Analysis

  • max time kernel
    178s
  • max time network
    190s
  • platform
    android_x64
  • resource
    android-x64-20240514-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
  • submitted
    22-05-2024 23:08

General

  • Target

    68f2ea6ffd4679a6c58d7bc6c1ba89a4_JaffaCakes118.apk

  • Size

    15.6MB

  • MD5

    68f2ea6ffd4679a6c58d7bc6c1ba89a4

  • SHA1

    33bbb52c2f4dac8f3abd19bb15a544b1348c0037

  • SHA256

    77467805083c0906d71ccc4f1337b7a1e10a4ea2bbad071b1da38206c9b28511

  • SHA512

    efbbd77e34e2af6c3d7366609625eaba09d0d4bc22f9b5342ccc29e58dce7550353b7486d37954ea64122ff4b5c8bceaca94a56ca8edf5615e65feced14825db

  • SSDEEP

    393216:2Bb1S4F8FTFj48IzM0NDfbEbamndysUuc97Exg9TzjmqtzokLkR9:yb1S4IZIXjE+GysK9pt5svR9

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 1 IoCs
  • Checks CPU information 2 TTPs 2 IoCs

    Checks CPU information which indicate if the system is an emulator.

  • Queries information about running processes on the device 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
  • Checks if the internet connection is available 1 TTPs 2 IoCs
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
  • Reads information about phone network operator. 1 TTPs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

Processes

  • com.resou.reader
    1⤵
    • Checks if the Android device is rooted.
    • Checks CPU information
    • Queries information about running processes on the device
    • Queries information about the current Wi-Fi connection
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5137
  • com.resou.reader:channel
    1⤵
    • Checks CPU information
    • Queries information about running processes on the device
    • Queries information about the current Wi-Fi connection
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5365

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.resou.reader/databases/MessageStore.db
    Filesize

    36KB

    MD5

    a509098bbe9364e5cd061dfe802a0a68

    SHA1

    5e5dbeabfd18c99f9edf4f66476453ac69da7eab

    SHA256

    6baea9fb37dbd4734634549289360413e90165e340d975f6d0384610052c0958

    SHA512

    0712f0c0873da4056debefbb7007a138971010d819f406bef625d2c79804055270bab139d092c6495ef8764f3d6649e3498067a5353bbf01eacdb146d31f0a27

  • /data/data/com.resou.reader/databases/MessageStore.db-journal
    Filesize

    40KB

    MD5

    32727e782765c1357c7084efbaafbef4

    SHA1

    fb254cae8632790c9dc8eb1618336c9fe764d311

    SHA256

    0e805ffee0cbd27912a8e3eb6d54093efb6d260f05416bd579483efb2cc9ad29

    SHA512

    806aabae47eeecceeb529270e838388176b552dcdb0b84908b55ab36581a614c7f7071f1981fb19f686bd8aad3a434455572115a76a7ce88ce81ada4a5c7fa05

  • /data/data/com.resou.reader/databases/MessageStore.db-journal
    Filesize

    512B

    MD5

    1e60a30a0d612e69e06f8e705cf324d1

    SHA1

    36fb153587b3d3fe1c3db6faab3f7f3c9849216b

    SHA256

    6c12f5f312e93f8ba40c72c6c8b4e8e61cd94d619a1970c9c4db6003da7e4b73

    SHA512

    32d8281e08a58e534f12885aa6fbcb6891562bfd049fb46d29a60710559b6b751e836d3f08a75e5a3e75071f031ffbcd52257100da8b41ad2f01221e93e79246

  • /data/data/com.resou.reader/databases/MessageStore.db-journal
    Filesize

    12KB

    MD5

    10b8a9756988dd8db5b9fb46e42753ab

    SHA1

    5269d6a47a0173e4aa4e4018e5172f2a658a02d3

    SHA256

    4ce673ccc8c718d5f2c93fbc1c78f14d6755f5a05f57d082ce0627eb7dbf5d63

    SHA512

    4effc165d749e7d82c18eb2640a7cf6bf3fe8977512361982864e5ba1f02d51b2fc1673d7c39761398cb1e761b1d2b02f3ff80ee544b72b0972c089004993c16

  • /data/data/com.resou.reader/databases/MessageStore.db-journal
    Filesize

    8KB

    MD5

    90fe81b4e3140a3149f541ec9a47144c

    SHA1

    5a7fc76e204830e56631642fcec49043261655b8

    SHA256

    c2834dcea973685ec30cdb0b31a2312f41da92e2da620dd0e64a8531d07a3030

    SHA512

    5b6ccf7a087c776f99a5a1ebad1894569a9cf1d78d6e25c607895f2043b32d4d74473e9fe8ae988ddb25279b67841fc90f62e9e0ab0558fc6bd74d2bd7ce9202

  • /data/data/com.resou.reader/databases/MessageStore.db-journal
    Filesize

    8KB

    MD5

    3fc978e20044220dd10ff3bd3b12b7d3

    SHA1

    1e43b0c241a43974172f75245418af35ef3a88fb

    SHA256

    3367c218708d1d5444287557d15d8d1f38ae273bd516e47e5d9a0f94abbe597a

    SHA512

    fe0479e57f9c1b01a527b3f6888f6b97f2fa3907d9dfff9ee6778593229195ea3747ba495051f848e0c45ad7145212fb85d34bddfe21a5e59bcf13dee09643d2

  • /data/data/com.resou.reader/databases/MessageStore.db-journal
    Filesize

    8KB

    MD5

    578df58fb2a8e3313a8f5798eebf16cd

    SHA1

    0be640933b05636b28c3b27d08b4e7be4739df66

    SHA256

    1726a145b412e151cbd0eeb8f71765da01659c0c6679a9dfa85e87bdf17658ac

    SHA512

    b2d6519fb1bc42483e3f8cc038be097a4268c804c35cde1d89a01c9a95377afd201fd39ad4ec967f81d3f034937f3c57fdc28f16f51b0b75cca28b0bd07bc9f4

  • /data/data/com.resou.reader/databases/MsgLogStore.db
    Filesize

    56KB

    MD5

    f9f37bca858cc47a1018f7d0f6c13a98

    SHA1

    bfa642aace4a47550ff9f1e636ef421efa5b383c

    SHA256

    07ee6ab8d434ccb3f719a39c10f3e278eaea5faa02f150a812551217b99da963

    SHA512

    92e2fb8dc4dd059d3c5bf04473d626455d74fff99e186f8967c5375399b44b14606e3b3898749cf91b628215d944dc9e7e140628b100f2ddf1385af972785779

  • /data/data/com.resou.reader/databases/MsgLogStore.db-journal
    Filesize

    36KB

    MD5

    50f3d63f4b9241e212be8ec20bf3e374

    SHA1

    10353f506f0aa9dfab398275482eb42da167232a

    SHA256

    be9049dfc1751c212273b6e4d07202e47cc7de289dd84d388a27675609056653

    SHA512

    dfc6dc641041edc77b5b77bda43ebbfd0eb6c0f4d55d05a7a914f77c58f2f465e8d29aa7e2c9773ec93a257154a6c779a6b165b8765a214aa154976887d8ff7c

  • /data/data/com.resou.reader/databases/MsgLogStore.db-journal
    Filesize

    8KB

    MD5

    5a74326f12f33ec395aaf851e6ea419f

    SHA1

    528b40f8506cf197a184a5ffb7db94bb8fc1127f

    SHA256

    f206ee7fa8c29043ef48013d4ee9fa9da50bb2a62840dda6f0c74b56793aa23b

    SHA512

    c1ebb364b7506599c0ab95f90e6d05e90f7f5073199b879f696fc532dfad621646de86e265250ae4107486745cf4da50592c0244f7c57b630ceaa31552135124

  • /data/data/com.resou.reader/databases/MsgLogStore.db-journal
    Filesize

    8KB

    MD5

    24ecf5ca92f85b067cf7a4e0813b8633

    SHA1

    59a56980b74157427ad9aefd3a1f08eb74cc0505

    SHA256

    d7ea48d284b46250da43324d58242adbcacc05d1e97282ef2ccf0755bc540bd2

    SHA512

    4144ccb58483400ca4dfe742568bf9209f84eddc9fe50429bd80c9c2886d5eeb7cc5e4aadaaf6ff6b9d445e73d07f42ba14510398bf97b11f74e51ca4eaa414b

  • /data/data/com.resou.reader/databases/accs.db
    Filesize

    44KB

    MD5

    dcc310ccd6d3127d1ce624ff59579226

    SHA1

    c4bcc906b5f359e32c6f63a13160541cdec89280

    SHA256

    b423ddf49075849156cb816e89c17b2de23557f413a48b1178b926073aec00fe

    SHA512

    d1318d86c3667e3f928989b7107768f06b079d547ee865c4dda465ebdd778771de58b834ed170f7dbead0e10135ab336bc95c59fbe314c25ec66e301f0a34985

  • /data/data/com.resou.reader/databases/accs.db-journal
    Filesize

    16KB

    MD5

    4a444cd09adeb528e8a6bcf7e4f49512

    SHA1

    c10f1852f20ef8eb16e04dbfcf2989fed871a852

    SHA256

    903842831235e94ec67bd1a4dee2ccc20c74f0cc51e6635e8d593517f2df5347

    SHA512

    edafa291c1e360ea82e9e104871d3c718bc91dd7d163891662c729884d380bccbad8e30953b9934715339434c84a9f0bdc77e46585202c1c5e6ff118a24db15b

  • /data/data/com.resou.reader/databases/accs.db-journal
    Filesize

    8KB

    MD5

    9a5bed4b7f0c1e1fba195aa1ca0f0a08

    SHA1

    0fa8c6e446177daa883117529a5c1037d8d28c50

    SHA256

    3f278c5b57f89355434236396e0575d1dced1fe9b29bdcfaffeac0cb24c314a0

    SHA512

    f7c2f3178c2de62fb24b04926d6fc9bbbc0134b6413693508eb9aa782844846749d6cb9faf2aa1293f29aff64f0be67a9157ec5afd88147505acf622742b7810

  • /data/data/com.resou.reader/databases/accs.db-journal
    Filesize

    8KB

    MD5

    dfadd786f5ef7d63e200b9349af4eaeb

    SHA1

    08196e6468e433893103562fcc5c5a000e856e51

    SHA256

    81bb02932c818ddf024e9440fc76c4acae8e8ac9b8d3eeb3d02a1314f11638e5

    SHA512

    5fefe0c33225f14ada498a604bf2f7c0f1be52ad304dec7e7c964876f96d13e08b57086c30a29dacabca5547273491ab8d72ae35d96725eddb1bf7a7d862f0ac

  • /data/data/com.resou.reader/databases/ut.db
    Filesize

    28KB

    MD5

    2c299f777ef00d276dc266f542befc5f

    SHA1

    c12f23eff662671b997e51188170428597b18ed0

    SHA256

    b30fefa2aeaa92ae68ff0403de999f899c1ae3583b1b5695fa1a8e75aeffc075

    SHA512

    232ce199e659f5a2f0876166098b81d51bae147997ee10696e71dd7bf690839345ee5847c888843a4e455b18db711256ff1455c9b70bad4768d22b701acc8a28

  • /data/data/com.resou.reader/databases/ut.db
    Filesize

    20KB

    MD5

    60873ca7db4a718a4d3d9e6d71972ae0

    SHA1

    36d12217932f627d376515fef84c23eb076ecf00

    SHA256

    72a86424445fbafd4a528d8f351312b66161b756b9f9acf6d88c0a099c42f321

    SHA512

    d8e82b3fce406f0e7e9a049fc76673a0e5db1b3faea08689a98034121d9f2371adc7e65ddd76307442d2796340e827cf9f53f29c5d727f2b8eeffa24d9d74d84

  • /data/data/com.resou.reader/databases/ut.db
    Filesize

    28KB

    MD5

    a888431bc94f2a782390243f49fbffdb

    SHA1

    3dcf9ff201ff2c64fddd938c504768362eeb1d90

    SHA256

    af2d1dba4959ad3187cc903f485c54e6a7356d619306af814983ab9af0b57824

    SHA512

    e8032074ac52d0877d9363327b5227bd0ed69ba5d60673eda7ea0c7ac2549b0923c5de1fabe06a79cb3276acafcb20f40d4a28fc812dd08427ed067279f2e973

  • /data/data/com.resou.reader/databases/ut.db
    Filesize

    32KB

    MD5

    49f8cf570103167aec16d041ace5f931

    SHA1

    484c54caf02f70431cae958def7c710385844bdf

    SHA256

    978f60dfa3ed973ae4ec96614143f16d40119ceb9e39306503371afc773f87d2

    SHA512

    daec3d3581fce9c16175afc9ca2526e719554d5254e21baefb078c080fcfc3d1119fb49bedb91d2eec0729a6255a583bc9197994230ac7921123063c626f9536

  • /data/data/com.resou.reader/databases/ut.db
    Filesize

    36KB

    MD5

    2ed0e2a5d955cb050a29118664bc5e4f

    SHA1

    df5cc5b69940889650810e8bfcd180078581628c

    SHA256

    60ce493a276d0dd85831cb3e200249afa90066b361b201a165a5cff8333cab37

    SHA512

    0083416a3544813ccf7d746ad2029c5d8faa3f4a115c1e6ae642b7dd539b75aedb02e88026ccec4b4c170d64450e90ca3436ab7be0a8a47c1480bc54df775162

  • /data/data/com.resou.reader/databases/ut.db-journal
    Filesize

    12KB

    MD5

    490e8b194ef4642e13c59228609b763a

    SHA1

    5e6d7ff1986411746147d6cbc840bca77d0412bf

    SHA256

    a986dac69db13fe4e0b47d20c27ae5ae265e220bc876ee1ce94a5a669c345710

    SHA512

    bfed339ebe2b0a6d42be1afb6a22a905c8cdbfc742ca754a81e4fa14ab503c1564047b57fbd13f67f7e0ea8156c687dbdb2f8974692e3a2aa4d1a61d9ec2b4cc

  • /data/data/com.resou.reader/databases/ut.db-journal
    Filesize

    32KB

    MD5

    407e8e6f34f825c2a9d6701b3b0e942c

    SHA1

    e2427830ba4f7bd1f952b23a11e1f402dff5a978

    SHA256

    52c67af7522941c1e60b6bf394e19d7558f044770b39c856108a29bd25b2b87b

    SHA512

    09dc47c7d086da2e7f6e4cb6ba34e22d07226746d0673cecd7a9fcce93ad0e614727d649881e32d9cbb1b1b08d0675d71061808630d76079540dd5319aae9a16

  • /data/data/com.resou.reader/databases/ut.db-journal
    Filesize

    20KB

    MD5

    d55f8bbe8dcc2a82ea30422dcc8cd706

    SHA1

    530c04251397c3d51a4dedf73cf357e5e8194828

    SHA256

    eae29d4273092287331052ef50ab937103251321681a42e6cbefed0827b5d594

    SHA512

    268d8fe63959ac8591b145706af0d518eb849cad7ac39b8edff85a173acf1b499a924c5c75908b79f03c6d830e04755cf524cd3bd54b3ce7338d57f2be08bed7

  • /data/data/com.resou.reader/databases/ut.db-journal
    Filesize

    12KB

    MD5

    940a9fa72bb83f1dcdd3f6f293b1d4c4

    SHA1

    e0b8a0e27899f6e9ed963bb93d6ee96804eb580f

    SHA256

    418959609dcd4e917749b7983450011d0546d6570aaec9a5bc42e2c000517121

    SHA512

    5cb84e5d950f0dfa3d286880000636e70ed8e40f4a58caff8735ae1325d4127f4ca5fe531edb69e94b4b42b9e9c6e007c17b2cf7a1c99b6ddb4ddae3e0415aa0

  • /data/data/com.resou.reader/databases/ut.db-journal
    Filesize

    16KB

    MD5

    8bd69217c68e9f41c19330625f7542c7

    SHA1

    394bacb27962cf39185c3263a5d7a8f8333564ee

    SHA256

    fc1d497cea4789c4e14d32926c2ac80361682feb22d89366a3afbea232abe52f

    SHA512

    5e08199882abffc2a3e58c7b2ea7995b07e1734f3734fae82ec8423c34c4667311edc360551cb13a824a4e1b5f0ae351b6c0752e349f68c35c1406d901fb0af3

  • /data/data/com.resou.reader/databases/ut.db-journal
    Filesize

    20KB

    MD5

    6ed6d1c14a20528ae42e3aea34cd8fcb

    SHA1

    1f2855f6d4799b670b9a1be2a60a0745b400fe7f

    SHA256

    38d493101d632d5c8dfa4477a6afadc9d3af0bd339c734c823fb03f7bc294948

    SHA512

    ab1bdc691ecf2e5b3383a42ee136c90a97e7b0b0e23a5c8467d2ccedafe140e0e1cfd8fd4246a70d0e2629036efe9dfd2a41ab7a3937bee695bf2bbb6c093d7d

  • /data/data/com.resou.reader/files/stateless/dW1weF9pbnRlcm5hbA== /dW1weF9pbnRlcm5hbF8xNzE2NDE5MzE3MDA4
    Filesize

    1KB

    MD5

    812f6c53642d16ab9f43452b5bc8d7c9

    SHA1

    392e05343773e64bc4511d35cd1a8d4180291856

    SHA256

    58948299bdb0e3962b1439870706b4a99bc8f66dfe2df412f1562624942d881a

    SHA512

    8c62bd962a492d660df1868b29ed9657de94988cb7b8bd0f97801910722d0ea73efbca363eac5ead192efd857c12fa027c504bdc1aa154579cfb664260fdd3cd

  • /data/data/com.resou.reader/files/umeng_it.cache
    Filesize

    433B

    MD5

    669d27e1ed0349ff45ae483793c942aa

    SHA1

    5069c6427007c5c816c84dae21a4ae7e9428c293

    SHA256

    381e6c8e383ff33f08e7771540f974ae1ddf968f428d96e678bfaabe6c791c4a

    SHA512

    8a0dfb09eaf6c8cd4bd9f1062850bc82c7872bbf4457f6923f81b68cd2c051ce4b2688df1538b461484af62196522f4556c8506c1ce3be2d94d17b10b2529581

  • /storage/emulated/0/.DataStorage/ContextData.xml
    Filesize

    12KB

    MD5

    e4f44d0015d967e9fff528fa714119b6

    SHA1

    f2e3287cf8f81c19666d7bac5f68eee52892bb93

    SHA256

    8c0a498b691933a227990133fe542841135b68fd3898bdb0b42305674ce96c44

    SHA512

    e3ea34f70fe27a775b4a4fb5b56134504023cfe2e59d8f8258717270b2435cf9d8f270af7debf47f25a85975a0461ecd827db891a8ef00f68d7469aff5568e59

  • /storage/emulated/0/.DataStorage/ContextData.xml
    Filesize

    20KB

    MD5

    5486b2b75264b775bb672b36150c2bf7

    SHA1

    043677415a4b1c4ce45863d5e4604e76b140ba63

    SHA256

    048b4b0ed2c0edb36acd367d1ae0a2fa4eb1e85be7aa6a76e71ac1c8f48946fb

    SHA512

    5acf8d2f116c38f87eebd93b829a12b3d5c56a79c257973722e56e106bddb619e2cf7e2de93edba3ef99883ab015a7dc679026dca6a89dd48b07e30eb8a460c6

  • /storage/emulated/0/.DataStorage/ContextData.xml
    Filesize

    12KB

    MD5

    75a9391b062a25a71b8b6d1ffc59dc3f

    SHA1

    6e0286b95369d8b95fbfab26f1fd1e52ba15c962

    SHA256

    60c705525939afb7209b92168ace59c4197358d7143c61d352d3984086e2130d

    SHA512

    857e502c3435ae473e1d8d0fcd0a6abc055cb67fdf0c3f2b9a20c982b39c5cfc1b813b787bc97fa318bf0e97d82b0fb3d074a4775daa2355fb26dca6e200f675

  • /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
    Filesize

    111B

    MD5

    d07e4217c85c22e345def69cfca27780

    SHA1

    8a9665ff4d1dcdb37609f9ad865cf753fc351a05

    SHA256

    9ddfa1c45879eebc71d75648d9a7012d80785e22fb850eb8f02357802748940b

    SHA512

    7bb85fb1305790aae8bf3957260a593adf99a8cf4f947e4a5c7bb387212ae00c5f1922cdd3a7cb55a09ceadba43b9d7b1267b9478b1b44843c829243d355e772

  • /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
    Filesize

    167B

    MD5

    5ba066306599ccc8329d18d9f6e993ef

    SHA1

    0af5dbba955579564dea30095ef2e0a3c7ffb361

    SHA256

    ab85b1f3c784952fdbb21101682c0867de67ca0d4e5ee2c5ae1d6e66b6f5fd83

    SHA512

    11e2393fdd6a58da2b28d9b9a85688130be72c2837500c3bef7663f1a85a782d3c9df4a9cf7048434aa8c8236ffa59a5bfd5dfe666756f4a6b92d3831a3ae92e

  • /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
    Filesize

    8KB

    MD5

    d9d8abb31394b5e6d712049e3e0c2008

    SHA1

    904219f8159ec0daa3040ca534378ea10d6bcf98

    SHA256

    7f84760d73b4b49af97b57d01ac4344787e97d5e5dc644b4c8fef155f76fc33b

    SHA512

    f6fab82c4445bac775dc6fe35d184e5f9f99cf00b877012e109787a8f91582cf51cec7b7e92083bb6bc790071f93cfcb40cd6167de7f7475f8095eb39bd62c91