Analysis

  • max time kernel
    179s
  • max time network
    131s
  • platform
    android_x86
  • resource
    android-x86-arm-20240514-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
  • submitted
    22-05-2024 23:18

General

  • Target

    68fa15a977506334699c754c5ab6c2d6_JaffaCakes118.apk

  • Size

    31.3MB

  • MD5

    68fa15a977506334699c754c5ab6c2d6

  • SHA1

    e04c05d636d573d48765782768f85caf421247c8

  • SHA256

    b3b42792483be1827c4b676ef26c7e955cded449955bc5f7f4b3caefa531decb

  • SHA512

    82d14f1dc92ff5d967513fed945b306cd380eb02d8f161d620dacce8362c3d3af8d3a14fe8cc7f0632701f71ea61ab6c24e4112f0b0d0c13ceec2a02bd7260dd

  • SSDEEP

    393216:6h5JleOjcMMEpxHGH9eCW/qzaeavjbkE6MkJuL5o+bNJfxt2j0VvPWtb5oBjdQS1:KXlpjPVy+9R6gVpbZ+0Vqy1J3vXDZn

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 4 IoCs
  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

  • Checks memory information 2 TTPs 1 IoCs

    Checks memory information which indicate if the system is an emulator.

  • Loads dropped Dex/Jar 1 TTPs 6 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Checks if the internet connection is available 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.virtualinfocom.fly.adventure.gtx
    1⤵
    • Checks if the Android device is rooted.
    • Checks CPU information
    • Checks memory information
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Queries information about the current Wi-Fi connection
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4282
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.virtualinfocom.fly.adventure.gtx/.jiagu/tmp.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/data/com.virtualinfocom.fly.adventure.gtx/.jiagu/oat/x86/tmp.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4325
    • cat /sys/class/net/wlan0/address
      2⤵
        PID:4354
      • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.virtualinfocom.fly.adventure.gtx/files/ebody/res/37669/vva.jar --output-vdex-fd=63 --oat-fd=64 --oat-location=/data/user/0/com.virtualinfocom.fly.adventure.gtx/files/ebody/res/37669/oat/x86/vva.odex --compiler-filter=quicken --class-loader-context=&
        2⤵
        • Loads dropped Dex/Jar
        PID:4414
      • sh -c ps
        2⤵
          PID:4499
        • ps
          2⤵
            PID:4499
          • ps
            2⤵
              PID:4525

          Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • /data/data/com.virtualinfocom.fly.adventure.gtx/.jiagu/classes.dex
            Filesize

            4.4MB

            MD5

            53ed1340c133da8c99c54ef8c03b71f1

            SHA1

            3825c3e938c2b571ff4bea74b0c57f9d7415acc8

            SHA256

            132809804ab33a206bb986d8c65187356f90b1d8507b03551e20c49a9f410a3c

            SHA512

            2be0210166d415e40abaf9aebfba503225fea5f51c8bf6d619a85579fb2ada4a7df20356784b36b49e420750572b41d09f61f88626760927e57d98f85f2e6956

          • /data/data/com.virtualinfocom.fly.adventure.gtx/.jiagu/libjiagu.so
            Filesize

            485KB

            MD5

            1da618896802fdb4b6f17c92703424f4

            SHA1

            b48aa81ac014a5a7f6e95e618e4f951ee12d34c3

            SHA256

            2cbf986b5e1357e00347d75d6f631539c0f368208079df36bb44603ac4e6973f

            SHA512

            620a06d8df24597467318582a12bce45e2e2cb66069ffbd6fa27ac5a164c58398ddb9c2348e6ef443272a22ca85fcfa03439d0f0f22109a93708d562e0737cb6

          • /data/data/com.virtualinfocom.fly.adventure.gtx/.jiagu/tmp.dex
            Filesize

            284B

            MD5

            f1771b68f5f9b168b79ff59ae2daabe4

            SHA1

            0df6a835559f5c99670214a12700e7d8c28e5a42

            SHA256

            9f8898ce35a47aeafced99ea0d17c33e73037bb2307c7688e50819966f4ae939

            SHA512

            dae27d19727b89bec49398503baa6801640540355688dfabbe689c97545295c2c2d9b0f0dcd7cbc4cfbf701d0c0c3289e647a152f49ff242d1ecc741efe4145d

          • /data/data/com.virtualinfocom.fly.adventure.gtx/app_ebody/res/xmtok/37669/uuloi
            Filesize

            2.6MB

            MD5

            f89793bb73a1dfca31a10ae21357bed8

            SHA1

            47a36c05e0fc31a2803da81ba1297267806101ef

            SHA256

            84c62eabb4d46fe7773e72fc36a58581ff48161f7f9665af96eac568cb251dda

            SHA512

            d500017a3da344ddc56398a7bd908a824148f3270502ba004897a57997fe35faa97443e422ef006c98700069886865131a205c3c4ba98e618c6a613ad58431cd

          • /data/data/com.virtualinfocom.fly.adventure.gtx/databases/cc/cc.db
            Filesize

            36KB

            MD5

            5d7ea1a23af19b4340cc8d90f28297d5

            SHA1

            4cfe95b23a9e98378d69c4290af81b51fbe76aea

            SHA256

            474c4a54534ed96beacad7cc9a805a3f53ec9c0522fc7bcc59771cf500a6a0da

            SHA512

            33071f4c92da0a3df01c4a61dd165df7c7e0f4f37753cafe02d19fc876a5e7fcbb01c069c804e140ab8bfa0644a55f50fd1373646d1c439f817baa5ffbd47f7b

          • /data/data/com.virtualinfocom.fly.adventure.gtx/databases/cc/cc.db-journal
            Filesize

            512B

            MD5

            e362e4c4fd4653eac1d094f3b33c2aaf

            SHA1

            771606c69986bfe000fd4f649018d0e7bf88b1fb

            SHA256

            ba896dfa99108fcfb38f87f091c5963a274dae2e9c4a3222d496d1ce00f3f16f

            SHA512

            81954474638ddfa63d5d60d6e2a7cffcc63dba1a8ccfb932503cb71b51b4e874c73c97ee6f6434b301eea14efa12fdf6ed9555aad59656f4e46d6bf8c2a68d1c

          • /data/data/com.virtualinfocom.fly.adventure.gtx/databases/cc/cc.db-shm
            Filesize

            32KB

            MD5

            bb7df04e1b0a2570657527a7e108ae23

            SHA1

            5188431849b4613152fd7bdba6a3ff0a4fd6424b

            SHA256

            c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

            SHA512

            768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

          • /data/data/com.virtualinfocom.fly.adventure.gtx/databases/cc/cc.db-wal
            Filesize

            48KB

            MD5

            b7eb7a43cca4cf3581f662feb5677e6d

            SHA1

            96af715dca66e243fa00359ec017d2d8acd92870

            SHA256

            e4cff416d7ed5a3edf6ca17da40010f3aaf6f94e48ee2bad8a6647b94d0bb3b6

            SHA512

            53bb5755785e3022e59ad03b622418d2d29435a17ae766ab918ccdd639ca4ceb17289d9e9bce6606242df0192856f30963f93a0553bc4b28eb3de4f51ae4cb23

          • /data/data/com.virtualinfocom.fly.adventure.gtx/files/.jglogs/.jg.ac
            Filesize

            40B

            MD5

            cf927b1d1651b71e7ddfa1d04393a870

            SHA1

            e2c3ab13a7ff583495d67be9f728199d92dbd282

            SHA256

            74644a3e91777c51eb4e6425846c2fe370d5722fd35771b4f47a0418f0e64f96

            SHA512

            a317ab1deb12359244062c847c092b2974d305a1090e58f0528b0c0abf8e8f72e1006aba49308e97f9443e96a24829638122cacd2a20ad8145cabd44c4d82a75

          • /data/data/com.virtualinfocom.fly.adventure.gtx/files/.jglogs/.jg.ac
            Filesize

            40B

            MD5

            5ec75c819eae3e53bab604fe637fbe2a

            SHA1

            887487d2c6dacb1dc1f3da3aca290a2545f3e03f

            SHA256

            c534de50ed6d4e7d1ac2759599acf8856c1424cca32410506ae9d080c60f1fcd

            SHA512

            fe063e4e591d0c775d9c9bdd71d88b6d2c2191fec47eda46192d759cf7f872e172e69a8d61d070a6b565a2ad39b7f6e55f14e87627bf1fd1331e703618454dc8

          • /data/data/com.virtualinfocom.fly.adventure.gtx/files/.jglogs/.jg.di
            Filesize

            340B

            MD5

            a4a61b107705768ab35638ce1509aaee

            SHA1

            fd858008bbd0a6a82a48499df03c3d1f900ebc1b

            SHA256

            26d99575a040d1fc52fb9b306f53aacc3e43196dccb05d22682efaab1e877b2f

            SHA512

            4df887816b06fbd4e15a1ab5ae67ca10dfcffb36d8dec01efeb8bb7df8fb0bd6fbe36485f5b9e3abfd6f5c7f05874ddeb698f488a67421004d8c9063783251a2

          • /data/data/com.virtualinfocom.fly.adventure.gtx/files/.jglogs/.jg.di
            Filesize

            340B

            MD5

            b227e7d28963bbc1c7707d7bf5f67207

            SHA1

            0db3a089c723265752314e8b06c59649bd29c173

            SHA256

            b9608cfd4c7e4d767842a3227fc7e4a363d0bf3a60f45baf01f8fb47d2e34513

            SHA512

            e2ba9bb2708ab5844f58d9283fca83cba2ad1f89268748a4f80c54cfc750372d9a634ea8e004479d96c1c0c444d626cb163553ef5034f91a549ba09a11672b74

          • /data/data/com.virtualinfocom.fly.adventure.gtx/files/.jglogs/.jg.ic
            Filesize

            40B

            MD5

            805d1920883381aeb2953a3765db166c

            SHA1

            e735898ec52b135bf92ae442243d94ef0d85c608

            SHA256

            96deead400ab90a0de898db942461508267610bc40164cff70eb94586cbf1127

            SHA512

            2b843fccd7985f080c1718a61dd4fc734efbd1e348fe502f7de019852babcce7e9946d79808f7eb685cbcf848c8b9e624fabda968a5a4a14f33f3b2b7a518b8e

          • /data/data/com.virtualinfocom.fly.adventure.gtx/files/.jglogs/.jg.rd
            Filesize

            73B

            MD5

            ebb7f6309364216bbeab567cc351e635

            SHA1

            4335553919865f4b083179dbd52ea8e8fe7c23f9

            SHA256

            d729da8748383494833eea6b252304863926c11f43e5aa7c289a177e02764393

            SHA512

            a851877cef25d8751f6b551f3b381c774576e889e4c8e718da4bee00a7f539dd450925e004f910abe1de6004c5452541f727accb6ac9c0f4edf97ef01d0f8425

          • /data/data/com.virtualinfocom.fly.adventure.gtx/files/.jglogs/.jg.ri
            Filesize

            314B

            MD5

            df96d680391522ab6dcc841cba4d3c7d

            SHA1

            f1371f7f7dbceb1fb54627aa220b42393f20bc44

            SHA256

            07dd5be6434e404c2d39001e9815434fb3a62413b5e41b26d69af718155212c8

            SHA512

            e3acf7b6cb17573f90b4e968b699647bcf6c73ded7e36603b5a7cc448bc0f766ab65a957f581f6e45ef14b7416979ebc508b39e740ee2e0db865d9488cf88f9c

          • /data/data/com.virtualinfocom.fly.adventure.gtx/files/.jglogs/.jg.store
            Filesize

            127B

            MD5

            c5fb2fcbb461594400d1aebde930b4a1

            SHA1

            d2b6f7883f2454977ba1b784580616f9dce51324

            SHA256

            a0647ba52ede0f70adb7bb48be1c52cd8ec5ee507baf306e569ea16c219c02c0

            SHA512

            dc8183b287b9dcc5a2179e6f5cad6580fe038f32dd71f497d174701fc9728406e71865a553227fd958f4792f9fad12f6ee07b0ee77291796234474c84b5dcce0

          • /data/data/com.virtualinfocom.fly.adventure.gtx/files/.jglogs/.jg.store
            Filesize

            32B

            MD5

            448e391c59eef34ee1defbe4dee4c41f

            SHA1

            df1f890987371d7d8e6963c68b787856e42bc146

            SHA256

            55612e17689f4bb05f27e18b4f6d06ffef92a6a8893a5cfdd3d5b99a6028b549

            SHA512

            ce336ce895ba861dda7da27e8869dea065eb3c3403cac55cdf1935409e5ebc95b495370f87ed7416af20af533b15615472e333ae9f2fd2713040f526835399b7

          • /data/data/com.virtualinfocom.fly.adventure.gtx/files/.jiagu.lock
            Filesize

            27B

            MD5

            0a38beee46028fbcea8a12c044c80532

            SHA1

            07ffc12898d81f6e77e2fe542e34be077353b5e1

            SHA256

            85ac60e08d4a821b841d71e09c92e739ba68ac064ecf3f3d579aba257bc5fb11

            SHA512

            ac19a40c6d77697bba2b7059e95060d11a93b395eb89d00c7f2bf9c45218ad6e43f7633bdd014d24c715ec9b09d21a2afeb4edf83bc3eb14d6562410103a39ba

          • /data/data/com.virtualinfocom.fly.adventure.gtx/files/INSTALLATION
            Filesize

            36B

            MD5

            79f583bb827550651f0bac4503dd723c

            SHA1

            09baf4d1153231bd5d3b16824bcf3957933514d6

            SHA256

            7e5a5df7a7c8db50f2e8427e50f82b7ddaf33d92f577826eae9c75cab8cf85aa

            SHA512

            ba7baae429a95bd064530c164f37026206b068d76d63486a4b8ecefb32939ea61d466c7295913be07553f7273e03e71bb8a7c0f53bafaa0714b7b9ad8a70da4b

          • /data/data/com.virtualinfocom.fly.adventure.gtx/files/adc3/026ae9c9824b3e483fa6c71fa88f57ae27816141
            Filesize

            41B

            MD5

            a9b553b24f2a2d8c3eaf7dff9f6cc3c9

            SHA1

            e68c068ba3679bb62a3ff6b9b7e0401a84f2225e

            SHA256

            c957f97f4f452cfa6086d68c9d64cffbd1ed16b348874ffe701aaba0d56d2a12

            SHA512

            39a30ec02603c25c45776135ab031cb85cd4a5ede77ec6bbfc37daf308ac56148192437fc9edc3b7109283d968cf10f284f256b567e12ce3e46e5c2baf1d03d8

          • /data/data/com.virtualinfocom.fly.adventure.gtx/files/adc3/AppInfo
            Filesize

            91B

            MD5

            14c9760b82cb25081d32ee9f1f4c8b8c

            SHA1

            c46d29dedebc3fbaac54a855245a2acaa7b0cdb4

            SHA256

            12b0ccbf7b356a579bfbb256d55e9687db588f2c941e790b35b4bd16ca5fa99c

            SHA512

            28124700f16e137f13312c3128d7f9a9e46840ee39a143a01372994279ab9f4196d5974c06e9f4bb47d8be5d362e865b93fa61d82ef634a773c149d5b59d0090

          • /data/data/com.virtualinfocom.fly.adventure.gtx/files/adc3/AppVersion
            Filesize

            26B

            MD5

            6447712249a0828ec925e494f8a17569

            SHA1

            73125a77a9fef8bf2b5793fc7bb74c4a15d7f924

            SHA256

            be8d26758710bfd7576537b5ee708340003719fbd469681bde06c32b14fd4393

            SHA512

            4e913cfff91356fc507698e69a5964224ccb0b3acd0bf1f2cd4d18d88a993dbfee1b7b5d042b2df86b14e970d7f1f3666e77babfecd4b4126c1a81e6486f4164

          • /data/data/com.virtualinfocom.fly.adventure.gtx/files/ebody/as/cheuu
            Filesize

            8B

            MD5

            99468d9a54dd4f9b320a4d525e7e93ef

            SHA1

            d484a071d1e260881c42a7c126ab951edf35b2c8

            SHA256

            5315b8484260796c9a63fa6af38ea05c1812c5ffdf0c1be6c938bd40e5112a5e

            SHA512

            4a9803170e7ff727e5e099698728bdced0f40b2579ec8f1a143172fb7330236925ddc2deec5a679efa8cdb4fa286b6d523bae1140b38bcfbee926f5f2cee73ce

          • /data/data/com.virtualinfocom.fly.adventure.gtx/files/ebody/res/37669/oat/vva.jar.cur.prof
            Filesize

            365B

            MD5

            5d3c9388a5e323a8a8003363354165fc

            SHA1

            97e2189dbd712adf4d7884f73e93015569fec510

            SHA256

            4646c5628b6e384e664e99552d8e5f5cf674ebcad05f1f9f9e9134f66946893b

            SHA512

            b31990aca806672fef311781b523bb7a67343ffaa667f2ff14bb51686755efd0c2c774d413502fcc54bb4cc89db7b57ce6b06c2b4cf6f78af4244c40c96457d7

          • /data/data/com.virtualinfocom.fly.adventure.gtx/files/ebody/res/37669/vva
            Filesize

            2.6MB

            MD5

            c0a1b0ad00259da1005edd05151635ba

            SHA1

            9679497cb82b4b4a1b2d594029d66b1f1f0de905

            SHA256

            6ec9e8d0b677ea2e6d1282250425af4e57cb7586b26206f9983d680e64aaddf9

            SHA512

            907226b3052ccbf24a7eea23c4aa8f0abd30bb1997d2590821e2561c81beaf1530fefe189c3083884d4463fcc1094a80e65a7c96926e4cda7df9c0d1414cd937

          • /data/data/com.virtualinfocom.fly.adventure.gtx/files/ebody/res/37669/vva.jar
            Filesize

            342KB

            MD5

            d66b3092a0364edd2d053b28db5450dc

            SHA1

            b94e8bb0ad25a3dff77e9960cf9442f1141d5d4c

            SHA256

            2b2de2a36792222e246096fbc72f3ed89167f4ce7a76c3e46393470ba3d6eff0

            SHA512

            b6e3f2b57797b0621cbb3b664ef9d6557240ece3c866ebac73f0bdc65292e99c14f93cd7cb4f21639d7f53030b81decc3536c8a1c1b534005004f8532f5ebd0b

          • /data/data/com.virtualinfocom.fly.adventure.gtx/files/ebody/seey/tmd
            Filesize

            32B

            MD5

            3c650d3e406dca102bde74538010bf06

            SHA1

            12e662b97cfbe786dfe5f80485bc5adadc9aae58

            SHA256

            3c4a4dad0f0a5373ebcef93dcf877eb55a79dbfe902235a52718b6979bef2a78

            SHA512

            c6c621e126be190a479a03ffa0fad9358114e3af5474ac708bd9637ce8b1070f10d97fa44558dc6517ef5f421b92920e7dd7aaba8240514ce76ff3b5c0ff5348

          • /data/data/com.virtualinfocom.fly.adventure.gtx/files/ebody/seey/tv
            Filesize

            5B

            MD5

            f493971809a5352fbc493e2b7e7f7110

            SHA1

            0ad8c106dd4b30f40bf4fec3e8720ec860932bd6

            SHA256

            9085aa498408b4a70b82c08b189ff3969bce460065cfbb21ecd8d6777020e266

            SHA512

            1fb25e95900472fe3523d31010f4b18b32741725f30f3a1b7f23f60c992c113657836645e18c5df5439de92058fda48b6ed72268c34c64453199cda261d0e00e

          • /data/user/0/com.virtualinfocom.fly.adventure.gtx/files/ebody/res/37669/vva.jar
            Filesize

            1.0MB

            MD5

            6cf733de6bf35000bfb604214fa3a2e6

            SHA1

            138c35beb7ee9ef139fae2413a13188ab54cbcaa

            SHA256

            82bc8e6cdd63c5a2791a10951281c6e34f5f662f894b6b3baa9d5c4fd2032575

            SHA512

            88a57beed0a300dbc1b29f9a3cdc743e783b13d37e11b68bc350b6853f8a8fab76c364c74feebdd131b9efec442984deaef9f4b99bb31008a75788a162f45fe5

          • /data/user/0/com.virtualinfocom.fly.adventure.gtx/files/ebody/res/37669/vva.jar
            Filesize

            1.0MB

            MD5

            d170908004c128c03a3f5bd9b2febdb2

            SHA1

            123a176f4370b54c67f7475e1fc66754696e4398

            SHA256

            04ae0c6944c16e958fa9b29b8561efe1fd9c06625f18bcdf37757b9c56799bc6

            SHA512

            3a940951695e3cbcff1a1d102ed2739d05415c02179fd7f6d2a316ea3f5e0b09e143016e4a6f98f48354d0caf7c98cf6c1c8f37299dc7b432cc70e0e632ac673

          • /storage/emulated/0/360/.deviceId
            Filesize

            48B

            MD5

            1d8d16c4e3b19ebf18988530d9b9a757

            SHA1

            bc94c1cce05cd848a53271ecb9c5311e27ffebf5

            SHA256

            abd87140da8de3d0aa39a24a8d52bfe7b2eb28f7a3d505f205471c7e8f4964d7

            SHA512

            4562d1eedbc5c2dd7f25cd1c70343053fd451026403585182b142a64f17016c1bd0bf6ad51667b439b220e425640e55fbbda08517e7106376cdc220a4555da82

          • /storage/emulated/0/360/.iddata
            Filesize

            32B

            MD5

            5269cd197340edea9c0046c6cdb6bdfe

            SHA1

            1b7264d8f79daeec50595ea20ff3dfe628609941

            SHA256

            86163c5d9a0e93232bf5133e4353f2b1ef8c32b9f42e185994b3a4c797422680

            SHA512

            41dacd156f93bfd487eed81e888484cac084ad127cfbf5ea269f15facc78c9ba8c9dd2a26ecfcab680205ee13efec62ccf62de2069cbd3c5b8bf9cad84a5102f