Analysis
-
max time kernel
178s -
max time network
190s -
platform
android_x64 -
resource
android-x64-20240514-en -
resource tags
androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system -
submitted
22-05-2024 23:08
Static task
static1
Behavioral task
behavioral1
Sample
68f2ea6ffd4679a6c58d7bc6c1ba89a4_JaffaCakes118.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral2
Sample
68f2ea6ffd4679a6c58d7bc6c1ba89a4_JaffaCakes118.apk
Resource
android-x64-20240514-en
General
-
Target
68f2ea6ffd4679a6c58d7bc6c1ba89a4_JaffaCakes118.apk
-
Size
15.6MB
-
MD5
68f2ea6ffd4679a6c58d7bc6c1ba89a4
-
SHA1
33bbb52c2f4dac8f3abd19bb15a544b1348c0037
-
SHA256
77467805083c0906d71ccc4f1337b7a1e10a4ea2bbad071b1da38206c9b28511
-
SHA512
efbbd77e34e2af6c3d7366609625eaba09d0d4bc22f9b5342ccc29e58dce7550353b7486d37954ea64122ff4b5c8bceaca94a56ca8edf5615e65feced14825db
-
SSDEEP
393216:2Bb1S4F8FTFj48IzM0NDfbEbamndysUuc97Exg9TzjmqtzokLkR9:yb1S4IZIXjE+GysK9pt5svR9
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 1 IoCs
-
Checks CPU information 2 TTPs 2 IoCs
Checks CPU information which indicate if the system is an emulator.
-
Queries information about running processes on the device 1 TTPs 2 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
Processes:
com.resou.readercom.resou.reader:channeldescription ioc process Framework service call android.app.IActivityManager.getRunningAppProcesses com.resou.reader Framework service call android.app.IActivityManager.getRunningAppProcesses com.resou.reader:channel -
Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
Processes:
com.resou.readercom.resou.reader:channeldescription ioc process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.resou.reader Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.resou.reader:channel -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
Processes:
com.resou.readercom.resou.reader:channeldescription ioc process Framework service call android.app.IActivityManager.registerReceiver com.resou.reader Framework service call android.app.IActivityManager.registerReceiver com.resou.reader:channel -
Checks if the internet connection is available 1 TTPs 2 IoCs
Processes:
com.resou.readercom.resou.reader:channeldescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.resou.reader Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.resou.reader:channel -
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Schedules tasks to execute at a specified time 1 TTPs 1 IoCs
Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.
Processes:
com.resou.reader:channeldescription ioc process Framework service call android.app.job.IJobScheduler.schedule com.resou.reader:channel -
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
Processes:
com.resou.readerdescription ioc process Framework API call android.hardware.SensorManager.registerListener com.resou.reader -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs
Processes:
com.resou.reader:channelcom.resou.readerdescription ioc process Framework API call javax.crypto.Cipher.doFinal com.resou.reader:channel Framework API call javax.crypto.Cipher.doFinal com.resou.reader
Processes
-
com.resou.reader1⤵
- Checks if the Android device is rooted.
- Checks CPU information
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Listens for changes in the sensor environment (might be used to detect emulation)
- Uses Crypto APIs (Might try to encrypt user data)
-
com.resou.reader:channel1⤵
- Checks CPU information
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.resou.reader/databases/MessageStore.dbFilesize
36KB
MD5a509098bbe9364e5cd061dfe802a0a68
SHA15e5dbeabfd18c99f9edf4f66476453ac69da7eab
SHA2566baea9fb37dbd4734634549289360413e90165e340d975f6d0384610052c0958
SHA5120712f0c0873da4056debefbb7007a138971010d819f406bef625d2c79804055270bab139d092c6495ef8764f3d6649e3498067a5353bbf01eacdb146d31f0a27
-
/data/data/com.resou.reader/databases/MessageStore.db-journalFilesize
40KB
MD532727e782765c1357c7084efbaafbef4
SHA1fb254cae8632790c9dc8eb1618336c9fe764d311
SHA2560e805ffee0cbd27912a8e3eb6d54093efb6d260f05416bd579483efb2cc9ad29
SHA512806aabae47eeecceeb529270e838388176b552dcdb0b84908b55ab36581a614c7f7071f1981fb19f686bd8aad3a434455572115a76a7ce88ce81ada4a5c7fa05
-
/data/data/com.resou.reader/databases/MessageStore.db-journalFilesize
512B
MD51e60a30a0d612e69e06f8e705cf324d1
SHA136fb153587b3d3fe1c3db6faab3f7f3c9849216b
SHA2566c12f5f312e93f8ba40c72c6c8b4e8e61cd94d619a1970c9c4db6003da7e4b73
SHA51232d8281e08a58e534f12885aa6fbcb6891562bfd049fb46d29a60710559b6b751e836d3f08a75e5a3e75071f031ffbcd52257100da8b41ad2f01221e93e79246
-
/data/data/com.resou.reader/databases/MessageStore.db-journalFilesize
12KB
MD510b8a9756988dd8db5b9fb46e42753ab
SHA15269d6a47a0173e4aa4e4018e5172f2a658a02d3
SHA2564ce673ccc8c718d5f2c93fbc1c78f14d6755f5a05f57d082ce0627eb7dbf5d63
SHA5124effc165d749e7d82c18eb2640a7cf6bf3fe8977512361982864e5ba1f02d51b2fc1673d7c39761398cb1e761b1d2b02f3ff80ee544b72b0972c089004993c16
-
/data/data/com.resou.reader/databases/MessageStore.db-journalFilesize
8KB
MD590fe81b4e3140a3149f541ec9a47144c
SHA15a7fc76e204830e56631642fcec49043261655b8
SHA256c2834dcea973685ec30cdb0b31a2312f41da92e2da620dd0e64a8531d07a3030
SHA5125b6ccf7a087c776f99a5a1ebad1894569a9cf1d78d6e25c607895f2043b32d4d74473e9fe8ae988ddb25279b67841fc90f62e9e0ab0558fc6bd74d2bd7ce9202
-
/data/data/com.resou.reader/databases/MessageStore.db-journalFilesize
8KB
MD53fc978e20044220dd10ff3bd3b12b7d3
SHA11e43b0c241a43974172f75245418af35ef3a88fb
SHA2563367c218708d1d5444287557d15d8d1f38ae273bd516e47e5d9a0f94abbe597a
SHA512fe0479e57f9c1b01a527b3f6888f6b97f2fa3907d9dfff9ee6778593229195ea3747ba495051f848e0c45ad7145212fb85d34bddfe21a5e59bcf13dee09643d2
-
/data/data/com.resou.reader/databases/MessageStore.db-journalFilesize
8KB
MD5578df58fb2a8e3313a8f5798eebf16cd
SHA10be640933b05636b28c3b27d08b4e7be4739df66
SHA2561726a145b412e151cbd0eeb8f71765da01659c0c6679a9dfa85e87bdf17658ac
SHA512b2d6519fb1bc42483e3f8cc038be097a4268c804c35cde1d89a01c9a95377afd201fd39ad4ec967f81d3f034937f3c57fdc28f16f51b0b75cca28b0bd07bc9f4
-
/data/data/com.resou.reader/databases/MsgLogStore.dbFilesize
56KB
MD5f9f37bca858cc47a1018f7d0f6c13a98
SHA1bfa642aace4a47550ff9f1e636ef421efa5b383c
SHA25607ee6ab8d434ccb3f719a39c10f3e278eaea5faa02f150a812551217b99da963
SHA51292e2fb8dc4dd059d3c5bf04473d626455d74fff99e186f8967c5375399b44b14606e3b3898749cf91b628215d944dc9e7e140628b100f2ddf1385af972785779
-
/data/data/com.resou.reader/databases/MsgLogStore.db-journalFilesize
36KB
MD550f3d63f4b9241e212be8ec20bf3e374
SHA110353f506f0aa9dfab398275482eb42da167232a
SHA256be9049dfc1751c212273b6e4d07202e47cc7de289dd84d388a27675609056653
SHA512dfc6dc641041edc77b5b77bda43ebbfd0eb6c0f4d55d05a7a914f77c58f2f465e8d29aa7e2c9773ec93a257154a6c779a6b165b8765a214aa154976887d8ff7c
-
/data/data/com.resou.reader/databases/MsgLogStore.db-journalFilesize
8KB
MD55a74326f12f33ec395aaf851e6ea419f
SHA1528b40f8506cf197a184a5ffb7db94bb8fc1127f
SHA256f206ee7fa8c29043ef48013d4ee9fa9da50bb2a62840dda6f0c74b56793aa23b
SHA512c1ebb364b7506599c0ab95f90e6d05e90f7f5073199b879f696fc532dfad621646de86e265250ae4107486745cf4da50592c0244f7c57b630ceaa31552135124
-
/data/data/com.resou.reader/databases/MsgLogStore.db-journalFilesize
8KB
MD524ecf5ca92f85b067cf7a4e0813b8633
SHA159a56980b74157427ad9aefd3a1f08eb74cc0505
SHA256d7ea48d284b46250da43324d58242adbcacc05d1e97282ef2ccf0755bc540bd2
SHA5124144ccb58483400ca4dfe742568bf9209f84eddc9fe50429bd80c9c2886d5eeb7cc5e4aadaaf6ff6b9d445e73d07f42ba14510398bf97b11f74e51ca4eaa414b
-
/data/data/com.resou.reader/databases/accs.dbFilesize
44KB
MD5dcc310ccd6d3127d1ce624ff59579226
SHA1c4bcc906b5f359e32c6f63a13160541cdec89280
SHA256b423ddf49075849156cb816e89c17b2de23557f413a48b1178b926073aec00fe
SHA512d1318d86c3667e3f928989b7107768f06b079d547ee865c4dda465ebdd778771de58b834ed170f7dbead0e10135ab336bc95c59fbe314c25ec66e301f0a34985
-
/data/data/com.resou.reader/databases/accs.db-journalFilesize
16KB
MD54a444cd09adeb528e8a6bcf7e4f49512
SHA1c10f1852f20ef8eb16e04dbfcf2989fed871a852
SHA256903842831235e94ec67bd1a4dee2ccc20c74f0cc51e6635e8d593517f2df5347
SHA512edafa291c1e360ea82e9e104871d3c718bc91dd7d163891662c729884d380bccbad8e30953b9934715339434c84a9f0bdc77e46585202c1c5e6ff118a24db15b
-
/data/data/com.resou.reader/databases/accs.db-journalFilesize
8KB
MD59a5bed4b7f0c1e1fba195aa1ca0f0a08
SHA10fa8c6e446177daa883117529a5c1037d8d28c50
SHA2563f278c5b57f89355434236396e0575d1dced1fe9b29bdcfaffeac0cb24c314a0
SHA512f7c2f3178c2de62fb24b04926d6fc9bbbc0134b6413693508eb9aa782844846749d6cb9faf2aa1293f29aff64f0be67a9157ec5afd88147505acf622742b7810
-
/data/data/com.resou.reader/databases/accs.db-journalFilesize
8KB
MD5dfadd786f5ef7d63e200b9349af4eaeb
SHA108196e6468e433893103562fcc5c5a000e856e51
SHA25681bb02932c818ddf024e9440fc76c4acae8e8ac9b8d3eeb3d02a1314f11638e5
SHA5125fefe0c33225f14ada498a604bf2f7c0f1be52ad304dec7e7c964876f96d13e08b57086c30a29dacabca5547273491ab8d72ae35d96725eddb1bf7a7d862f0ac
-
/data/data/com.resou.reader/databases/ut.dbFilesize
28KB
MD52c299f777ef00d276dc266f542befc5f
SHA1c12f23eff662671b997e51188170428597b18ed0
SHA256b30fefa2aeaa92ae68ff0403de999f899c1ae3583b1b5695fa1a8e75aeffc075
SHA512232ce199e659f5a2f0876166098b81d51bae147997ee10696e71dd7bf690839345ee5847c888843a4e455b18db711256ff1455c9b70bad4768d22b701acc8a28
-
/data/data/com.resou.reader/databases/ut.dbFilesize
20KB
MD560873ca7db4a718a4d3d9e6d71972ae0
SHA136d12217932f627d376515fef84c23eb076ecf00
SHA25672a86424445fbafd4a528d8f351312b66161b756b9f9acf6d88c0a099c42f321
SHA512d8e82b3fce406f0e7e9a049fc76673a0e5db1b3faea08689a98034121d9f2371adc7e65ddd76307442d2796340e827cf9f53f29c5d727f2b8eeffa24d9d74d84
-
/data/data/com.resou.reader/databases/ut.dbFilesize
28KB
MD5a888431bc94f2a782390243f49fbffdb
SHA13dcf9ff201ff2c64fddd938c504768362eeb1d90
SHA256af2d1dba4959ad3187cc903f485c54e6a7356d619306af814983ab9af0b57824
SHA512e8032074ac52d0877d9363327b5227bd0ed69ba5d60673eda7ea0c7ac2549b0923c5de1fabe06a79cb3276acafcb20f40d4a28fc812dd08427ed067279f2e973
-
/data/data/com.resou.reader/databases/ut.dbFilesize
32KB
MD549f8cf570103167aec16d041ace5f931
SHA1484c54caf02f70431cae958def7c710385844bdf
SHA256978f60dfa3ed973ae4ec96614143f16d40119ceb9e39306503371afc773f87d2
SHA512daec3d3581fce9c16175afc9ca2526e719554d5254e21baefb078c080fcfc3d1119fb49bedb91d2eec0729a6255a583bc9197994230ac7921123063c626f9536
-
/data/data/com.resou.reader/databases/ut.dbFilesize
36KB
MD52ed0e2a5d955cb050a29118664bc5e4f
SHA1df5cc5b69940889650810e8bfcd180078581628c
SHA25660ce493a276d0dd85831cb3e200249afa90066b361b201a165a5cff8333cab37
SHA5120083416a3544813ccf7d746ad2029c5d8faa3f4a115c1e6ae642b7dd539b75aedb02e88026ccec4b4c170d64450e90ca3436ab7be0a8a47c1480bc54df775162
-
/data/data/com.resou.reader/databases/ut.db-journalFilesize
12KB
MD5490e8b194ef4642e13c59228609b763a
SHA15e6d7ff1986411746147d6cbc840bca77d0412bf
SHA256a986dac69db13fe4e0b47d20c27ae5ae265e220bc876ee1ce94a5a669c345710
SHA512bfed339ebe2b0a6d42be1afb6a22a905c8cdbfc742ca754a81e4fa14ab503c1564047b57fbd13f67f7e0ea8156c687dbdb2f8974692e3a2aa4d1a61d9ec2b4cc
-
/data/data/com.resou.reader/databases/ut.db-journalFilesize
32KB
MD5407e8e6f34f825c2a9d6701b3b0e942c
SHA1e2427830ba4f7bd1f952b23a11e1f402dff5a978
SHA25652c67af7522941c1e60b6bf394e19d7558f044770b39c856108a29bd25b2b87b
SHA51209dc47c7d086da2e7f6e4cb6ba34e22d07226746d0673cecd7a9fcce93ad0e614727d649881e32d9cbb1b1b08d0675d71061808630d76079540dd5319aae9a16
-
/data/data/com.resou.reader/databases/ut.db-journalFilesize
20KB
MD5d55f8bbe8dcc2a82ea30422dcc8cd706
SHA1530c04251397c3d51a4dedf73cf357e5e8194828
SHA256eae29d4273092287331052ef50ab937103251321681a42e6cbefed0827b5d594
SHA512268d8fe63959ac8591b145706af0d518eb849cad7ac39b8edff85a173acf1b499a924c5c75908b79f03c6d830e04755cf524cd3bd54b3ce7338d57f2be08bed7
-
/data/data/com.resou.reader/databases/ut.db-journalFilesize
12KB
MD5940a9fa72bb83f1dcdd3f6f293b1d4c4
SHA1e0b8a0e27899f6e9ed963bb93d6ee96804eb580f
SHA256418959609dcd4e917749b7983450011d0546d6570aaec9a5bc42e2c000517121
SHA5125cb84e5d950f0dfa3d286880000636e70ed8e40f4a58caff8735ae1325d4127f4ca5fe531edb69e94b4b42b9e9c6e007c17b2cf7a1c99b6ddb4ddae3e0415aa0
-
/data/data/com.resou.reader/databases/ut.db-journalFilesize
16KB
MD58bd69217c68e9f41c19330625f7542c7
SHA1394bacb27962cf39185c3263a5d7a8f8333564ee
SHA256fc1d497cea4789c4e14d32926c2ac80361682feb22d89366a3afbea232abe52f
SHA5125e08199882abffc2a3e58c7b2ea7995b07e1734f3734fae82ec8423c34c4667311edc360551cb13a824a4e1b5f0ae351b6c0752e349f68c35c1406d901fb0af3
-
/data/data/com.resou.reader/databases/ut.db-journalFilesize
20KB
MD56ed6d1c14a20528ae42e3aea34cd8fcb
SHA11f2855f6d4799b670b9a1be2a60a0745b400fe7f
SHA25638d493101d632d5c8dfa4477a6afadc9d3af0bd339c734c823fb03f7bc294948
SHA512ab1bdc691ecf2e5b3383a42ee136c90a97e7b0b0e23a5c8467d2ccedafe140e0e1cfd8fd4246a70d0e2629036efe9dfd2a41ab7a3937bee695bf2bbb6c093d7d
-
/data/data/com.resou.reader/files/stateless/dW1weF9pbnRlcm5hbA== /dW1weF9pbnRlcm5hbF8xNzE2NDE5MzE3MDA4Filesize
1KB
MD5812f6c53642d16ab9f43452b5bc8d7c9
SHA1392e05343773e64bc4511d35cd1a8d4180291856
SHA25658948299bdb0e3962b1439870706b4a99bc8f66dfe2df412f1562624942d881a
SHA5128c62bd962a492d660df1868b29ed9657de94988cb7b8bd0f97801910722d0ea73efbca363eac5ead192efd857c12fa027c504bdc1aa154579cfb664260fdd3cd
-
/data/data/com.resou.reader/files/umeng_it.cacheFilesize
433B
MD5669d27e1ed0349ff45ae483793c942aa
SHA15069c6427007c5c816c84dae21a4ae7e9428c293
SHA256381e6c8e383ff33f08e7771540f974ae1ddf968f428d96e678bfaabe6c791c4a
SHA5128a0dfb09eaf6c8cd4bd9f1062850bc82c7872bbf4457f6923f81b68cd2c051ce4b2688df1538b461484af62196522f4556c8506c1ce3be2d94d17b10b2529581
-
/storage/emulated/0/.DataStorage/ContextData.xmlFilesize
12KB
MD5e4f44d0015d967e9fff528fa714119b6
SHA1f2e3287cf8f81c19666d7bac5f68eee52892bb93
SHA2568c0a498b691933a227990133fe542841135b68fd3898bdb0b42305674ce96c44
SHA512e3ea34f70fe27a775b4a4fb5b56134504023cfe2e59d8f8258717270b2435cf9d8f270af7debf47f25a85975a0461ecd827db891a8ef00f68d7469aff5568e59
-
/storage/emulated/0/.DataStorage/ContextData.xmlFilesize
20KB
MD55486b2b75264b775bb672b36150c2bf7
SHA1043677415a4b1c4ce45863d5e4604e76b140ba63
SHA256048b4b0ed2c0edb36acd367d1ae0a2fa4eb1e85be7aa6a76e71ac1c8f48946fb
SHA5125acf8d2f116c38f87eebd93b829a12b3d5c56a79c257973722e56e106bddb619e2cf7e2de93edba3ef99883ab015a7dc679026dca6a89dd48b07e30eb8a460c6
-
/storage/emulated/0/.DataStorage/ContextData.xmlFilesize
12KB
MD575a9391b062a25a71b8b6d1ffc59dc3f
SHA16e0286b95369d8b95fbfab26f1fd1e52ba15c962
SHA25660c705525939afb7209b92168ace59c4197358d7143c61d352d3984086e2130d
SHA512857e502c3435ae473e1d8d0fcd0a6abc055cb67fdf0c3f2b9a20c982b39c5cfc1b813b787bc97fa318bf0e97d82b0fb3d074a4775daa2355fb26dca6e200f675
-
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xmlFilesize
111B
MD5d07e4217c85c22e345def69cfca27780
SHA18a9665ff4d1dcdb37609f9ad865cf753fc351a05
SHA2569ddfa1c45879eebc71d75648d9a7012d80785e22fb850eb8f02357802748940b
SHA5127bb85fb1305790aae8bf3957260a593adf99a8cf4f947e4a5c7bb387212ae00c5f1922cdd3a7cb55a09ceadba43b9d7b1267b9478b1b44843c829243d355e772
-
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xmlFilesize
167B
MD55ba066306599ccc8329d18d9f6e993ef
SHA10af5dbba955579564dea30095ef2e0a3c7ffb361
SHA256ab85b1f3c784952fdbb21101682c0867de67ca0d4e5ee2c5ae1d6e66b6f5fd83
SHA51211e2393fdd6a58da2b28d9b9a85688130be72c2837500c3bef7663f1a85a782d3c9df4a9cf7048434aa8c8236ffa59a5bfd5dfe666756f4a6b92d3831a3ae92e
-
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xmlFilesize
8KB
MD5d9d8abb31394b5e6d712049e3e0c2008
SHA1904219f8159ec0daa3040ca534378ea10d6bcf98
SHA2567f84760d73b4b49af97b57d01ac4344787e97d5e5dc644b4c8fef155f76fc33b
SHA512f6fab82c4445bac775dc6fe35d184e5f9f99cf00b877012e109787a8f91582cf51cec7b7e92083bb6bc790071f93cfcb40cd6167de7f7475f8095eb39bd62c91