608fea5151526866ebb91b8a7dbe98ae5d02157462e3ac73bbdcb03235fb4fe4

Analysis

max time kernel
13s
max time network
130s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
22-05-2024 22:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68d9c5fd69f0c4c00851a5f4ab2c509f_JaffaCakes118.apk
Size

17.0MB
MD5

68d9c5fd69f0c4c00851a5f4ab2c509f
SHA1

90a5195c0b499fa3083288cd2778c7db2e183bfb
SHA256

608fea5151526866ebb91b8a7dbe98ae5d02157462e3ac73bbdcb03235fb4fe4
SHA512

8539f33fc684d5fbdcb72abe755cb9e95e74d179ee4dea02baf9bc0c36f253c7744aa9fe78bf70ed2157a921e1ef1a54dd60f8ff2aea16ac624b53049f57d4eb
SSDEEP

393216:W0AVAKmSiBurO38NNaS0HjX8+t9GJ9khfjjuTc54eq0B/jd3o:FAVAKPauXHhsXJPMwfj4C4z0B/q

Score

8^/10

banker discovery evasion impact persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

T1418.001
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
evasion discovery

T1633.001

T1426

Processes:

com.dhxd.zhishi

description ioc process

File opened for read /proc/cpuinfo com.dhxd.zhishi
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
evasion discovery

T1633.001

T1426

Processes:

com.dhxd.zhishi

description ioc process

File opened for read /proc/meminfo com.dhxd.zhishi

description	ioc	process
File opened for read	/proc/cpuinfo	com.dhxd.zhishi

description	ioc	process
File opened for read	/proc/meminfo	com.dhxd.zhishi

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

T1407

Processes:

com.dhxd.zhishi/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.dhxd.zhishi/mix.dex --output-vdex-fd=56 --oat-fd=57 --oat-location=/data/data/com.dhxd.zhishi/oat/x86/mix.odex --compiler-filter=quicken --class-loader-context=&

ioc	pid	process
/data/data/com.dhxd.zhishi/mix.dex	4245	com.dhxd.zhishi
/data/data/com.dhxd.zhishi/mix.dex	4245	com.dhxd.zhishi
/data/data/com.dhxd.zhishi/mix.dex	4314	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.dhxd.zhishi/mix.dex --output-vdex-fd=56 --oat-fd=57 --oat-location=/data/data/com.dhxd.zhishi/oat/x86/mix.odex --compiler-filter=quicken --class-loader-context=&

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

T1421

Processes:

com.dhxd.zhishi

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.dhxd.zhishi
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

T1422

Processes:

com.dhxd.zhishi

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.dhxd.zhishi
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

T1624.001

Processes:

com.dhxd.zhishi

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.dhxd.zhishi
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

T1421

Processes:

com.dhxd.zhishi

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.dhxd.zhishi
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

T1422
Reads information about phone network operator. 1 TTPs
discovery

T1422
Checks the presence of a debugger
evasion
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

T1471

Processes:

com.dhxd.zhishi

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.dhxd.zhishi

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.dhxd.zhishi

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.dhxd.zhishi

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.dhxd.zhishi

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.dhxd.zhishi

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.dhxd.zhishi

com.dhxd.zhishi
1⤵
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4245

sh -c getprop ro.yunos.version
2⤵
PID:4288

getprop ro.yunos.version
2⤵
PID:4288

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.dhxd.zhishi/mix.dex --output-vdex-fd=56 --oat-fd=57 --oat-location=/data/data/com.dhxd.zhishi/oat/x86/mix.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:4314

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.dhxd.zhishi/databases/bugly_db_legu
Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.dhxd.zhishi/databases/bugly_db_legu-journal
Filesize
512B

MD5
8783260b51f558f2e8f1a627bc37b3e9

SHA1
cfd3d6947ca6dd7075eb5f867327079920daa97a

SHA256
5b33c0472d07fcd610773c8b7137d3d072472f5ab482d54eb054ee412bea47a2

SHA512
f68e70222b7369f4ebc41b4c025f99344fe026e7738b558ac3de1022f725d924f3db878d29bb6e1ec34a09e0814050f7a76515d45237a9e5072afcbdf51909c6

Download Submit
/data/data/com.dhxd.zhishi/databases/bugly_db_legu-shm
Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.dhxd.zhishi/databases/bugly_db_legu-wal
Filesize
92KB

MD5
04e682e2ec5b37fd7fbd0add2294cb35

SHA1
dd3b3b2e0c67acb9780fbc7c220be413403efb07

SHA256
fa1c3bc59a41557ed63c2e62c4141f078ec0c473c2f767e6cab61a66c1f4c1bf

SHA512
653d6e0ce8ecb588be1a84499d04c25101aa75ec83e33b4fe2e577a9bb12e743b35f0699fa372cd0491b76fe1839993ad2d7e11493abe97157610383292d266b

Download Submit
/data/data/com.dhxd.zhishi/files/cnc3ejE6/eje3cnc
Filesize
335B

MD5
585839d66722cfd02e40cb740cccb633

SHA1
374c19200fee201b26d0153487a281a934615884

SHA256
86a9bb4985cca6c9636c4fd071bef4b70ba7b3a5eb51af869a1299dc2b1574a8

SHA512
09bbe1bf1455861fd4732f2d1945c84bac34090906ac2fab75d144c22ffcf6bc585c8209e94a2b1919c8402df53966081a1af2993e12261ae4c4ac5568667d88

Download Submit
/data/data/com.dhxd.zhishi/mix.dex
Filesize
292B

MD5
63f77f99bd2c2b772a479923bde11974

SHA1
c7632e7d301e4463fafce85f84e9c3d7da3fdbbe

SHA256
4c76a3af64cdd2f8713ffe2733dea50dbe714d0ca41c17d1847ee5b62a7ca615

SHA512
3aae4a89d1ed51fdd911cb367eb10afe3c2264e4222085891b18a60d5412f85d10bf5c8f3c6642db70abb9aa42732bac5c42c42ee32d587100f53c21b5beb16c

Download Submit
/data/data/com.dhxd.zhishi/shared_prefs_ext/test_app
Filesize
29B

MD5
29902646cbeeb9620b92a4a33e6bc9f6

SHA1
2ae06268861897f5bd03ac08446d7e65722f4064

SHA256
758f3a1c9659bf5921c90323bad25207d5c10479388681aebf45af34256a8080

SHA512
d4c7ac82b028c865e1752608993c176f93a88e452be14929a0fe71215d430b9e82d7bd62c0d250f56e9ef6b745c251b169e2c6f4f3c330c666efa27d94786ecc

Download Submit
/storage/emulated/0/.imei.txt
Filesize
32B

MD5
4ff7f5fac1efd62f5d1b491e14550aa8

SHA1
1154fe386145716053f98373f4d222a3be1783ec

SHA256
3456d82b4b8f9b50fd7ecbf36013e5c5e9c6723d7ea36248cc451850276ef42d

SHA512
5c511082ec7cbefba51decd617debe44c6b40b0bbac63636513de2a24e7fe1a3681d51e5287312d4733e5ea531f2e5a538fd7dd93b73ab8f37825ccee895a59c

Download Submit