680d4e83295bb7587aa4516f712adc56f361ddac9324eb7ddb8e72d2cf376467

Analysis

max time kernel
3s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240514-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
submitted
22-05-2024 23:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68ef219c8c132b9df1182d9db75b8d25_JaffaCakes118.apk
Size

21.8MB
MD5

68ef219c8c132b9df1182d9db75b8d25
SHA1

6fa27572886d4d405c92ea7ae34cd19bd134f201
SHA256

680d4e83295bb7587aa4516f712adc56f361ddac9324eb7ddb8e72d2cf376467
SHA512

dcea925c8314d169d32b38b14b0df3bb3393e1c533ea76eeeac16bc676884f16d7f38d3cad05a35d732d1e2514b63e0fd6531701fccb21344b24dc66ce759134
SSDEEP

393216:W2DSZ9u9O4X9uGtUNCK54bOZkLx0hb2fHxF4096Q46BJJjbuQbF0EtfK3/sKH7mP:WWfc4X9uGtUXzset2fHP40974651BGHw

Score

7^/10

discovery evasion

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

Processes:

com.lixiangdong.audioextrator

ioc	pid	process
/data/user/0/com.lixiangdong.audioextrator/app_AdServer/AdServer_asset.apk	4523	com.lixiangdong.audioextrator
/data/user/0/com.lixiangdong.audioextrator/app_analytics/analytics_asset.apk	4523	com.lixiangdong.audioextrator

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

System Network Connections Discovery
T1421

Processes:

com.lixiangdong.audioextrator

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.lixiangdong.audioextrator
Acquires the wake lock 1 IoCs

Processes:

com.lixiangdong.audioextrator

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.lixiangdong.audioextrator
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

com.lixiangdong.audioextrator

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.lixiangdong.audioextrator

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.lixiangdong.audioextrator

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.lixiangdong.audioextrator

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.lixiangdong.audioextrator

Requests dangerous framework permissions 3 IoCs

Processes:

description	ioc
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE

com.lixiangdong.audioextrator
1⤵
- Loads dropped Dex/Jar
- Queries information about the current Wi-Fi connection
- Acquires the wake lock
- Checks if the internet connection is available
PID:4523

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.lixiangdong.audioextrator/app_AdServer/AdServer_asset.apk
Filesize
1.1MB

MD5
73c2ac27961b9db4274ca13a178c0fa2

SHA1
3d1b1a8f6c9bc63fc88068c71e98bbe70797d03e

SHA256
751012d560a3c16a6f377f403ea12b9c6805a279d84c08210f9a5543c5bef42e

SHA512
591bf3bd1316189616aed273c5bdcb49ed1c46fc7bdf6ee1db9ce11b317dbfda5477989cc3ceafaa2e02dc6555afa1ac4ba872ea27d9a8ae9b5a9ac3abadcef8

Download Submit
/data/user/0/com.lixiangdong.audioextrator/app_AdServer/AdServer_asset.apk
Filesize
379KB

MD5
e865fc4fa68968e2f5375e94d8b9a9ed

SHA1
ba765ce01cb46ddd73de57ee5035e39133840d1b

SHA256
b1fff92a015efe5fbe4c4dc2c23fbeb7b10682dee887d91e80d7db939ae91e5c

SHA512
cf5ea475bd4e5edb0e6e1a5e30e979edb49e6d683370fa05e410635c1251e5293ab59e830e5840556b0721e22b954b2c50341f26eae4a3e71ce5280246259b94

Download Submit
/data/user/0/com.lixiangdong.audioextrator/app_analytics/analytics_asset.apk
Filesize
159KB

MD5
d2e90bb505f20fc73baf25805b0273aa

SHA1
240fbbfda194a65761baed6f3546bc4c744a1850

SHA256
77060ad812f5e6e9e896c39bc548f8295238eaa9941e1986e8e024e7d2114309

SHA512
c2ef3f79b6cfb171b0904ff8138238cbf985344d91d6d9ec35472d14233d1b108cc0234259e8286cbb099747cc8d9d2f74c8c7394ab3a6dcfc2cc95e168c8c85

Download Submit
/data/user/0/com.lixiangdong.audioextrator/app_analytics/analytics_asset.apk
Filesize
132KB

MD5
6d363f8778efe0e54f37ccce23d16fbc

SHA1
11d186169520c633d09a1a775747ed0fe5181c55

SHA256
b1b9b928f020d1ecd232211f2733dd1fc640f5101db35794ef43dca96766aa55

SHA512
e375c9d975e4c44d7424c43f7c01cdb5db474a71c4658ca1a021a5cd3265a8e5027f671f3d04ddee962a34f65ae4eeba5c45c36c286a8016277993a1d6931cb9

Download Submit
/data/user/0/com.lixiangdong.audioextrator/app_analytics/asset_lib/libanalytics.so
Filesize
105KB

MD5
cd1cdef06a5e2a33c5c9e7d4a6cb915f

SHA1
8df09fd32c4fa6b821d9dee89a4fcbf7d32b9b02

SHA256
929c2b04d1495dd1a8b8b72552daedb5d8c385526fac224f5e3c466f748467bf

SHA512
8518002482356e5caad64d33f74172f13fdf3150a05d3dd20662bac8e3ff3e95986a5a7331fc60753d6db8eb5aa3e0779127946505d1fbd03e197359203f88f1

Download Submit