.freewifi:remote1⤵
- Requests cell location
- Checks CPU information
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4312
-
com.zhaowifi.freewifi:pushservice1⤵
- Queries information about running processes on the device
- Checks if the internet connection is available
PID:4380
-
com.zhaowifi.freewifi:location1⤵
- Requests cell location
- Queries information about running processes on the device
- Queries information about the current nearby Wi-Fi networks
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Listens for changes in the sensor environment (might be used to detect emulation)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4465
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Hide Artifacts
1User Evasion
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
709KB
MD559591f233bcb72a706fbf48c997c3224
SHA1905933a6a0533f6d347fbb4c5dc4bf42cd49e551
SHA2567579da62c502f7b35bf3358ffd528da70ee01185102d1315b9145b3b7865245e
SHA5122ae5e1869fd06010cf0a7cd82e5bc2f929ffa449f279d81900a5cf630321b3f495718fcc40a9082ad3ef02ef60f53ab31b6a15a0591b56d42481d95ebc39c4eb
-
Filesize
1024B
MD59c5cd6571ef14ec5c431a1268e20edfc
SHA10bb8e4a5308b1ce92d360b529ec48e9ecca3bd8b
SHA2566ede924ec05e04cea302f1bdf0e39521fb7f3a6a0b3e1aa227ba663c008e7efa
SHA512684f8db69c50ca8faa0073d506f83ec04e5653d9081b7acea6d5c1e26546b5bf588d5da57f993e95bc30eb7286098db04a733aef5b2395c00344b91c48680883
-
Filesize
1KB
MD57bad7e71c9170728b551e4ef5b201322
SHA17570c1216ff765349ff175618781aea4b24de9a5
SHA2568b13f91e501f6d0370b99198d25fda9c9ac2a86915fc812b1a1433bddc942bdc
SHA512404e051c217729392406da4e20dff7f3987d429a5ac35c89ecb8367ffda4d9fdeed4161de7f45c6b3eedf2ef7d68d818815e812b96b5db77e59acb895703a7a4
-
Filesize
32KB
MD52c17a752a2a3f40ea1692191b4f1d6ea
SHA1a85d8069575771e7e8dc0fbef79d65e17549906a
SHA25616913e2296720192a103215f11e214c749187074b26f50d4441759a8b68382ac
SHA512a77f2eddb4af34e46f7cac2fe243f013a7bd6c5d687b4cf28f1e115f859eef395e7b0abad4d8646e686c512655c510e2a7823bf873cba0451dec59a9b9b21348
-
Filesize
4KB
MD50513358fe3baeaa94a3df2c23181204a
SHA107238bfe8ea952e67ff3485e3fcee51c34744930
SHA256a4adc6d149195b012f74186a61df59f5d1768611df7f31ae06cd5376b1145762
SHA512c7194a127bfd3d110dc349639c20279fc3f80c8b853d0dc9995a556776f1a5dc2f59cf09c63e6411c38250b08b64fe5ca9a3cfec5baed3ba9d9a23a4ea6936c8
-
Filesize
20KB
MD575aca1ec8ca563f007ce5a77ad85fa0b
SHA1bf9892c5d2e9c46594d3be21cf259398e465d1af
SHA2563e251272ddb7b259624e88247c6d8eba4337f90156b68eb3208badb7a789ae34
SHA512cb3ced8217f31f01378df680d041ac58f90141e0cd563728c03b9cada4b9cd271a9e8ecb37d86446914cd3bb65d4b8b8bc81632d91749c286e7b4b989cabf7e4
-
Filesize
512B
MD59d1e8c2b8ba996b7ea0ff88c4dd61688
SHA17ffece60ca717a68e5c38b0e082f61110135cfcb
SHA256e6ac7e339bed309b7de61004c8cb1d91a3f1d9bc1679a327d7447f8969567844
SHA512c4606e9912a35e0966250549e11864199b3e71d6c44d235cf1e47d949a8d71820ee1ce3113adab8bd3fb7d0f9a36cf911b32304d044a4d5ce0e55a3061d3a904
-
Filesize
52KB
MD589b200326141e47613213ecc2a6fa816
SHA1d1e0d5d46ddcad829b675d893327799808783a4a
SHA256556a2d343adca3af096508e65992fd0351f7a310d52da5265c8beb3e9ff6a1ba
SHA5123b290f490c7ad0e8c89d906e76818f189791b1e18a64a81a84658cce5067e62b4d64f0710a17fc023cd615fb1452d3c7dc3450331b076314f54c6beef4a09871
-
Filesize
68KB
MD5cb6c5a47bb194d3f62542b3f711b0a8a
SHA1e5f4a32991f62f620a41d9d4fec9c9e9208f0384
SHA25619dfd11e030f70962039f2a9a6e10442bff760c488b252efe8145529c2e364ed
SHA51235f8224f58d03109c354c31bd70270dc0d8d85a5d9fb170afb0c11e3b3559c97189b66960ff26addfd8f7cc01110644daa4b5a73fbd6ebf78bef1f9646e0fe6a
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
112KB
MD5bb126b7c2d6882c2caee7aaa6bddbcb3
SHA159880bdc02ff8dd499f6dbd65edefac649bcecb5
SHA256fafc4c68567af1ebdc038ff61eb8fd60c57edeab0a92688c92ac4e23c6cafbde
SHA512693d01fe4f6859de761ebe8af13f63b94b5fc4f88ffe7a157168328305dcfbfb5fbcc8cea4aa9260da49d482b3b61a01a2e1229e27353e846a1cc7690fcf329b
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
84KB
MD53fe2a020c5f5488db72e7b9f5620dd9d
SHA1e561a6ec2be79d43f3c9dd8e23ec41b978d92554
SHA256f4c8bc393ccde70c7f62f0b0c33e9997b9473827a29a3db27cd37123088db68e
SHA5124d556e2614797104dd10a0929898b9dadcb506836d49894c877281e3daee0d7edb1f0c89edf6bb558e4b74a4965fb58868e67591a053787d38d26173caf2fa7e
-
Filesize
40KB
MD54dcaa7fe72057e21f7b1d18c1be99238
SHA169b7c2b45dd56ab1edef56c860724bb1523488cd
SHA25685cd7f8a0ae458a1c81f75cf5961eccb2a9f845c0ee5f254b8ddc435bdfedfa7
SHA5126fa7c32d0fbf9c7f4d6b7af30ad3569e25384f9b19d2faf4dcefaee20e88e4fc299afafbf65f6765f9dd5e041b61a76daf1ef86767166aab0150758d112ff97b
-
Filesize
36KB
MD5426db7185ab24e993328e2ef3dd882b6
SHA1c89291238f4eb2c2835fc04b7c07d93c71f66174
SHA256dadada53dd6d93a0a6815d29aff7848b5b4177f7a8725bb0bd36e69ddcc1fcff
SHA5129e21aeab4d87d99e155d06f540473fcff5fde40bb282f4fd244bd055178cdf20713d2679baecc28c7e727e9146bd992ca503c2afe55cc7513f83695b9aa43e3b
-
Filesize
32KB
MD57d51b10b899eccddf4356d6f9fc5e4c9
SHA12805fc6d14fa7d5062b9b55a8ecfacaa6c5b99cd
SHA2565469ddacc50246aad965769492b8cabb0a6aa87abffb3822fcba1e3990e1903b
SHA5128d17be62ce6d58ec8e22465d3a5b5368bb58fec71d2e99f27e961b2fe2fccfad86e15b7f400c80eb5522df343c5125421bcc2ffb36da28a3fa3c4d7168d1d702
-
Filesize
12KB
MD5d87e4ac962d28eec26156824c289d433
SHA15215e5b6c723092d0c2c0b64a0888045d42690da
SHA256e206d6490ecbb5753534e725b52dc375522b41a4b3ef25738874afbef491f6ce
SHA512001270503c553710ac50611d53e1f9a5614b474af293d7ff8443c2dcdfdf8c9bafe2f43e88355b74a6cd08ff257accd086e643fe044e52caca4bc663f114090d
-
Filesize
36KB
MD5537d34acfef0742dab14632a1d2937ef
SHA10be64eebb6d7c183a832e073e857f8fbfcb3890a
SHA256f914617f808026b027c8e41507d249a57ee78d61965ac2e4ccbcc0faede8d17a
SHA5125733a03baabe24022409ac0dc2f4a663b85c23090e322170ca96f7dd5cd7bc6a27038ff12875d3140910ee406073499bf394cc35875a5026631bf5e49b811060
-
Filesize
60KB
MD5aee0090ff8f1e143fb20ddff3793d7f5
SHA10c662e199f20f6df4e8a185cbe6a789a485a0dbe
SHA256405b0f6ea73b721987f8e9ea47109c5b009e7eeac91bbdf98dc7003cb66d8907
SHA512a47e50c3f443d31112cb4713e94c9ae8016d89fb144429ae7eaa0653d4b40e8757dd43967c1a48e7b575d2029161d2901af14533e48cc5f01e6deb2fbb635193
-
Filesize
8KB
MD572dc595100729e3c4e9fc409afc99aca
SHA11591d18ccc509dbd208eb9fdd93d35f2a7c287b0
SHA256d4e232553d0a92cdb56dc14bb1913a7d5759f0279cf06b0ce0aaa0c368f191d2
SHA512e88e09d0f0f4d4a3a6fdab85a9e820ac7d5ee97807582ea60ecc218854e6ef6d5f647663fcd04ba6f24249d75a5194e80dee9ded85f6f4fed847e0fcf7bbd30f
-
Filesize
655B
MD546b27f5a5f2308ce6b72eb97b7c4b16a
SHA119c98edbda2a7d962eb2fce72e1496c657198b0a
SHA2566d5fc0ecae3b3d8fce723902be6e97aac9eea2af0fd402b4a65afe53a5a75d8e
SHA512cb6e1d86ca4f5a39b25cc865a431afa622d258a29b28dff75f11108b8341f7c282b867c6267bf8ede3c2292b83f51eb52483457fcbd531918b1b60706f3d6b25
-
Filesize
16KB
MD58298b494a4882f308e16701765e62b4c
SHA1c5531a8e7f65bc023fdb07b7b03696d334d7cc2c
SHA256c012836f1aac5ad0d52c1f7dc51c4bc64e75378cc91130d6f5c8d864c16090b3
SHA512fc26f7cce58792ac2d535d6d7fde602f84b08dedb5c6ce6a6217fe9d6e4e1e8949ddc77b7c38fa7524bb8906173c7286043dfc0211f8ad45134b5016724f6652
-
Filesize
169KB
MD57cc7c13bb0afa4b2d6514ac36b4bbad1
SHA1404d71044ed6f497c2f990edb684a9270e614631
SHA2569761173b8dbcd77d32d657f0972729ca288c41318fbdff0dfa9aa80f844517d3
SHA512745546030421e42b92e800b67e8da5e1c7261c6d64b1a0b8231d4f0f54dc414beb8d5a953fc846c9f244cc2cd44b33050777e5e42885cb614f78f641681d7dd1
-
Filesize
310B
MD57608910933b1a2c7e7f5b19f2117bbfe
SHA1476635704a62d1e37d7b659c322092a9275b7d8c
SHA25606c6e33063ae713101a2961fe1755e2cc4041f80ad8ffaa16d36aeb443080c43
SHA51284c8ca4873bb97435f64d69da02b3f8fe7308b69d761c49276fc1256a001ddf9be9e4642cf5c3f64398ef1c34524aec67df824b5ec2be8e7daf42c48e9db1e55
-
Filesize
32KB
MD5519716beebf5e6475787481862a350df
SHA1d57d891e4a373704fa42f2bd9c8720e236f9281d
SHA25668c033ecf502191839d4147f1996eb5de8826072ba68ae0741dd931e95054085
SHA512f7f45364dc5f11259aa60ea89e30b60b24e8dddeb4e7a662c3e7b03836e86a01812b8292a4251e1ced222a994b7f8f54a6278a1ccca39ed207169448d6131578
-
Filesize
48KB
MD54c9d68c10cb18f40f37c523c60b84415
SHA11cc24b27500547a10f5b9b0620d5d7da71764129
SHA25672111e8a36de2c67449e5976fe1f1073147732c4ec71d9a1967588ca4492f5ce
SHA512e8235a901d9a8807057a1920cf33647842cf2592f8c3581284c9598bec573907198b53181b0b0156c5c59ecdfcef8b8beb10c5c5aa1e15aec85cfb843994aa3c
-
Filesize
225B
MD5bf90fe6a225ed6c092a36da8adc72488
SHA11d4589664159e73856346e8ca7c46add17042688
SHA2560e71aae28db7332076323fa2d7c81817f70c1c670f4f43f6a00c734d9bb9c4d1
SHA51207e9679d4f9cd997f66e89594c6fd20b9a553df4ba5afed47132e98b6059c660d1070f128133221de3293641c234fd4d901ff2c65de1ccbc66ab7df79a235700
-
Filesize
24B
MD5f4b2c363a5befe91e69bc45b325bf411
SHA1da365b123f83fee2a7ebf29d3120f363e4576e2d
SHA25646d0885346a8b989e89492000b905285eb376c9e5b4ca822485c3326c877775b
SHA512c0bcad68626d7508748396b5253c8338a09bdf4d12628312d135b2d6332a9809d2c467bb07781607ebef6c07226bfd075cce7a5c978d0d39d9b3e073ae792bc8
-
Filesize
2B
MD5142ba1ee3860caecc3f86d7a03b5b175
SHA16e956e31476ccd6bea194a2d6e5e54d66bd3281b
SHA256dedba7762ec349c2d16e9199752b17f374d6f83071d29b09877816f390928960
SHA512afeff9332ae66f946c36cb077ca8eb02a2168d1e0634a5d04c607beb2b20abf893b18e30c5061081c7b0b6886d290a970378df7a05c565506c7e6c309d9532d7
-
Filesize
399KB
MD5caa9ccc4b7528337a36606791d5dcc00
SHA17820059a3d9f65a1c80242ad3d59a0e420696ff1
SHA2567539dc15447a2059f8094dcb043ea680ccce23e6afd00330085d6cae6d18a112
SHA51224103c0adbef887c68b79993aa68ba361a9baa6f553ccc48bfbb9cd7b44828440472cbbf7441282b0e5cd44ed3a4e33de5f2e1cbb546172c6189552de9d9a0d4