Analysis

  • max time kernel
    127s
  • max time network
    139s
  • platform
    android_x86
  • resource
    android-x86-arm-20240514-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
  • submitted
    21-05-2024 15:17

General

  • Target

    63c241381ac7474cc47efb5cffa259af_JaffaCakes118.apk

  • Size

    11.3MB

  • MD5

    63c241381ac7474cc47efb5cffa259af

  • SHA1

    3b2caed81c1d5d6a288e79083613e9db6ab4d645

  • SHA256

    320d511afbcc7a35870d65bc4e5453590abfc340b5e56f839901b38b821af253

  • SHA512

    e43220b89ef5bfde1e956b08c46164f02e5e0aea66ddae44e8e078a881e8c2b935f0a993cdae85e83faff10202daa0a66481f4f7f60214c73c28501ab244cbe6

  • SSDEEP

    196608:e6XFnSguCxMn/RwgmPFOW8bPRAQEppZR3jIrOcWTZVduvCvqO44YWojivVMKi:bX4TAQZeFOW8bP/EppZVcryZUgS47mSS

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 3 IoCs
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries information about running processes on the device 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Checks if the internet connection is available 1 TTPs 2 IoCs
  • Requests dangerous framework permissions 2 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.qq.reader
    1⤵
    • Checks if the Android device is rooted.
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Queries information about the current Wi-Fi connection
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4254
  • com.qq.reader:pushservice
    1⤵
    • Queries information about running processes on the device
    • Checks if the internet connection is available
    PID:4305

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.qq.reader/app_midaslib_2/libufoPatch.so
    Filesize

    84KB

    MD5

    e109fd0af788c2ccc39cc18d555a08bd

    SHA1

    9c47a54f9501c229340eb99f8b9d76ed48b325bd

    SHA256

    59db0474e441ef5fccfc9de660e1347f5da9815893c18ef46206e8f0b96fa4ac

    SHA512

    b6596485b2624db155ad1d134fc65a2fceea4f68379e428b4294b6936d5f5cb862bdb6a411352763f9954b0bced0f44d31f5fedf5553eea4b8610b00039348cf

  • /data/data/com.qq.reader/app_midaslib_2/libunipayutils.so
    Filesize

    13KB

    MD5

    e1bb63177e7ff007f4e0efb467113a4e

    SHA1

    acd580b093aea8fec9acdb045ddf359f6fe094eb

    SHA256

    0d65d1232701f00e322b18bc4026f73e51ce77188c77c0070f5850bca40ba119

    SHA512

    a9a5371e953ea4e4c0946f4357a86d4c9ea51b32b82c82fe957590155294b95936014f964cf9a498807ead564485b27a4aca7d4d9e66224fcafacea365cebfa2

  • /data/data/com.qq.reader/app_midasplugins/MidasCFT_1.5.1d_34_fefa46db17af090a6901cc91ba53929a.apk
    Filesize

    313KB

    MD5

    fefa46db17af090a6901cc91ba53929a

    SHA1

    403806bcaaad17df9850815fe6da3626684166bd

    SHA256

    004834606899dafe2726552346c23e407a1c7d4d236891755c778a6b9416f773

    SHA512

    3e603739a4e605defdf8f5c96c2f545772bb4b3da8c4547a31fec69159e36f57a9dcaf29a1688a0b2e6b12860f4535711c28d1ec40d609d3306413340801a88b

  • /data/data/com.qq.reader/app_midasplugins/MidasCore_1.5.1h_38_e2f6e77a61b7693178b5722304224541.apk
    Filesize

    2KB

    MD5

    e2f6e77a61b7693178b5722304224541

    SHA1

    bfa86b3297f75dd3abceea5d0fb1e2969384cefb

    SHA256

    823d1bec9d3a2f403f3313575b104da36313a028436d59d8e108668f00de3329

    SHA512

    781620116a456c98a70bb92c27a076670c6203a918be86cebe21b3c65b378308c92d9979fd399edfde46f6345c7ff266746f19e028c9def59723ffa68cf54236

  • /data/data/com.qq.reader/app_midasplugins/MidasPay_1.5.1h_38_05165adcf3a7e6a4014936f44004f86f.apk
    Filesize

    819KB

    MD5

    05165adcf3a7e6a4014936f44004f86f

    SHA1

    5504843b6fed6fa8ce7395eaf40f23c504c490c3

    SHA256

    5bb11bc22ecbfeeb47b0adc2d8f6d77a14ed371a2f7b1f842bc723c7c2e866b5

    SHA512

    386355a15ec04ee8c874663c7e96fefa9d75c57e6f833ffcf289dc639507e5c657a1b698a5f2c7cf6c1fb8677f4cfb6cefd9d6650ae836638f98db9c6154657b

  • /data/data/com.qq.reader/app_midasplugins/MidasPay_1.5.1h_38_05165adcf3a7e6a4014936f44004f86f.apk
    Filesize

    1.0MB

    MD5

    dc7a72c782458e7bfaffe00446c92d2f

    SHA1

    fc2324ba511e7d89a9c7793712175c3d8777c84f

    SHA256

    676b42a1ae3acbc3c1eaa9a22a187dbe2d8b47e31547b68d16f8bd0103d8750b

    SHA512

    74048c6b1615eced916d95896c1b10d6a328e5b210ae3561c338d595c5ec71e1ea00575d9518c722ea588ad79e712f97a0825da736d1e76a74c0b8c3befa0c57

  • /data/data/com.qq.reader/app_midasplugins/MidasSign.ini
    Filesize

    1KB

    MD5

    0b7746c9e890467a0717de7126d2b341

    SHA1

    492984eb80deddee069525418b8859e4b3c26ec7

    SHA256

    95ca8f656d722e80751e0271c6f69d10843e1730b6d797a2dcdeae28cb412792

    SHA512

    b61c522495c483ac2088ffdf45d532885f23df6b4d8fd999b082efcdcd79b32af841f8ebb2623ce3fbd98a75dcd8762041621cdc7b20f3e4d64f43c9ce74cf8a

  • /data/data/com.qq.reader/databases/beacon_db
    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

  • /data/data/com.qq.reader/databases/beacon_db-journal
    Filesize

    512B

    MD5

    9c99b34b218c780295a4104aa5272b75

    SHA1

    98878719519e3a7801b2aa5c5e62e37217dc9e6c

    SHA256

    2efd6e7e58de209ae18f8c6dce2fc02358db2f46ff8a335b8777c0699934bd58

    SHA512

    adc7d29c41eec2afc05ed4aff6558477529fc79ae455beedd389aeb9361447ca135a8db9f0fe73f2fd2fe22580de82c7708c6ba842c12715f6fd44fac658b20d

  • /data/data/com.qq.reader/databases/beacon_db-wal
    Filesize

    100KB

    MD5

    47918c2b932f2cb114806e4197c1ef4d

    SHA1

    76d4a93b1dd13384682caf0b0223009882413968

    SHA256

    3d2f0daabeb4bdee6a729234f2edd52643e3b0e293773df4729408bf98d11d7c

    SHA512

    12b2c3d08e90b41f8c655081ee605db19997c2bae298a1d81fe90148fb5745f6156104fa5080426027f0135e2b151f9225a4314378fa1e2394b0c4cd0815a7f1

  • /data/data/com.qq.reader/databases/d
    Filesize

    20KB

    MD5

    f568bb3d6794894d304583ef5fd193a5

    SHA1

    5b3445ef6e0d18a68bf7c56eb66abc6195e94e81

    SHA256

    9e3d781a426e6846ffdce553a7db74c9ce187a432e3435c9aa6841efb1d1d782

    SHA512

    3c785a298fe967a10953726c02a0bbe49448b07819d42df7100af9904be472dece545e169c9b24d852325d2666b86dd5da9f21e6f9915387742919d33ec8c897

  • /data/data/com.qq.reader/databases/d-journal
    Filesize

    512B

    MD5

    a4846d8e79428f5111153d829ce0a3c2

    SHA1

    2d551e037b8772bc3b6d7811b09208d4addb2370

    SHA256

    3c095373c2e529dec7bab78dddaf4a28188a09555db6c8395cbb09c41d5e4617

    SHA512

    1009c973d5c63217ac2df7bd0e235afe13bd50c9e30db754df04d98a076a64ea03d4329948179b1839f90459454bec587ae84aad5693ace84bbbe0dd1a70de4d

  • /data/data/com.qq.reader/databases/d-wal
    Filesize

    32KB

    MD5

    7a353c72aa2da998bba0b869bbf33d64

    SHA1

    ebb13f653f3c7e79cb44655b1379913d4e82f5e3

    SHA256

    e50737ce587388bab9533eef0ecaeb38aa5227b4dfe962c0c1e40a8f02a7741d

    SHA512

    2ce55f97d40f0f833d9da4dca43ba1a20fbcea663f2e56f20a0c111ad95ca1f7a52359789312b1bada4d26863b6ebd7184f90a5f126730d50c33e9877f17b475

  • /data/data/com.qq.reader/databases/eup_db
    Filesize

    44KB

    MD5

    ea25a44c5f7c3d2763b0cec8ea033906

    SHA1

    d4fd1e205f7ea89a879d8ac5bd8b0251da78f8a3

    SHA256

    f0319d89aea03a0cc6295b5a43c784cc4f91954e141c520c2b9e8070f9171837

    SHA512

    8f13640208499d841e6c0007909d2bab4f14e33ba20cc6e6440c429a7245bf352cc3fe9bd0538033668348415fbc20c9807fcee7201dba48e1070f56ab859cdd

  • /data/data/com.qq.reader/databases/eup_db
    Filesize

    36KB

    MD5

    86002f93f3534474d67705857159dccb

    SHA1

    1bec157b8182cceb577dd858b2e39da422392a88

    SHA256

    fd4cc7b56dda95b1b1411865e4f1beae283de20bb7ef488e9905b67634b3be52

    SHA512

    c449e4d70fb07e97f9c308a15dd905796fca4864fe0f20da81f6a7185e8408cf05901ecb700757393f08e239214f3d97e6c8864999a1089fa6ac23943c0fdb54

  • /data/data/com.qq.reader/databases/eup_db
    Filesize

    16KB

    MD5

    107b3346b0e5478ac422e2133f98b38b

    SHA1

    f6cb0ba3b4e5eae0915f139543e1e27fc0bbfa55

    SHA256

    ce79ffa4834b3a63ade6b8640d3bda698cb580c2e6692ab62ffd01b2ffc9cbb2

    SHA512

    aa9e019024f232ca6af1a50feb57f5abe1cae4487979d976abf6e02954a8496f3d3a825d3dddf27630deb8429f8324d92114d7ea5f80ef695f051b1d1d4b7763

  • /data/data/com.qq.reader/databases/eup_db
    Filesize

    16KB

    MD5

    7659e3c55e54baf71e6365c3a7515b60

    SHA1

    0eb50b42a7cc8732a1f34725939ec6da2702ff78

    SHA256

    b26bbf5eceb9663252556ace121d7f5717ca7e89c8761062117f203e559d75a6

    SHA512

    5586389023611e4b14d68aa109e2f7c4583a3003f4341e99a24055d2b7fd54f84582e17f2932d614790cf5d89efdc976d683a885938b9b5dfcc92b97a732c1b4

  • /data/data/com.qq.reader/databases/eup_db-journal
    Filesize

    512B

    MD5

    a01abbf7549839847872e709add65eb3

    SHA1

    fcbf9616dba3e4532672a4bdc74b202524c49794

    SHA256

    a4114db818c94ed8f2cfb6b1599ea0c74cefa83ecea74ea7cbea3f143f1df1b7

    SHA512

    a84fedfcc1fb9b5ed7c14014b28fcd0b51b4a30d1192fcc21f7147c9f80ada074f25d0a5fd5cdcccc115bc6e9cb3f84691135180e57b00239e9023161136fa28

  • /data/data/com.qq.reader/databases/eup_db-shm
    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/com.qq.reader/databases/eup_db-wal
    Filesize

    4KB

    MD5

    28130d85ac19777ebf504ad2c01d68af

    SHA1

    7a9041285c99f2bb57d42819061a648a27c5fe43

    SHA256

    5631cabf629fbffdc5e4e284182d32431da78efb2a2e5d41ab1840bdcb6eb377

    SHA512

    e33e60c2ec04ab128693dfca2a0636f41fc6c23cc1700e383708151ba97c75c41c77a797cda9060a4cbab3196f36db925d9cfd546a3e54a3920d1ed287cd3f6a

  • /data/data/com.qq.reader/databases/eup_db-wal
    Filesize

    56KB

    MD5

    0c7ec5431b130d3c7d4aff4ba7e1d63e

    SHA1

    f176649186e35f5553d21ece73f072dd28660168

    SHA256

    4a3cde6e973843740d111edf9eb7b4bf57ad656eecbd8c65efe04070ccb754b1

    SHA512

    89a8bbc47ba0b635aa756ea893039bd98d3434f6cd618407e8c6ea0fcb70dee28cd050f4477c333e6ff213ddd68650c471f80e100e79629ca0db0ffe19988816

  • /data/data/com.qq.reader/databases/eup_db-wal
    Filesize

    8KB

    MD5

    ae75a613d1e2c53411409797ea873571

    SHA1

    c892d4efea4de5297a74a615de55380d355d7313

    SHA256

    f34614c99d87d28f0d587dcfe1630f0ef0affa7b2a721fbaa0ee511db722a1bd

    SHA512

    4f0eeac3f4b7d659c28d66088cf9741f395a370a20cbbf1721f76f94bd367cf81e642b3d5d103b2e670a2f0612e90886562ddf725d02f3831f5d04b67ca928d1

  • /data/data/com.qq.reader/databases/eup_db-wal
    Filesize

    8KB

    MD5

    d4ab098041ff17f882789f780d6ed368

    SHA1

    66ea92071e66381176605056329623b477a3d105

    SHA256

    b6406494963c4f1ff1f13cbe3ccb767cd5e17becb1ce7a7924110033399b17cd

    SHA512

    f09928c7f39002d95ec31d167d8f7916c402bd074f06a0224a4da06db2ed037ec84de5f4737ba92fabf50b1e5ca04272b86e08c4a068f8646f87c8756e3c78bb

  • /data/data/com.qq.reader/databases/name_file-journal
    Filesize

    512B

    MD5

    a7aab627f8d1ebea3b797b6c104ef086

    SHA1

    91fc2b096709544137edb023ca8f5828aabdb8b9

    SHA256

    77e6c825bd91ba2988126b41da847f7c6601fdb16f132fd1587a6121e51c86ee

    SHA512

    a4ae146084cf650f57ba6b023a3499f2797f2cad1b30cd6a267421a00d2e5eb34b983518682944bf100ceeba3a8149480ffbab45a35e7c36f86fe3791b989a20

  • /data/data/com.qq.reader/databases/name_file-wal
    Filesize

    20KB

    MD5

    58cd9634a385f32bcfd6c73fb7c1c9f3

    SHA1

    51d8ff43f601fd679b0c487467143f0f1463f859

    SHA256

    4c891939664d89f28ad682fec9f251d8698e0ccf54e1e9a2cb40eb387fbd3062

    SHA512

    b4eae70b01f27009c08571324b48fb87c6021e6ad2ba63a447180f4878534266c74c571d40c855d146ff19b2b0fd943aa28650a21174dbe5ce23d8e0feab77a1

  • /data/data/com.qq.reader/files/tencent/wtlogin/MjAyNDA1MjE
    Filesize

    81B

    MD5

    33823d2335c66128f89db221b330d999

    SHA1

    e229269ca9ee29b291fb09aca012d36079145adb

    SHA256

    f72656c3749a9eb2e0c67e0c3f3f88750400fc8407727f80c0b345a2d37fe84f

    SHA512

    02bc5a2b1016a68876eb1d386f47c0701fca3c28002f0992d40871683dbf12ad168aa7704de2a1acef6afdac2178d460281a019e50c2aa70029f8cf7e0cb5ea9

  • /data/data/com.qq.reader/files/tencent/wtlogin/MjAyNDA1MjE
    Filesize

    493B

    MD5

    9ee6bf8be913f6c37eb0d5fa30d7f046

    SHA1

    f75ccfe38586a62fd80a410c660d49bd52f78202

    SHA256

    bde1c0312c70dcd245801c091d80ab8c8020f75cc7169b81e629a3a03b352641

    SHA512

    491f2306d9ce8ca2291067ddba1fc2f6b0988103e001edeb008feed6138e414f3f65cd06bea25f4383d784340bb3a4a17bf71ace9bb2dd464cc1963769ab913f

  • /data/data/com.qq.reader/files/wlogin_device.dat
    Filesize

    16B

    MD5

    9e136747ab40f4c41b6e1e1a888be5fc

    SHA1

    82cb5a16f650996106e1c54cf6a727ed3bed6c19

    SHA256

    24335d9a994fc24560077db890d3ee75b8598ef4f5afded121535be855ecd6e0

    SHA512

    eadc454204c4b66b60bea7811758aa796ee75d8d02c0404748c314ab9a0cdfd4ff00bfbec1b0364ae5b3b4dcd83727fa4f9c6b3570a394d3a22ce225a6ab96ec

  • /storage/emulated/0/Android/data/com.qq.reader/files/MiPushLog/log1.txt
    Filesize

    219B

    MD5

    cd244d63c88247c49384c8358fd275d3

    SHA1

    2ded8277c771df3bc203624b6bd7dde509a64dcc

    SHA256

    137c0ac6a842ac7b9edde065fe4d275c7446caa6af8d7fcfedbaf655c1a5682a

    SHA512

    25b9a25dcf9cb3af70f853437a5070418b4fc7b37fbc785a6777d88245c9e8eaacb8fbee8ce42df17b8ded0aa5f69fd2c04864a9c281fa6c3b97bab7e0dfb764

  • /storage/emulated/0/QQReader/bkd/default.db
    Filesize

    24KB

    MD5

    7c1fc43b7a8e0c9978feb5fcb58cd62b

    SHA1

    f40b50349fbfaf77369b8a9b141daebcca69c1ed

    SHA256

    8a82b31e3ed8d1b74d28c01384d6d3a3513afd9801860d2a3facf2419b7a5137

    SHA512

    e66ed7baaac2c8a21606d24a0b24e60ba64f0d1465704b3b1cac813823ebae07696ab6c20fb013226c28851e71ff0bd498707306354a2fabce9d7cefed9f1d58

  • /storage/emulated/0/QQReader/bkd/default.db-journal
    Filesize

    512B

    MD5

    232b4193db8010a64337c9190fdca466

    SHA1

    6933dc2d69c1a447f97e21d191d0e00451392014

    SHA256

    5dcd08aa5795173859ee3af145febc4c03bcf8537fe0b2f92ee194a0c4e6ba9c

    SHA512

    7522496e532aad97cbc86b02d3e372652673d88015dfc60769951df9aa195899ade4cb1d725f5e3c5865ef7360ef69c2eb23e29c468c00a898103a9afe345e77

  • /storage/emulated/0/QQReader/bkd/default.db-wal
    Filesize

    24KB

    MD5

    21b71938de3e56baa4cb5421447531e8

    SHA1

    e265fe12868972ec41ed8ecab611df4f17b231f2

    SHA256

    49eda3e7c4c3897c9e65fd39d523203b8d162c856bfbf00876bc5a25ecb1dd09

    SHA512

    145aad12d6464e64dd53359edc1b1820719af52f4f5a1c12a53b529c8a3f6a229c18bf01b3be7527dff7812d5db91b1ea75400232e492df25bf90d543283bbce

  • /storage/emulated/0/QQReader/config.db
    Filesize

    4B

    MD5

    48cb863c0ea7b8a11cbf50bb2a5a9b78

    SHA1

    a10ecd522caac9097879c19b34b4bb817d4ba696

    SHA256

    950c9c8e9bf20ea792a35ba13df3ae390f1ee9736b2bc73691cd38ee5d6eeb0d

    SHA512

    89e0557d1876105da06ab5c38d69b3a017a2b38b01443b3709a32ecf0d0713d8c15ebbf205897a28e009e172bad5d3d379eea0ad770f1cbeec9dccf0e568449a

  • /storage/emulated/0/QQReader/default/journal.tmp
    Filesize

    31B

    MD5

    8c92de9ce46d41a22f3b20f77404cc1d

    SHA1

    8671a6dca00edb72be47363a7071be65cf270373

    SHA256

    68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274

    SHA512

    30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

  • /storage/emulated/0/QQReader/skin/skinlist.db
    Filesize

    16KB

    MD5

    f8788d655c0adf89d9a53630dc88022f

    SHA1

    d0a2faac6fcd0eb625901cf6893b12299c1df4ea

    SHA256

    e20cc4343bd0e44da80f40eed48e895a374a7c8d2718e39dbcf6355759c4104b

    SHA512

    6631ba9afabfd155f006e0030980cc4811980fcd60ae1b019d4d2ec9a7a17b873b85cef93f6dc5f805cb9a127344917cd523543ed5844d48cd9ab641798c4b5b

  • /storage/emulated/0/QQReader/skin/skinlist.db-journal
    Filesize

    512B

    MD5

    a2e28d92eb623d4b68ec211450b03357

    SHA1

    9da284c5adc39bd4348455c0957fa6074af69ef0

    SHA256

    900b466c7176eb8f38b142f35c2b829c27cfcf48aaff6bd5309de70784f9cd83

    SHA512

    42ba00d65db6a8106fec8af61fd65799c1b56fd7d04ffb033540df5beff5d9893bfa7999a5975413c35de4ab0ad6133130c8cf636d4d7e3a9ebbef409a58dca4

  • /storage/emulated/0/QQReader/skin/skinlist.db-wal
    Filesize

    16KB

    MD5

    7b6941f57e93cb2afb4691490eaccd40

    SHA1

    ee4cea2cbf27f8673cf45d112a4d9eb62da9c9b9

    SHA256

    62495728108b7318b46d34a15911d0de157d15b6bda41dceea945e06fcfb99ad

    SHA512

    817dbe013a48d22e027b095e94b5be4b2a165fff64be1bb0c16047ee707f9c510c8ff5decc1d4f26dcff89f2d65f7a18402bcca0d73cb4a14a7506c899bb03e0