Analysis

  • max time kernel
    171s
  • max time network
    186s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240514-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
  • submitted
    22/05/2024, 01:01

General

  • Target
    6571ea09f63399fb19ea404bfd06216c_JaffaCakes118.apk
  • Size 16.1MB
  • Sample240522-bdjhssfe61
  • SHA256 0565962e1208fa1a103825906dd5d6655adb49402dc015de39baf247e8baa84c
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 11 IoCs
  • Requests cell location 2 TTPs 2 IoCs

    Uses Android APIs to to get current cell location.

  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

  • Checks known Qemu files. 1 TTPs 6 IoCs

    Checks for known Qemu files that exist on Android virtual device images.

  • Checks known Qemu pipes. 1 TTPs 4 IoCs

    Checks for known pipes used by the Android emulator to communicate with the host.

  • Checks memory information 2 TTPs 2 IoCs

    Checks memory information which indicate if the system is an emulator.

  • Loads dropped Dex/Jar 1 TTPs 6 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries information about running processes on the device 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

  • Checks if the internet connection is available 1 TTPs 2 IoCs
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
  • Reads information about phone network operator. 1 TTPs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

Processes

  • com.longshine.xindiantucar
    1⤵
    • Checks if the Android device is rooted.
    • Requests cell location
    • Checks CPU information
    • Checks known Qemu files.
    • Checks known Qemu pipes.
    • Checks memory information
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Queries information about the current Wi-Fi connection
    • Queries information about the current nearby Wi-Fi networks
    • Checks if the internet connection is available
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4526
  • com.longshine.xindiantucar:channel
    1⤵
    • Checks if the Android device is rooted.
    • Checks known Qemu files.
    • Checks known Qemu pipes.
    • Checks memory information
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Checks if the internet connection is available
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4712

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        classes.dex

        • Path /data/user/0/com.longshine.xindiantucar/.jiagu/classes.dex
        • Size 7.2MB
        • SHA256 ae7f68cf1a9894ae674da25344e79b0efc0fd183710f171918657baf101c9037
        • MD5 SHA1 SHA512 SSDEEP

        classes.dex!classes2.dex

        • Path /data/user/0/com.longshine.xindiantucar/.jiagu/classes.dex!classes2.dex
        • Size 7.2MB
        • SHA256 6832395a24eac7c6f111fc1b2f9946327434298b83e3c4730f5655190d52fb19
        • MD5 SHA1 SHA512 SSDEEP

        classes.dex!classes3.dex

        • Path /data/user/0/com.longshine.xindiantucar/.jiagu/classes.dex!classes3.dex
        • Size 4.0MB
        • SHA256 908026f8bd24197fcd946cbb66f00e28e78ff247f5653a6125b88e9e1f3fa844
        • MD5 SHA1 SHA512 SSDEEP

        libjiagu.so

        • Path /data/user/0/com.longshine.xindiantucar/.jiagu/libjiagu.so
        • Size 477KB
        • SHA256 1c38f2e98f1e8252c9651ed500a43faabaf075175b44a0ab35938426be9d3e8a
        • MD5 SHA1 SHA512 SSDEEP

        libjiagu_64.so

        • Path /data/user/0/com.longshine.xindiantucar/.jiagu/libjiagu_64.so
        • Size 513KB
        • SHA256 7e4562345d0031ea40381cc593356a5ed7bc003413b4958efdc5d1556cf20b7b
        • MD5 SHA1 SHA512 SSDEEP

        1004

        • Path /data/user/0/com.longshine.xindiantucar/app_crashrecord/1004
        • Size 235B
        • SHA256 00ae07e801f17d7d70e431ab82240aaa9815ebb737959e02e73ec788725ef428
        • MD5 SHA1 SHA512

        1004

        • Path /data/user/0/com.longshine.xindiantucar/app_crashrecord/1004
        • Size 58B
        • SHA256 988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
        • MD5 SHA1 SHA512

        tomb.zip

        • Path /data/user/0/com.longshine.xindiantucar/cache/tomb.zip
        • Size 637B
        • SHA256 700798938b8949c6dec111e668456442bbf9337344e76c53c63f9784bf5a84b8
        • MD5 SHA1 SHA512

        MessageStore.db

        • Path /data/user/0/com.longshine.xindiantucar/databases/MessageStore.db
        • Size 36KB
        • SHA256 05dd1623b6b7153fd1ed738e77fece7300ac3e38d649a9bb2a114be42885ad18
        • MD5 SHA1 SHA512 SSDEEP

        MessageStore.db-journal

        • Path /data/user/0/com.longshine.xindiantucar/databases/MessageStore.db-journal
        • Size 8KB
        • SHA256 2263effe307a69ae1151e41a10ee06791e6c22898f7d0e9f374a45b36591d1f2
        • MD5 SHA1 SHA512 SSDEEP

        MessageStore.db-journal

        • Path /data/user/0/com.longshine.xindiantucar/databases/MessageStore.db-journal
        • Size 8KB
        • SHA256 5659b044b1db5efee63d9292e920de00b9918d8b025143f7e7c26af7e77362f2
        • MD5 SHA1 SHA512 SSDEEP

        MessageStore.db-journal

        • Path /data/user/0/com.longshine.xindiantucar/databases/MessageStore.db-journal
        • Size 512B
        • SHA256 f40a85f9c851b9c672a827d3cf06ff11df1b34035e53be1d1a45d3cf5e3b020e
        • MD5 SHA1 SHA512

        MsgLogStore.db

        • Path /data/user/0/com.longshine.xindiantucar/databases/MsgLogStore.db
        • Size 56KB
        • SHA256 be62dba627fcfc45c713f640c355eaddc2f55a9ea7c7feeff3621beb2c924689
        • MD5 SHA1 SHA512 SSDEEP

        MsgLogStore.db-journal

        • Path /data/user/0/com.longshine.xindiantucar/databases/MsgLogStore.db-journal
        • Size 8KB
        • SHA256 c87bab48dd8624c29eecc48f5fd7ee273c20fd7d3877d3b7b4b7c7112a006ad5
        • MD5 SHA1 SHA512 SSDEEP

        MsgLogStore.db-journal

        • Path /data/user/0/com.longshine.xindiantucar/databases/MsgLogStore.db-journal
        • Size 8KB
        • SHA256 c34224a883533c69e2f8400f4a7ba5069543c92767e96774f1e35278b2b2e31c
        • MD5 SHA1 SHA512 SSDEEP

        MsgLogStore.db-journal

        • Path /data/user/0/com.longshine.xindiantucar/databases/MsgLogStore.db-journal
        • Size 10KB
        • SHA256 9cb866f7d504896b752275e31ce11f99c64d25b66b2b02fa977ff16164c172e9
        • MD5 SHA1 SHA512 SSDEEP

        accs.db

        • Path /data/user/0/com.longshine.xindiantucar/databases/accs.db
        • Size 20KB
        • SHA256 b4ef8a71919ac4b6ef9a895a991b527f5c3316fd6204eb815366c9614dc71f00
        • MD5 SHA1 SHA512 SSDEEP

        accs.db-journal

        • Path /data/user/0/com.longshine.xindiantucar/databases/accs.db-journal
        • Size 512B
        • SHA256 c27a090f8715a993829eee5b19fcbae031a884c71c53fc420cab984d39e4ab17
        • MD5 SHA1 SHA512

        accs.db-journal

        • Path /data/user/0/com.longshine.xindiantucar/databases/accs.db-journal
        • Size 8KB
        • SHA256 a71b7dac72a48378e5c14221c852c71159265ef6614bece553b7f5ed0f09bc60
        • MD5 SHA1 SHA512 SSDEEP

        accs.db-journal

        • Path /data/user/0/com.longshine.xindiantucar/databases/accs.db-journal
        • Size 8KB
        • SHA256 a443c29a6a0aca962bfe60df79cca4a934001b57bd0a32effd6c71765b2514a3
        • MD5 SHA1 SHA512 SSDEEP

        bugly_db_

        • Path /data/user/0/com.longshine.xindiantucar/databases/bugly_db_
        • Size 52KB
        • SHA256 678c21d422abd1ba90b6ad2f08d67af5cfda23381357b274e24ba2dd93416fbf
        • MD5 SHA1 SHA512 SSDEEP

        bugly_db_-journal

        • Path /data/user/0/com.longshine.xindiantucar/databases/bugly_db_-journal
        • Size 8KB
        • SHA256 496d344c6d5cee41d93d795519364d2bbd5d7adef40ad4c7b1507f4478bfb5ea
        • MD5 SHA1 SHA512 SSDEEP

        bugly_db_-journal

        • Path /data/user/0/com.longshine.xindiantucar/databases/bugly_db_-journal
        • Size 8KB
        • SHA256 9cd4c2cb9d8aac86a919923dff6e19a302a33b501ce15f6e74ed84234401915f
        • MD5 SHA1 SHA512 SSDEEP

        bugly_db_-journal

        • Path /data/user/0/com.longshine.xindiantucar/databases/bugly_db_-journal
        • Size 8KB
        • SHA256 dc3c0a5a59bc9b1242855fdd4c9af43b98ee2a80572e23e7379028049cc6f5a2
        • MD5 SHA1 SHA512 SSDEEP

        bugly_db_-journal

        • Path /data/user/0/com.longshine.xindiantucar/databases/bugly_db_-journal
        • Size 8KB
        • SHA256 d586981473af2595e3d57c1f3ed17dad338d246523ab2c7ed38235a4fc59a2e1
        • MD5 SHA1 SHA512 SSDEEP

        bugly_db_-journal

        • Path /data/user/0/com.longshine.xindiantucar/databases/bugly_db_-journal
        • Size 8KB
        • SHA256 e11f7d47f917b6977f1c1f63c85ec964bad2f2c53495d2e853a33f981a74bafc
        • MD5 SHA1 SHA512 SSDEEP

        bugly_db_-journal

        • Path /data/user/0/com.longshine.xindiantucar/databases/bugly_db_-journal
        • Size 8KB
        • SHA256 3252554b98bd1a1bb3337e5f804260706657937a0b2b62b431689d51ea99c8bc
        • MD5 SHA1 SHA512 SSDEEP

        bugly_db_-journal

        • Path /data/user/0/com.longshine.xindiantucar/databases/bugly_db_-journal
        • Size 8KB
        • SHA256 c27e6e6d76027a5feca05090359fb9352027a43a9796c4a0daa538eceb526280
        • MD5 SHA1 SHA512 SSDEEP

        hmdb

        • Path /data/user/0/com.longshine.xindiantucar/databases/hmdb
        • Size 12KB
        • SHA256 d2ab452d9360848f46af866b870b5c6fc98230b09c72b89cb1a4b2778586678e
        • MD5 SHA1 SHA512 SSDEEP

        hmdb-journal

        • Path /data/user/0/com.longshine.xindiantucar/databases/hmdb-journal
        • Size 512B
        • SHA256 083c95ed7ff592c27ac0f7b1d2a1a63a107e69d5756df7587b48bae55b3d0e36
        • MD5 SHA1 SHA512

        hmdb-journal

        • Path /data/user/0/com.longshine.xindiantucar/databases/hmdb-journal
        • Size 8KB
        • SHA256 b92695c8b619e80e483cc1ce958c011923825e6a22cb8bf12bd0cc7f926c2946
        • MD5 SHA1 SHA512 SSDEEP

        logdb.db

        • Path /data/user/0/com.longshine.xindiantucar/databases/logdb.db
        • Size 36KB
        • SHA256 1dd2d23b7c64bde28175205a16f99abac0aa5938d31812c095234defbd1f917b
        • MD5 SHA1 SHA512 SSDEEP

        logdb.db

        • Path /data/user/0/com.longshine.xindiantucar/databases/logdb.db
        • Size 20KB
        • SHA256 ad36f77c8bacb01100109eed202bf983731bae290edb2db9fe8129819cacb61f
        • MD5 SHA1 SHA512 SSDEEP

        logdb.db-journal

        • Path /data/user/0/com.longshine.xindiantucar/databases/logdb.db-journal
        • Size 512B
        • SHA256 47c8e135d90a1a05a95bf1d4057a099801cfd9c3c6025d43efd77e6ebfa3e551
        • MD5 SHA1 SHA512

        logdb.db-journal

        • Path /data/user/0/com.longshine.xindiantucar/databases/logdb.db-journal
        • Size 8KB
        • SHA256 33700d3601c07ad3b08288786181d8611833ad5a968fc1a4af79a4622c424d26
        • MD5 SHA1 SHA512 SSDEEP

        logdb.db-journal

        • Path /data/user/0/com.longshine.xindiantucar/databases/logdb.db-journal
        • Size 8KB
        • SHA256 392e8f918e54b75a83bfef99c3aec7c67b66a6dec8a548ac860a539c211b25e7
        • MD5 SHA1 SHA512 SSDEEP

        logdb.db-journal

        • Path /data/user/0/com.longshine.xindiantucar/databases/logdb.db-journal
        • Size 12KB
        • SHA256 69ddc615016cb1bb10ba18ee4c179fa737400f811e14dc499f811f2deb37393d
        • MD5 SHA1 SHA512 SSDEEP

        .jg.ac

        • Path /data/user/0/com.longshine.xindiantucar/files/.jglogs/.jg.ac
        • Size 8KB
        • SHA256 89f6c07b38690c9f3e0a35e37edd8202986163b63c97adb8a4e779690d5b37c1
        • MD5 SHA1 SHA512 SSDEEP

        .jg.ic

        • Path /data/user/0/com.longshine.xindiantucar/files/.jglogs/.jg.ic
        • Size 12KB
        • SHA256 aebea9c782de2fa07733a84d50068d1359fb418ac0822b37f404e3c3c1482410
        • MD5 SHA1 SHA512 SSDEEP

        .jg.pk

        • Path /data/user/0/com.longshine.xindiantucar/files/.jglogs/.jg.pk
        • Size 36KB
        • SHA256 f2434b69ad5ddbdeb3796b9e34fa428cf6fc31bf987dee42c12816e3632a128b
        • MD5 SHA1 SHA512 SSDEEP

        .jg.pk.h

        • Path /data/user/0/com.longshine.xindiantucar/files/.jglogs/.jg.pk.h
        • Size 213B
        • SHA256 fbe6c7bcb7096698ba836652f78805955f6d959432ddf753b3064afe81cb74bc
        • MD5 SHA1 SHA512

        .jg.rd

        • Path /data/user/0/com.longshine.xindiantucar/files/.jglogs/.jg.rd
        • Size 8KB
        • SHA256 71ac352a597844e1d463f1b882cb08782bad549b26aab94f6d65d2a4d933bfcf
        • MD5 SHA1 SHA512 SSDEEP

        .jg.ri

        • Path /data/user/0/com.longshine.xindiantucar/files/.jglogs/.jg.ri
        • Size 92KB
        • SHA256 3e0bdb9ffb256a38368659fc01f7b68e1a2bd03cca5f0b1317f37220b4c5ac96
        • MD5 SHA1 SHA512 SSDEEP

        .jg.ri

        • Path /data/user/0/com.longshine.xindiantucar/files/.jglogs/.jg.ri
        • Size 314B
        • SHA256 0ef3ce3832b4cfd74cfb73be3cd2523fdbd0c0f9e1797d635760025f3c72ba08
        • MD5 SHA1 SHA512

        .jg.store.report_pid

        • Path /data/user/0/com.longshine.xindiantucar/files/.jglogs/.jg.store.report_pid
        • Size 54B
        • SHA256 e7d479f6dcd25ea592c3b0761207b15b0b10d94a674b413f6b930b3807909155
        • MD5 SHA1 SHA512

        .jg.store.report_pid

        • Path /data/user/0/com.longshine.xindiantucar/files/.jglogs/.jg.store.report_pid
        • Size 32B
        • SHA256 e022d3adf80c7aeb04c6386c0d670cfc1bc202f744275eb22eac9c0bf506e8cf
        • MD5 SHA1 SHA512

        .jiagu.lock

        • Path /data/user/0/com.longshine.xindiantucar/files/.jiagu.lock
        • Size 27B
        • SHA256 b876bdddc25c89ae90ba6820df4220baab4bef8800f7158b2a55618d7ef3b2fa
        • MD5 SHA1 SHA512

        4c984fe24161907e5b5b9423ecec3163.0.tmp

        • Path /data/user/0/com.longshine.xindiantucar/files/a/b/4c984fe24161907e5b5b9423ecec3163.0.tmp
        • Size 547B
        • SHA256 8760ba3fffaad4065d4b01d46927454861f64f4b9b8c3870a0942d54005d6d4b
        • MD5 SHA1 SHA512

        5ad6cdbb45b4a14283563bba26a5e0b7.0.tmp

        • Path /data/user/0/com.longshine.xindiantucar/files/a/b/5ad6cdbb45b4a14283563bba26a5e0b7.0.tmp
        • Size 547B
        • SHA256 403e352565a28eb169bf1efc75641e35c6a1fe7f413aa926c4fdbd9b1e25e19c
        • MD5 SHA1 SHA512

        journal

        • Path /data/user/0/com.longshine.xindiantucar/files/a/b/journal
        • Size 113B
        • SHA256 768bb5055e609f1dc8f2c10b27bbe265eb707d8585b80858253c261ef2682fac
        • MD5 SHA1 SHA512

        journal

        • Path /data/user/0/com.longshine.xindiantucar/files/a/b/journal
        • Size 195B
        • SHA256 df62894c08968ff667d8dceab87d74d6275595c04ec78c2e989c082effdd475c
        • MD5 SHA1 SHA512

        journal.tmp

        • Path /data/user/0/com.longshine.xindiantucar/files/a/b/journal.tmp
        • Size 31B
        • SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
        • MD5 SHA1 SHA512

        k.store

        • Path /data/user/0/com.longshine.xindiantucar/files/a/k.store
        • Size 32B
        • SHA256 cb6bc4ad063ffc910dc850636a9a71a5da4070018d17b280105ae78c7a226a45
        • MD5 SHA1 SHA512

        dW1weF9pbnRlcm5hbF8xNzE2MzM5NzI1MDkz

        • Path /data/user/0/com.longshine.xindiantucar/files/stateless/dW1weF9pbnRlcm5hbA== /dW1weF9pbnRlcm5hbF8xNzE2MzM5NzI1MDkz
        • Size 1KB
        • SHA256 d6eddee6f00ebde06a77a2acc859bf12cba1dc22e6a5dc75dda80fc297900b60
        • MD5 SHA1 SHA512

        umeng_it.cache

        • Path /data/user/0/com.longshine.xindiantucar/files/umeng_it.cache
        • Size 433B
        • SHA256 f7e8238d7f180307d1587c86655a4f6b9f314b220495e79eb3961485e702180d
        • MD5 SHA1 SHA512

        ContextData.xml

        • Path /storage/emulated/0/.DataStorage/ContextData.xml
        • Size 111B
        • SHA256 fa94c72382438c74490befa06ab812bc592d4544a0717a9de1f04e6c828c4e4e
        • MD5 SHA1 SHA512

        Alvin2.xml

        • Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
        • Size 65B
        • SHA256 3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793
        • MD5 SHA1 SHA512

        Alvin2.xml

        • Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
        • Size 111B
        • SHA256 8aa2829c67549897c13b0398d5006a83490db5115e19e4373d636035e4ca2a24
        • MD5 SHA1 SHA512

        Alvin2.xml

        • Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
        • Size 167B
        • SHA256 8c155fdb0317c1e2829a707f942f6b01a806ae6386d20c053c8c24d7674377cb
        • MD5 SHA1 SHA512

        alsn20170807.db

        • Path /storage/emulated/0/amap/openamaplocationsdk/alsn20170807.db
        • Size 20KB
        • SHA256 8f341157c090835d6bf14a770bb188eb3e05cfc4ed1bb13ba90d2bbbe8d331dc
        • MD5 SHA1 SHA512 SSDEEP

        alsn20170807.db-journal

        • Path /storage/emulated/0/amap/openamaplocationsdk/alsn20170807.db-journal
        • Size 512B
        • SHA256 50835112af3d127e5a42f34e841635c37191543f68fe76e450139de77003f92d
        • MD5 SHA1 SHA512

        alsn20170807.db-journal

        • Path /storage/emulated/0/amap/openamaplocationsdk/alsn20170807.db-journal
        • Size 8KB
        • SHA256 21d2d62949e3f38d6e89efbc8659cc3ac924e7760f3527641fb48e160230c63d
        • MD5 SHA1 SHA512 SSDEEP

        alsn20170807.db-journal

        • Path /storage/emulated/0/amap/openamaplocationsdk/alsn20170807.db-journal
        • Size 8KB
        • SHA256 a966b0e57eb28b27a92b32684b7de009c38569ed61fae57e9639c075e394c657
        • MD5 SHA1 SHA512 SSDEEP