Analysis

  • max time kernel
    179s
  • max time network
    184s
  • platform
    android_x86
  • resource
    android-x86-arm-20240514-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
  • submitted
    21-05-2024 14:23

General

  • Target

    63999ffe7ec47cf3b06e715d6d1540f2_JaffaCakes118.apk

  • Size

    4.5MB

  • MD5

    63999ffe7ec47cf3b06e715d6d1540f2

  • SHA1

    378571b9a4b1a2b11d23140f00a34139a10aa988

  • SHA256

    2a303767fa79577935a2f4b790cab3cfaf19c086d06a70de59b375f69c313800

  • SHA512

    6ea8b106f28e183f70b3811257c3d5fa9b497c66dd7a015718cee4db12e530ee264c62f9d61ab46b5315875a62bb18927b2f4b666e71be2ad72523da7fe066c1

  • SSDEEP

    98304:/LgSe/Noi6GzW2QH62Ceb0+LCHPdr5nmlVpW6dCDV0nAAPPUM:kS8qiXaFHrbRaPSlVxCDin7

Malware Config

Signatures

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Requests cell location 1 TTPs 5 IoCs

    Uses Android APIs to to get current cell information.

  • Checks CPU information 2 TTPs 2 IoCs

    Checks CPU information which indicate if the system is an emulator.

  • Queries information about running processes on the device 1 TTPs 4 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Queries information about the current nearby Wi-Fi networks 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 3 IoCs
  • Checks if the internet connection is available 1 TTPs 4 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 3 IoCs

Processes

  • com.zhaowifi.freewifi
    1⤵
    • Requests cell location
    • Checks CPU information
    • Queries information about running processes on the device
    • Queries information about the current Wi-Fi connection
    • Queries information about the current nearby Wi-Fi networks
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4280
  • com.zhaowifi.freewifi:remote
    1⤵
    • Requests cell location
    • Checks CPU information
    • Queries information about running processes on the device
    • Queries information about the current Wi-Fi connection
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4312
  • com.zhaowifi.freewifi:pushservice
    1⤵
    • Queries information about running processes on the device
    • Checks if the internet connection is available
    PID:4380
  • com.zhaowifi.freewifi:location
    1⤵
    • Requests cell location
    • Queries information about running processes on the device
    • Queries information about the current nearby Wi-Fi networks
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4465

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.zhaowifi.freewifi/databases/oui.db

    Filesize

    709KB

    MD5

    59591f233bcb72a706fbf48c997c3224

    SHA1

    905933a6a0533f6d347fbb4c5dc4bf42cd49e551

    SHA256

    7579da62c502f7b35bf3358ffd528da70ee01185102d1315b9145b3b7865245e

    SHA512

    2ae5e1869fd06010cf0a7cd82e5bc2f929ffa449f279d81900a5cf630321b3f495718fcc40a9082ad3ef02ef60f53ab31b6a15a0591b56d42481d95ebc39c4eb

  • /data/data/com.zhaowifi.freewifi/databases/oui.db

    Filesize

    1024B

    MD5

    9c5cd6571ef14ec5c431a1268e20edfc

    SHA1

    0bb8e4a5308b1ce92d360b529ec48e9ecca3bd8b

    SHA256

    6ede924ec05e04cea302f1bdf0e39521fb7f3a6a0b3e1aa227ba663c008e7efa

    SHA512

    684f8db69c50ca8faa0073d506f83ec04e5653d9081b7acea6d5c1e26546b5bf588d5da57f993e95bc30eb7286098db04a733aef5b2395c00344b91c48680883

  • /data/data/com.zhaowifi.freewifi/databases/oui.db-journal

    Filesize

    1KB

    MD5

    7bad7e71c9170728b551e4ef5b201322

    SHA1

    7570c1216ff765349ff175618781aea4b24de9a5

    SHA256

    8b13f91e501f6d0370b99198d25fda9c9ac2a86915fc812b1a1433bddc942bdc

    SHA512

    404e051c217729392406da4e20dff7f3987d429a5ac35c89ecb8367ffda4d9fdeed4161de7f45c6b3eedf2ef7d68d818815e812b96b5db77e59acb895703a7a4

  • /data/data/com.zhaowifi.freewifi/databases/oui.db-shm

    Filesize

    32KB

    MD5

    2c17a752a2a3f40ea1692191b4f1d6ea

    SHA1

    a85d8069575771e7e8dc0fbef79d65e17549906a

    SHA256

    16913e2296720192a103215f11e214c749187074b26f50d4441759a8b68382ac

    SHA512

    a77f2eddb4af34e46f7cac2fe243f013a7bd6c5d687b4cf28f1e115f859eef395e7b0abad4d8646e686c512655c510e2a7823bf873cba0451dec59a9b9b21348

  • /data/data/com.zhaowifi.freewifi/databases/oui.db-wal

    Filesize

    4KB

    MD5

    0513358fe3baeaa94a3df2c23181204a

    SHA1

    07238bfe8ea952e67ff3485e3fcee51c34744930

    SHA256

    a4adc6d149195b012f74186a61df59f5d1768611df7f31ae06cd5376b1145762

    SHA512

    c7194a127bfd3d110dc349639c20279fc3f80c8b853d0dc9995a556776f1a5dc2f59cf09c63e6411c38250b08b64fe5ca9a3cfec5baed3ba9d9a23a4ea6936c8

  • /data/data/com.zhaowifi.freewifi/databases/wifi_cache_db

    Filesize

    20KB

    MD5

    75aca1ec8ca563f007ce5a77ad85fa0b

    SHA1

    bf9892c5d2e9c46594d3be21cf259398e465d1af

    SHA256

    3e251272ddb7b259624e88247c6d8eba4337f90156b68eb3208badb7a789ae34

    SHA512

    cb3ced8217f31f01378df680d041ac58f90141e0cd563728c03b9cada4b9cd271a9e8ecb37d86446914cd3bb65d4b8b8bc81632d91749c286e7b4b989cabf7e4

  • /data/data/com.zhaowifi.freewifi/databases/wifi_cache_db-journal

    Filesize

    512B

    MD5

    9d1e8c2b8ba996b7ea0ff88c4dd61688

    SHA1

    7ffece60ca717a68e5c38b0e082f61110135cfcb

    SHA256

    e6ac7e339bed309b7de61004c8cb1d91a3f1d9bc1679a327d7447f8969567844

    SHA512

    c4606e9912a35e0966250549e11864199b3e71d6c44d235cf1e47d949a8d71820ee1ce3113adab8bd3fb7d0f9a36cf911b32304d044a4d5ce0e55a3061d3a904

  • /data/data/com.zhaowifi.freewifi/databases/wifi_cache_db-shm

    Filesize

    52KB

    MD5

    89b200326141e47613213ecc2a6fa816

    SHA1

    d1e0d5d46ddcad829b675d893327799808783a4a

    SHA256

    556a2d343adca3af096508e65992fd0351f7a310d52da5265c8beb3e9ff6a1ba

    SHA512

    3b290f490c7ad0e8c89d906e76818f189791b1e18a64a81a84658cce5067e62b4d64f0710a17fc023cd615fb1452d3c7dc3450331b076314f54c6beef4a09871

  • /data/data/com.zhaowifi.freewifi/databases/wifi_cache_db-wal

    Filesize

    68KB

    MD5

    cb6c5a47bb194d3f62542b3f711b0a8a

    SHA1

    e5f4a32991f62f620a41d9d4fec9c9e9208f0384

    SHA256

    19dfd11e030f70962039f2a9a6e10442bff760c488b252efe8145529c2e364ed

    SHA512

    35f8224f58d03109c354c31bd70270dc0d8d85a5d9fb170afb0c11e3b3559c97189b66960ff26addfd8f7cc01110644daa4b5a73fbd6ebf78bef1f9646e0fe6a

  • /data/data/com.zhaowifi.freewifi/databases/wifi_db

    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

  • /data/data/com.zhaowifi.freewifi/databases/wifi_db-journal

    Filesize

    112KB

    MD5

    bb126b7c2d6882c2caee7aaa6bddbcb3

    SHA1

    59880bdc02ff8dd499f6dbd65edefac649bcecb5

    SHA256

    fafc4c68567af1ebdc038ff61eb8fd60c57edeab0a92688c92ac4e23c6cafbde

    SHA512

    693d01fe4f6859de761ebe8af13f63b94b5fc4f88ffe7a157168328305dcfbfb5fbcc8cea4aa9260da49d482b3b61a01a2e1229e27353e846a1cc7690fcf329b

  • /data/data/com.zhaowifi.freewifi/databases/wifi_db-shm

    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/com.zhaowifi.freewifi/databases/wifi_db-wal

    Filesize

    84KB

    MD5

    3fe2a020c5f5488db72e7b9f5620dd9d

    SHA1

    e561a6ec2be79d43f3c9dd8e23ec41b978d92554

    SHA256

    f4c8bc393ccde70c7f62f0b0c33e9997b9473827a29a3db27cd37123088db68e

    SHA512

    4d556e2614797104dd10a0929898b9dadcb506836d49894c877281e3daee0d7edb1f0c89edf6bb558e4b74a4965fb58868e67591a053787d38d26173caf2fa7e

  • /data/data/com.zhaowifi.freewifi/databases/xlstat.db

    Filesize

    40KB

    MD5

    4dcaa7fe72057e21f7b1d18c1be99238

    SHA1

    69b7c2b45dd56ab1edef56c860724bb1523488cd

    SHA256

    85cd7f8a0ae458a1c81f75cf5961eccb2a9f845c0ee5f254b8ddc435bdfedfa7

    SHA512

    6fa7c32d0fbf9c7f4d6b7af30ad3569e25384f9b19d2faf4dcefaee20e88e4fc299afafbf65f6765f9dd5e041b61a76daf1ef86767166aab0150758d112ff97b

  • /data/data/com.zhaowifi.freewifi/databases/xlstat.db

    Filesize

    36KB

    MD5

    426db7185ab24e993328e2ef3dd882b6

    SHA1

    c89291238f4eb2c2835fc04b7c07d93c71f66174

    SHA256

    dadada53dd6d93a0a6815d29aff7848b5b4177f7a8725bb0bd36e69ddcc1fcff

    SHA512

    9e21aeab4d87d99e155d06f540473fcff5fde40bb282f4fd244bd055178cdf20713d2679baecc28c7e727e9146bd992ca503c2afe55cc7513f83695b9aa43e3b

  • /data/data/com.zhaowifi.freewifi/databases/xlstat.db-wal

    Filesize

    32KB

    MD5

    7d51b10b899eccddf4356d6f9fc5e4c9

    SHA1

    2805fc6d14fa7d5062b9b55a8ecfacaa6c5b99cd

    SHA256

    5469ddacc50246aad965769492b8cabb0a6aa87abffb3822fcba1e3990e1903b

    SHA512

    8d17be62ce6d58ec8e22465d3a5b5368bb58fec71d2e99f27e961b2fe2fccfad86e15b7f400c80eb5522df343c5125421bcc2ffb36da28a3fa3c4d7168d1d702

  • /data/data/com.zhaowifi.freewifi/databases/xlstat.db-wal

    Filesize

    12KB

    MD5

    d87e4ac962d28eec26156824c289d433

    SHA1

    5215e5b6c723092d0c2c0b64a0888045d42690da

    SHA256

    e206d6490ecbb5753534e725b52dc375522b41a4b3ef25738874afbef491f6ce

    SHA512

    001270503c553710ac50611d53e1f9a5614b474af293d7ff8443c2dcdfdf8c9bafe2f43e88355b74a6cd08ff257accd086e643fe044e52caca4bc663f114090d

  • /data/data/com.zhaowifi.freewifi/databases/xlstat.db-wal

    Filesize

    36KB

    MD5

    537d34acfef0742dab14632a1d2937ef

    SHA1

    0be64eebb6d7c183a832e073e857f8fbfcb3890a

    SHA256

    f914617f808026b027c8e41507d249a57ee78d61965ac2e4ccbcc0faede8d17a

    SHA512

    5733a03baabe24022409ac0dc2f4a663b85c23090e322170ca96f7dd5cd7bc6a27038ff12875d3140910ee406073499bf394cc35875a5026631bf5e49b811060

  • /data/data/com.zhaowifi.freewifi/databases/xlstat.db-wal

    Filesize

    60KB

    MD5

    aee0090ff8f1e143fb20ddff3793d7f5

    SHA1

    0c662e199f20f6df4e8a185cbe6a789a485a0dbe

    SHA256

    405b0f6ea73b721987f8e9ea47109c5b009e7eeac91bbdf98dc7003cb66d8907

    SHA512

    a47e50c3f443d31112cb4713e94c9ae8016d89fb144429ae7eaa0653d4b40e8757dd43967c1a48e7b575d2029161d2901af14533e48cc5f01e6deb2fbb635193

  • /data/data/com.zhaowifi.freewifi/databases/xlstat.db-wal

    Filesize

    8KB

    MD5

    72dc595100729e3c4e9fc409afc99aca

    SHA1

    1591d18ccc509dbd208eb9fdd93d35f2a7c287b0

    SHA256

    d4e232553d0a92cdb56dc14bb1913a7d5759f0279cf06b0ce0aaa0c368f191d2

    SHA512

    e88e09d0f0f4d4a3a6fdab85a9e820ac7d5ee97807582ea60ecc218854e6ef6d5f647663fcd04ba6f24249d75a5194e80dee9ded85f6f4fed847e0fcf7bbd30f

  • /data/data/com.zhaowifi.freewifi/files/.um/um_cache_1716301470789.env

    Filesize

    655B

    MD5

    46b27f5a5f2308ce6b72eb97b7c4b16a

    SHA1

    19c98edbda2a7d962eb2fce72e1496c657198b0a

    SHA256

    6d5fc0ecae3b3d8fce723902be6e97aac9eea2af0fd402b4a65afe53a5a75d8e

    SHA512

    cb6e1d86ca4f5a39b25cc865a431afa622d258a29b28dff75f11108b8341f7c282b867c6267bf8ede3c2292b83f51eb52483457fcbd531918b1b60706f3d6b25

  • /data/data/com.zhaowifi.freewifi/files/config.xml

    Filesize

    16KB

    MD5

    8298b494a4882f308e16701765e62b4c

    SHA1

    c5531a8e7f65bc023fdb07b7b03696d334d7cc2c

    SHA256

    c012836f1aac5ad0d52c1f7dc51c4bc64e75378cc91130d6f5c8d864c16090b3

    SHA512

    fc26f7cce58792ac2d535d6d7fde602f84b08dedb5c6ce6a6217fe9d6e4e1e8949ddc77b7c38fa7524bb8906173c7286043dfc0211f8ad45134b5016724f6652

  • /data/data/com.zhaowifi.freewifi/files/lfwfobserver

    Filesize

    169KB

    MD5

    7cc7c13bb0afa4b2d6514ac36b4bbad1

    SHA1

    404d71044ed6f497c2f990edb684a9270e614631

    SHA256

    9761173b8dbcd77d32d657f0972729ca288c41318fbdff0dfa9aa80f844517d3

    SHA512

    745546030421e42b92e800b67e8da5e1c7261c6d64b1a0b8231d4f0f54dc414beb8d5a953fc846c9f244cc2cd44b33050777e5e42885cb614f78f641681d7dd1

  • /data/data/com.zhaowifi.freewifi/files/umeng_it.cache

    Filesize

    310B

    MD5

    7608910933b1a2c7e7f5b19f2117bbfe

    SHA1

    476635704a62d1e37d7b659c322092a9275b7d8c

    SHA256

    06c6e33063ae713101a2961fe1755e2cc4041f80ad8ffaa16d36aeb443080c43

    SHA512

    84c8ca4873bb97435f64d69da02b3f8fe7308b69d761c49276fc1256a001ddf9be9e4642cf5c3f64398ef1c34524aec67df824b5ec2be8e7daf42c48e9db1e55

  • /storage/emulated/0/.system/system.bat

    Filesize

    32KB

    MD5

    519716beebf5e6475787481862a350df

    SHA1

    d57d891e4a373704fa42f2bd9c8720e236f9281d

    SHA256

    68c033ecf502191839d4147f1996eb5de8826072ba68ae0741dd931e95054085

    SHA512

    f7f45364dc5f11259aa60ea89e30b60b24e8dddeb4e7a662c3e7b03836e86a01812b8292a4251e1ced222a994b7f8f54a6278a1ccca39ed207169448d6131578

  • /storage/emulated/0/Android/data/com.zhaowifi.freewifi/cache/uil-images/journal.tmp

    Filesize

    48KB

    MD5

    4c9d68c10cb18f40f37c523c60b84415

    SHA1

    1cc24b27500547a10f5b9b0620d5d7da71764129

    SHA256

    72111e8a36de2c67449e5976fe1f1073147732c4ec71d9a1967588ca4492f5ce

    SHA512

    e8235a901d9a8807057a1920cf33647842cf2592f8c3581284c9598bec573907198b53181b0b0156c5c59ecdfcef8b8beb10c5c5aa1e15aec85cfb843994aa3c

  • /storage/emulated/0/Android/data/com.zhaowifi.freewifi/files/MiPushLog/log1.txt

    Filesize

    225B

    MD5

    bf90fe6a225ed6c092a36da8adc72488

    SHA1

    1d4589664159e73856346e8ca7c46add17042688

    SHA256

    0e71aae28db7332076323fa2d7c81817f70c1c670f4f43f6a00c734d9bb9c4d1

    SHA512

    07e9679d4f9cd997f66e89594c6fd20b9a553df4ba5afed47132e98b6059c660d1070f128133221de3293641c234fd4d901ff2c65de1ccbc66ab7df79a235700

  • /storage/emulated/0/system/android/ad/ad.dat

    Filesize

    24B

    MD5

    f4b2c363a5befe91e69bc45b325bf411

    SHA1

    da365b123f83fee2a7ebf29d3120f363e4576e2d

    SHA256

    46d0885346a8b989e89492000b905285eb376c9e5b4ca822485c3326c877775b

    SHA512

    c0bcad68626d7508748396b5253c8338a09bdf4d12628312d135b2d6332a9809d2c467bb07781607ebef6c07226bfd075cce7a5c978d0d39d9b3e073ae792bc8

  • /storage/emulated/0/system/android/data/zhaowifi.freewifi/devscore.dev

    Filesize

    2B

    MD5

    142ba1ee3860caecc3f86d7a03b5b175

    SHA1

    6e956e31476ccd6bea194a2d6e5e54d66bd3281b

    SHA256

    dedba7762ec349c2d16e9199752b17f374d6f83071d29b09877816f390928960

    SHA512

    afeff9332ae66f946c36cb077ca8eb02a2168d1e0634a5d04c607beb2b20abf893b18e30c5061081c7b0b6886d290a970378df7a05c565506c7e6c309d9532d7

  • /storage/emulated/0/system/android/mobile7_pluginapk_20140920.apk

    Filesize

    399KB

    MD5

    caa9ccc4b7528337a36606791d5dcc00

    SHA1

    7820059a3d9f65a1c80242ad3d59a0e420696ff1

    SHA256

    7539dc15447a2059f8094dcb043ea680ccce23e6afd00330085d6cae6d18a112

    SHA512

    24103c0adbef887c68b79993aa68ba361a9baa6f553ccc48bfbb9cd7b44828440472cbbf7441282b0e5cd44ed3a4e33de5f2e1cbb546172c6189552de9d9a0d4