aa380ff914e8a09595b221a06445141ea4a7b7ece4ce82a20ef64417915b411b

Analysis

max time kernel
179s
max time network
186s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
22-05-2024 23:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6908ddc72ecea0e26eaa5eefb87b4480_JaffaCakes118.apk
Size

19.1MB
MD5

6908ddc72ecea0e26eaa5eefb87b4480
SHA1

a95a656db63721a5c1ed8abda62b43c07a17a19e
SHA256

aa380ff914e8a09595b221a06445141ea4a7b7ece4ce82a20ef64417915b411b
SHA512

d8e3547ab72f52f2d2588ab70d9bde0314c154a42bc9079942cf602812210386be2ae0b17497aeae22c2e650795e2026b94a1e051786c8d9f316286e1c437e85
SSDEEP

393216:scRaw+16XFh1Gy1EoplS6ZwzOHi6X+qQic/AfslsgcByoYpnfNqhaoI2c:3aw+1cfGyuojSkiP61ffK7AyoMfkaolc

Score

8^/10

collection discovery evasion impact persistence

Malware Config

Signatures

Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
collection discovery evasion

Location Tracking
T1430

Geofencing
T1627.001

Processes:

cn.gmw.cloud

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getCellLocation cn.gmw.cloud
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

cn.gmw.cloud

description ioc process

File opened for read /proc/cpuinfo cn.gmw.cloud
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

cn.gmw.cloud

description ioc process

File opened for read /proc/meminfo cn.gmw.cloud
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

Process Discovery
T1424

Processes:

cn.gmw.cloud

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses cn.gmw.cloud
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

System Network Connections Discovery
T1421

Processes:

cn.gmw.cloud

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo cn.gmw.cloud
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

System Network Configuration Discovery
T1422

Processes:

cn.gmw.cloud

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone cn.gmw.cloud
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

cn.gmw.cloud

description ioc process

Framework service call android.app.IActivityManager.registerReceiver cn.gmw.cloud
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

cn.gmw.cloud

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo cn.gmw.cloud
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

cn.gmw.cloud

description ioc process

Framework API call javax.crypto.Cipher.doFinal cn.gmw.cloud

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	cn.gmw.cloud

description	ioc	process
File opened for read	/proc/cpuinfo	cn.gmw.cloud

description	ioc	process
File opened for read	/proc/meminfo	cn.gmw.cloud

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	cn.gmw.cloud

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	cn.gmw.cloud

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	cn.gmw.cloud

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	cn.gmw.cloud

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	cn.gmw.cloud

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	cn.gmw.cloud

cn.gmw.cloud
1⤵
- Requests cell location
- Checks CPU information
- Checks memory information
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4305

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/cn.gmw.cloud/app_crashrecord/1004

Filesize
58B

MD5
0d210bfb2a0e1f1b4c082a6a0f79de07

SHA1
bb8ed9e364db79d1d9f2fcde3f15091893222faa

SHA256
988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d

SHA512
536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1

Download Submit
/data/data/cn.gmw.cloud/app_crashrecord/1004

Filesize
219B

MD5
e095d2b95396fb43a2cd32840e0c8f20

SHA1
d8edf8f195dd3307b8768717a3e35a516011da55

SHA256
7b4d905db43fad3c131909024f802374d47ed7af2ecc2e06407029d93a9af523

SHA512
3af3da49e3bba97be005fec0614e37024fb43ee30f896a8d0ed16ecb6736d46a50861ceae2d65d72d4460c6d2e4c2103413e910df4c5d95753b06300655b2744

Download Submit
/data/data/cn.gmw.cloud/databases/bugly_db_

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/cn.gmw.cloud/databases/bugly_db_-journal

Filesize
512B

MD5
a1f766452b668fed28c9c807f542af1b

SHA1
776cc3ac232ec8b16ff2db3a3ca67dbf1bc2128f

SHA256
7e1e74775117ae17f303b14765bf391d2b9a9b953c8214008d3f613a143a413c

SHA512
76012fae670ff59802938798a30b277764d9281e6f95249bcd74c3c2028ba758b73ee41f75d711db01a560997ad83d1be19c2bbc4245a15ef2a39db87c9b20dd

Download Submit
/data/data/cn.gmw.cloud/databases/bugly_db_-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/cn.gmw.cloud/databases/bugly_db_-wal

Filesize
72KB

MD5
a5f1ae0794c30d71fa63b7b1fd1570a1

SHA1
4cd808c0d0aaff0e0373d36a24fc15a1a10db369

SHA256
2791239c45623f0b9bc7f0a175f9d80190f1c915a84d6f7a7b70df2b835b9a2e

SHA512
b08f2a6797ff2a833a70faec3ece9e67e35df6cb7481103c92ae5cff5c4d260e1bf7eaa42588e9b25fdff47c7f5acda0031ee3531823ff70f4e40d59d23e4da0

Download Submit
/data/data/cn.gmw.cloud/databases/cc/cc.db

Filesize
36KB

MD5
5d7ea1a23af19b4340cc8d90f28297d5

SHA1
4cfe95b23a9e98378d69c4290af81b51fbe76aea

SHA256
474c4a54534ed96beacad7cc9a805a3f53ec9c0522fc7bcc59771cf500a6a0da

SHA512
33071f4c92da0a3df01c4a61dd165df7c7e0f4f37753cafe02d19fc876a5e7fcbb01c069c804e140ab8bfa0644a55f50fd1373646d1c439f817baa5ffbd47f7b

Download Submit
/data/data/cn.gmw.cloud/databases/cc/cc.db

Filesize
36KB

MD5
ce6135aa1b1fe4f2c2db2a546d2a5558

SHA1
79b59582154017aadab783dc266fcb158c252940

SHA256
7b45f576c08c7f78220168cca4a0e33198b13e9bdc8b1da406ddb6887412000c

SHA512
2839075fe374c8567c839ae35ce2d33ec72fdaebf170aa7d224b555e5b0e74d4a43f2f67d17ed806dae841da883e9620d788ea052d06152678afa927307c7ce4

Download Submit
/data/data/cn.gmw.cloud/databases/cc/cc.db-journal

Filesize
512B

MD5
36df7974bf12a4a9a7942958e4ee2dd9

SHA1
02087ed1e2db3738b3647445c2b6eaf2895e1f75

SHA256
81d69879f3884adf8d515a6ad30a0b96cbb55ab80a3ba319a1b09f9ee7c7e9e2

SHA512
454b203b32d1fbf59ed95dd0c4586905d15798e233e4f465ea9a94966e8b228f22a040bdff738165fa980be3973c71b73323ee382219ee972c363e4cd6f3518a

Download Submit
/data/data/cn.gmw.cloud/databases/cc/cc.db-wal

Filesize
48KB

MD5
b4fa246a98281de943750cf530c954f7

SHA1
9d9a6a071323656ef0b84dc61b3798f2fbbf06f3

SHA256
013d52cd626d0e11958b98df417573309bd29bebb6afe8f92a6abbb299a050f3

SHA512
aa2f416d8b421a4f88c1714029c86bfa42d97d0f0fa9db5f7e614bc8fb3be9506410c076d97ee2f7c54d5e8b8866a5fdfbca9ad58078cf488d761f7b1898c2df

Download Submit
/data/data/cn.gmw.cloud/databases/cc/cc.db-wal

Filesize
16KB

MD5
958fd515b44fa9104be15801c2dbb43b

SHA1
68714463cb254aec8c04897266c3d831343b7406

SHA256
18253d871bc09dceffab359656db918fa7bf1fd9ebc9d7f6009925f554060868

SHA512
53f2ff874405f0653e65a521fced1132f4f08aa4f11caa34b1de348a8195b24fbe8e2e1d6b3226d801f037b0fbbdf8d89913f89191db4dfaf12934c49144589a

Download Submit
/data/data/cn.gmw.cloud/files/.um/um_cache_1716421497670.env

Filesize
1KB

MD5
b5ff90f8dbed3e12ea614c8a3c5a4870

SHA1
cfbb96726fd64466ebc71ca07d47f326eb2f4666

SHA256
9e7e120fdbfafced2734dd9c0d9c38bbda9a468c06dd7e447f44ce6f09e35dd4

SHA512
ca67e1b838c058a279235d385a255647a7bf45c8fbd6b060243eafbfca9c363d658c8ae26ea5a527959f301f49d6529342ec6a5c7c73688ec1403f2700f8d387

Download Submit
/data/data/cn.gmw.cloud/files/.umeng/exchangeIdentity.json

Filesize
162B

MD5
11877fd594f4770a794733bd137dd271

SHA1
84e24becfe83d49323ed03d08347f0a75759a927

SHA256
412f60f0f91af816a117e77863d506d08f68d36d324664dd2b1efabd3d4b053d

SHA512
e6588b6f1a1270619a3d4df27451cf7ef6bade4b89f7ad6f4b3d3234cc6f3de4c1e91aa836dc84206f4b851bc0de3b6b3875c8638adc06227bdca750d9a01fe4

Download Submit
/data/data/cn.gmw.cloud/files/com.maa.sdk/access.log

Filesize
296B

MD5
90e8ad87f268e52e6bc51bdcdd884280

SHA1
e881a520e36f2d0b532288381ea32dd9076fb16e

SHA256
ef602b6c03399d21cebe256eabb96f06389ac499f661fce07c0a40a942bf213e

SHA512
ebe0a284184cf4f19d87c87503e9e49cba801a8665e064af782fc9a8d7c0a4d2bd5b162431c7856fcf6e4e0118e08c7c5da0fa235a2b9f515db7c1bbda4cd2a6

Download Submit
/data/data/cn.gmw.cloud/files/mobclick_agent_cached_cn.gmw.cloud75

Filesize
2KB

MD5
2888bd538d6ecef1ef48326865e8e6cf

SHA1
bdcf4f3773fbb649424ffbdbe0f26e7525d18df1

SHA256
0efc5f596baa376cfeb482a9a3490f2b01f7d946d5d8af072dc54a2ec523f69b

SHA512
27af0d236eeb34b9879ac0948f3514f7490359f318959a92c8cd139fc05300fec473a8b1555b0b5718a3221b43bab0b115c1384e7dc2a0bb7b3666bdb65f0444

Download Submit
/data/data/cn.gmw.cloud/files/umeng_it.cache

Filesize
415B

MD5
50e0d289eadd05e4ecbd252d5f18f020

SHA1
8040ff245321c78728c9f740465793ecdbb1252d

SHA256
26ab7688b68b44d8b305fa3711ee5bdfd1b7cb46ba361009552f41f9b601e92a

SHA512
4ffe9ab3127dcfc9dd7efe43d18bb31875fa9a055b1618bb46072184c9c3908bd90a7c6f02d978f0aa764163623c95d66893f09dba6ceb17de207023b7b5a01b

Download Submit
/data/data/cn.gmw.cloud/files/wspx

Filesize
277KB

MD5
b0af5e81eb5ae8b2196ccbd0eab3c65c

SHA1
3ba81ead639281abd20589464a7cd90bb6e8025d

SHA256
42184f314d77add645a9bdb828398d966104d1803b991022b1e7ab7a7e6e0e2e

SHA512
41fc351992aee16dfad9e1381340b56aec18d52edd4c779df5a46e1e978f74c4e87d296ec213691509ca493749549240a3f4a048b9e9dd7a059d4e55b7f5a29f

Download Submit
/storage/emulated/0/Android/data/cn.gmw.cloud/cache/mw_cache/journal.tmp

Filesize
31B

MD5
8c92de9ce46d41a22f3b20f77404cc1d

SHA1
8671a6dca00edb72be47363a7071be65cf270373

SHA256
68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274

SHA512
30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

Download Submit
/storage/emulated/0/gmwdaily/cdnlog/RedCDNUpLoad.log

Filesize
1KB

MD5
b6dc26188924d62b6c32495592f47df5

SHA1
72c8bfc7c6758b29cbc1fd6968fc4a1da5904e00

SHA256
7d61bd61a87b1315e8ba8be21a6c2430c7530fe7fe4e8857e5564b78575c0404

SHA512
2773a7a910174f8a1bd7088daa8780a5af4d694752a48fd9c0b198f862bbb9a3bd083f099e4b554d6df900890d1905dbefe359f28eb280f1661832b4c37cd853

Download Submit
/storage/emulated/0/gmwdaily/cdnlog/m.ini

Filesize
1024B

MD5
a84881f746f80cae9cf6038ffc86ff65

SHA1
0e7fd278ef8f5b59183a1642f1b1974ab1d26eab

SHA256
4025131af9366930f6a8f96845bab680a07fd5939199e4d473eabc372cbea57d

SHA512
1a394f084aa99b1f278ca941eacb4fe4a20ce018a863bd54d450808b1ef8d8a870dfb2400a0a3c0aea9f0d0c0db2174b778741ad68e77ef9bdbb6689f797e9f7

Download Submit
/storage/emulated/0/gmwdaily/cdnlog/uploadmgr.db

Filesize
2KB

MD5
216661729a3c81e912cfe15446f2a28e

SHA1
bb858e5732520da826393f8908d19f43b19f280f

SHA256
e96221ea726c0689f527c3a522c89399d99abaceeebe02b8bf78793a629c6521

SHA512
ad28d06f21274221aa584c7cb9bb06bf022d14ec4d7da58a705e3d23665ad79b3d04774aaaa099f4aa917c0f42a1ffe2c609722f19858d4db663c1d58a7343e4

Download Submit
/storage/emulated/0/gmwdaily/cdnlog/uploadmgr.db-journal

Filesize
512B

MD5
a011d172aaeb30a19e4eebb0266a9e90

SHA1
9dbbc6006bba22881019cc6c19f1978e6e916f42

SHA256
b70ad4700fee35fc2825a285f6354af73de96b3ac36fc82b753613ec4e6a6e8e

SHA512
2d1b15780c8c92c193f69361b80b2a1198b6f58ecbc459187ac7a58c98dda46a8533e136059b2cf9debb4ce0c4b54949eebcd502d6473d477ce1606409fb366d

Download Submit