Analysis
-
max time kernel
176s -
max time network
183s -
platform
android_x86 -
resource
android-x86-arm-20240514-en -
resource tags
-
submitted
22-05-2024 22:08
General
-
Target
68ce2b64305f4458b3b1f259c181912c_JaffaCakes118.apk
-
Size
14.5MB
-
MD5
68ce2b64305f4458b3b1f259c181912c
-
SHA1
a547984caec6313f6ba7359cfda009268647067b
-
SHA256
489a9cb3e9f9ceaca3bb3e27a84acf3c21abcc5be686e98214296ae98eee4284
-
SHA512
9b598e476b9da11759a719dffdd0270d13788189f9db97b0ee42d0dd18dd16284613e8a9aa5f1e3575afe861c19cfa48095d7718d6d4881bc8043e41368c37ed
-
SSDEEP
393216:QmIse8nq4yNljPXAKf9UvvP42QZHjPB7u:QmIenqdzwKf9EPRQJs
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 2 IoCs
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
-
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
-
Loads dropped Dex/Jar 1 TTPs 9 IoCs
Runs executable file dropped to the device during analysis.
-
Queries information about running processes on the device 1 TTPs 2 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
-
Checks if the internet connection is available 1 TTPs 2 IoCs
-
Reads information about phone network operator. 1 TTPs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs
Processes
-
com.feichang.yierduo1⤵
- Checks if the Android device is rooted.
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.feichang.yierduo/.jiagu/tmp.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/data/com.feichang.yierduo/.jiagu/oat/x86/tmp.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
/system/bin/sh -c type su2⤵
- Checks if the Android device is rooted.
-
-
/system/bin/sh -c getprop ro.genymotion.version2⤵
-
-
getprop ro.genymotion.version2⤵
-
-
/system/bin/sh -c getprop androVM.vbox_dpi2⤵
-
-
getprop androVM.vbox_dpi2⤵
-
-
/system/bin/sh -c getprop qemu.sf.fake_camera2⤵
-
-
getprop qemu.sf.fake_camera2⤵
-
-
sh -c ps -ef2⤵
-
-
ps -ef2⤵
-
-
com.feichang.yierduo:pushcore1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.0MB
MD50cd3889249a5c8051fba7021cf5bf313
SHA146daf7930623fcb4e1a911959529310767b73299
SHA2566494af47c3c4fb939be22da0f18913466b3624e07fba0d5244515845b52d6eb7
SHA512f597f4ced0bede7438dff36aedc7fb1f589a7d2a3049064b7e030629e44d742483b25b0817f36f18619212b05cb3315ee5ea0e3df6e05155d744a7836d93b714
-
Filesize
3.4MB
MD5745756525e4210290812c34f807cb488
SHA1cf5666abf4399847dfeeb5f6788dfab5e909f3cb
SHA256a8fd669523ebc0af7142d54a1cc03850948bb6552eecfb34a21cf28cc3a70f00
SHA5120122db1f70b57d1eb816558fe1c532fcf39ebe7f55ccacb2930c64354dd907804bf3de3e26d809b065ed1040e927166f6145a1a708f30936b51c2051e9704897
-
Filesize
475KB
MD55aea02f4e4c77fbf2e7a27f7ca9cc06b
SHA1522db1748608e9173547b29b7aa82ddc3542c534
SHA2565a1c513b347e2a929769e2be67552c1d591704f08f7b5590282b66cc2c7d7bd2
SHA5125c979a11f5e896829db906f533756efc1cf3c5a7e35ecc9e376a0aae818f2dada013441649feac2e188bd51affbbf35156e32fdc6552e185bddbc547f3850316
-
Filesize
284B
MD5f1771b68f5f9b168b79ff59ae2daabe4
SHA10df6a835559f5c99670214a12700e7d8c28e5a42
SHA2569f8898ce35a47aeafced99ea0d17c33e73037bb2307c7688e50819966f4ae939
SHA512dae27d19727b89bec49398503baa6801640540355688dfabbe689c97545295c2c2d9b0f0dcd7cbc4cfbf701d0c0c3289e647a152f49ff242d1ecc741efe4145d
-
Filesize
21KB
MD56f0e4dc0b14d74f0620dbad7d8c21e59
SHA1075d224b80cc6d49659e65a06515f1fe424ef84d
SHA256ee752fc56a6df96b7c327f9a3529e23bcbce6a9f37ca4518df3096e4b0f9dffb
SHA512350523313b84ce8556d7a3d72c82d7989c452c523ca9811b8cdb6b9d5a659a4e4c01e9be6db5a97a438adf71e4aaa660f78747487b6e8f49897022918727b94d
-
Filesize
179B
MD5f217d889264ee3a6e3000c99f7d36ac3
SHA1d775a13fefcc315d81122305a89a1fc4197b5e18
SHA256f0a01085a3240dc698584837ec5fb96e1565f3f69e54b626e64367cbc6dc79a3
SHA512b8e62d8ce0e52f6a3564afcc4e6dde43b5cd457b318481e08cf2162e06f5a745c5a392a7fe31552f50ee6dd65166aca6168b55013123b5263041876077e22fb8
-
Filesize
31B
MD58c92de9ce46d41a22f3b20f77404cc1d
SHA18671a6dca00edb72be47363a7071be65cf270373
SHA25668bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
SHA51230f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56
-
Filesize
36B
MD537e8e716e0e2f4a0b05cd9571d95b84d
SHA1f8d068f6931707bddb8cd69f706f2224ad1fea3c
SHA2567080cb592d5149c858b206d3fd0d5e3e7d601f120af00b2616bee928ee1291ca
SHA512e62b850901835fdb73fa6224618422f721dd765861d42f6bc2dd013413e96bd910ac5313afd9b4f63da74beb12a15fac81b5157456c9caa3031862dab84423f6
-
Filesize
512B
MD5cb921f448cf1078ff69db4c9f52c5e0f
SHA1997b0caaa941c62b89d1644b183aad6a6ab54d42
SHA2567045d96d35e6c523f7bce3576083e07d98d8c6179dd3206f232cb3371f66ea67
SHA5125328eaadf8f2d2c1ffaadfd976db14b4758867b4d8c3e5613f8a92edfd3424c3cad1d8d54947fbd75e928d3264d3e31d4d65759d76071ca9ac4f7a13921550f8
-
Filesize
32KB
MD585e5b7c9264116a404112f8512c97da5
SHA1ba73a2ed0616012116453bf54495e236df2baa8a
SHA256e8aa3837144260d459a91b3a55999fb1a91f6f14386dd9577459d4425a31a5bf
SHA5127927b6e3f4624d321eaa2f705eb071d845cfd3d991e18fca735be92e3d01dc16f4f0d21ad3d584b83f36b8b7c2f6c81e2de5c1166d8ccae632424bb69eb4fcb4
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD5efec2cc4d35c20ad9f26628f7e159014
SHA14b3aefe1525b03e4488dd2665a219cf9d41f2ea8
SHA25626a77cae9d0b25c2ebdd1fa76ea49abcc8d416c9e47efc14932c33f86c906653
SHA5122f58ea78958d95b63c9f74992b211e3d27c47d3c2dd3afe622df9e35c35380b1882a3f2cfa5aaa3eead803dede61f1a73dfc3319019bd3a54f7664b36f44a736
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
96KB
MD5c62035a8aa8587a8de3dc4db77739c4c
SHA1a85f5a6c7ce90c8acbe4be316ad0674db6379a7b
SHA25699d10423f6b76dbe2fd688331f7f17233534bd5d28027dd57dbc47fff43baf7f
SHA512488a180bf507d75b9cb7ad5641c562013a51facc61b3dc6312b3d67c03bbb104e48d5d137c79b86648b1e62df3240b756940ae154245b352ed381aab922d9d92
-
Filesize
32B
MD50d930c9386ba9e004da5a7c805e066b3
SHA1421c3febf5037b3924449899c5bc7f5401ba361c
SHA25652e4d050b77560a032e252aa56e4e251af716f6f645e3646b5f5844b076512c1
SHA512cc98814cbb319fb4201f2e2c852ee2d6a985f832db48875f85d6cb792b3f35d10a1ea63ea361c7cebd3ccde7f5a4d8df4e62a8f6d62652ffa05f9390135d729c
-
Filesize
40B
MD51e27ddfd045e8284b02939b2b6040a86
SHA1de4fee7f6c36daac9dd678b2846b320f31583df1
SHA2561e93106e1ef6e3e507bdf8324102e7026bca1a2899a526e009b3d7e60fd433d8
SHA51250af0b03907b50e6da96d6c35b963e8cd0de587ac723ce55d3624646e4039616d760d9fe2891663c80e4fe2221802f6cfafdc010809a1c2c1f1eec08b386c667
-
Filesize
32B
MD5f86290ac1b1d3b7b4688732767f1324a
SHA1f5f58c47d12b4bec02ad594eff83bf0410a69c57
SHA256ff2a2c16def0696c7cf1e7ab66b885d294b0023c3f8e3f414df65cdf8ef03c14
SHA512cd271cf31f8e171597936d1beacd225a30ec6346efaf9bacd37755b83a1ca5058a58dc249c45367c7fcdb583bc2fcd909d320636f3cf9092a008261918f09154
-
Filesize
73B
MD58f2dc7a5996685b070ea3f18f76950cf
SHA1973b5619c77396ecb2305b0c8c002922a854a069
SHA256260679153e154ce462ea65d7322785167fb6c4877955508a8a740eb3593b7796
SHA5123fb31ee64d652f8dd02e1c0e83e61e4cb48821d705b1233ede7974bf9ec5cace529e0f41f80ed74174981935b87c72001ff0802d33e10cbd57d55257fdbd9e2a
-
Filesize
350B
MD58602bcc384cb0ad99e3fb84014cdf8e8
SHA1e4617c7127fc41235193337592bb555a8fe9aeb0
SHA256badfb59f1b255e9b25747924f5e57496cecf879f2b09313008b4d9e6dd868359
SHA5128ad1a030a898e51e93e449db47bdb4a912d8dc8dcae0a8f613165ef9cd37c9a82a9350107f79bdc92eb15303fd70cf5dd3f2b83b677ab26a78b886d56349698e
-
Filesize
314B
MD597ce43b7d55406c7803248e6904e420a
SHA1ae1db2b9999807525afa964be94956914c3f5304
SHA256b70004a5d21a45565bf37ad9b59b038ccbf09c305e0c0624f354f032eaffb916
SHA51256ae74306dda822c0a0dbbe0ee6bb4e2f07e2e315c62a67466c11510577cec956bb796bef2b02a02865d71b2969e9ffe2275104ec9741b9368815bf9ebc983bd
-
Filesize
32B
MD5d3c6075028bc785a3334cdeeb5d4b383
SHA146a4c8952820061c723b752949ea62b333361ef2
SHA2569010407c9477f9f4733657e3129d6ad8f4979789e738c20a464bf52ca5c1201e
SHA512c96977a4add7ee941574d39ee4c023eedaf0933a6c782251cab00dc7db89d3238e336c12c98bab3391b3cb1a9c9e27db1a24865892e95777df9f2ff8c0827ca0
-
Filesize
27B
MD54013d8be214357a719be6959c4a068b0
SHA181630faa96d025ea7e3acf151fa46b5acd1f19e0
SHA256bf3ca363ab5e0d240a8d5b396f568ab553ffaa7352075b1e192f6c38504ff215
SHA51261424f656fc8074b009194f890a9f8e8239fa997fe4d56c1925a77eea53d2b0da3dca189d24e527f56dc6d50d234a1d36c26cdc44cd9a8b6a77339453ae34b9d
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
Filesize
23B
MD58e24e79baab91c4d0604eaa9006a0cb3
SHA1e427afc94a4b957a7096f73e395a10ea404c076b
SHA25665ee797326cb9d94a4c8b13fb114a7273d80af9ae547496bf56556c479f75e4d
SHA51245bde5e1b5da5e54f7f5baf24cf4d9158ccf5813f0babc05677437bfedf1d54c4707090a1c425089e8f9582a85fed80b25c1e1f30ec2051afc6fe68bb8a76bae
-
Filesize
62B
MD51c2797660325cb2589b04f8b1a8443ff
SHA1d34a6effab85b0b6667c43765b85aed8a1382645
SHA256526e4eef77de175f90202c8bf87402d66a435e6864c59ce84dbf5abab18d330e
SHA5127e48fd93dde39e119baa4ededad349d9f740fc32e7870efe565402d9389086d6c0b403be79e6fe8da448b9effb6b14e7d366f36f3ecdd87e22d00b8982cb6376
-
Filesize
86B
MD57b5fbb939dfb2a6d7af521e4c5275f49
SHA1a0b006040414f300ac6caef4bf286d14bfb5673a
SHA256d6852973ecc9e186b6945bbd1d36979525ab1937ca6be06ec478aad25988c0d7
SHA5125112bb9544840e9d464a72e1a26a2042e8b94faf8a60fef40ca9277b2fa0bbbf414a1dfe891d73ebf08b7107db65ea9dd8567fa9227d1388bd21b977c9c83e7f
-
Filesize
195B
MD5ce028bbf7cd4d0ff3447e043fc72a268
SHA1b137771b8b8ed1c56d47ab68bce21c6508a8b988
SHA256a56a763667e8db1e7e8fc8424f713f6143b8ff5a3f50e0bced127827a7c385d7
SHA5128d6c3c5620e765acdb451f514e59c57e1779eff17ccb5a6826ab3e757255ef776b551ce75c39fc3c29977b682d09f90b7f14d470d0a3c4a73a91347e78b20a66
-
Filesize
174B
MD5233323f82e79d36d97421dbcfcc03603
SHA1d2595f357997bc1c4a79a500fe909b2f6d8d9216
SHA25602b9efefe4ec6acc493739da2520b9e60f0afb49ab38fd754de6a900341ea5a0
SHA51296dc767904c0b383c3c5f72b4f5e6fc83290e32065128194fb6d4317ee2f53184c821bb1724612c06f5b0aea1338d41cae458100d881114227916915e43bba3e
-
Filesize
161B
MD505ccac34153397f091c29be3efe38049
SHA16036d881c711b30f2e4b3ebc5c9ed842b158a68a
SHA2564e5cbef39bb7437d0f0206d844f6fbfd1e57cb93ff8b3d87d048ace2bf43a635
SHA51237b9700aa585d75e0428d6d9a28b068f4286d12406dce806e1772da69974348c5b3db01fba1794bc16ddf994295ae03261c9db7d357de89e829c1c13331e9460
-
Filesize
130B
MD5f321656a466363e5192773d92000e401
SHA13a6abe9be1a6f4deffaa98fd27f3449c888d3c4a
SHA25653efd5207de6ed80429ec3c7865eed2b64023a0ed66e0fd29e7f45b708a1751c
SHA512fcf6884bf5ce8d10b3a3dd461fad96cb6cf0bc4129e01788de112551230fbc4d8ea6961b04411d1c7816e248437c4560277069d9c544e5450612abc0e2c0171d
-
Filesize
146B
MD58359c9dec0ace060f500a7698bff051d
SHA1dd6da51cf68fed70a26f2dedefe1b07545db4b38
SHA25675dbeadbcaaa2adb48c9c5da371f572413c3c31b2eb084991deb1aaa20310342
SHA5122d72d4d515981b138937e2f3c118038e0a83e9c3b5b81b08b41d74694aa502f055a1d638932b9573a8486c9fe02b4232d5f62a667bb6af53770495189cdc6318
-
Filesize
194B
MD59c50a410a02690abe6cb99c4844c90c1
SHA1cf9f5051762eccba08c53150ad5117d438528811
SHA256b6f41b6f8e8f4e15e7af61d75bb35756a10d96ef009baa5ed288974012c34ce5
SHA512bf976f5f1c6c0749c6e105026d441dffc8fd7ac230b6f8ec6aefa59ddada1c2a55aec7bd8b3c527d07c950a72b0930d6ef4530ad5001b27cf94d5731e81b3381
-
Filesize
82B
MD5517c2315f52727eac0bfd3fc14bae079
SHA16d5fd16219c45b4550263285b2c68f6cec2c2e07
SHA256925f72ec8603d7e7a96e2c0b731254baea56e075b56c070f17a1d310f609bb2c
SHA5125fefb0e196fec6bdf9ef1f0ee231020046f2e88851812b4292e5191a2faf56b3a077dd0164690e752803d9d78e51d7edcc325538bf278570a825c1677db53a34
-
Filesize
57B
MD570a42cba408700f9a6c01c7941a8829e
SHA1eab01cc2c0671538795fb0b1146017dc099d0984
SHA256499576707ce2623293166979e59c832be5b8636c64ad39aa63ebcf961910c35f
SHA5128900d4dc8eed0430babbacb72942401bd22ef7fe5430cad90d3ce0c2c53010220d666aa0e2eb1026f3ec81d574c7fa12585b49222a5f15b01637f6ba134fe70c
-
Filesize
132B
MD5f19c1e688d1e1de34ccd492e18d3121f
SHA1f9c083c12f680dbf7fa862030f12fefecbb81c80
SHA2566d8ffcbcb41e2afb16769edeab42722a1d0e408630a1295671179aa14000a2dc
SHA51226105600fbc49c0a1f440d6a5a9915d8191742511f634eb6e5d2cabcbc7498968b1c7d07879123db408ce3acb036febebc538af6f0be0308acdc555e7aca8826
-
Filesize
32B
MD5d8dd9feeedff300eb60ce007334f35d3
SHA1eafb66b5dac7040a061304629274861805c15f1b
SHA25622eae7447987e46c633a179b6911e4f96f140787f59d06eca3683f28141a089c
SHA5125d03a96ebed9ab59e52d27dfa14bec8391eb24ff9954feb01afb850b5889039da3e55b7eb1efc78b05c7470f6d5267c1fbc8c4a36b1d4122b19ada41e03053c4