Analysis
-
max time kernel
171s -
max time network
186s -
platform
android_x64 -
resource
android-x64-20240514-en -
resource tags
-
submitted
22-05-2024 01:10
General
-
Target
65788ec9c2255139f7b64d9e8630b6c8_JaffaCakes118.apk
-
Size
12.8MB
-
MD5
65788ec9c2255139f7b64d9e8630b6c8
-
SHA1
d98b00cc1c9723b625fa76ef67ef65aa41bc1027
-
SHA256
6f38da6bb5b0a7b0ef8996aa69f865dd49b7fc21d9e6f9b3c229ad088765fd1a
-
SHA512
2f2eea8ff1dbe7cb178e5ba6716808ae16fa7444faf276f3c0484027864b11609b739d7897ab7791712896bda52dbaf7ac17b1499b13f21f2e2bfda54c21d864
-
SSDEEP
196608:PDobuDTeop/7k0T5YfCUXmTajZ/a5tesngSR+AnEAPFx9BAQ8MbJOSKdoYRE8Rt:PDYuDT5p/w0T5Yxjcv9QUEuPZdK95Rt
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 1 IoCs
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
-
Checks memory information 2 TTPs 3 IoCs
Checks memory information which indicate if the system is an emulator.
-
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries account information for other applications stored on the device 1 TTPs 2 IoCs
Application may abuse the framework's APIs to collect account information stored on the device.
-
Queries information about running processes on the device 1 TTPs 5 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 5 IoCs
-
Acquires the wake lock 3 IoCs
-
Checks if the internet connection is available 1 TTPs 4 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 3 IoCs
Processes
-
com.gau.go.launcherex.gowidget.weatherwidget1⤵
- Checks if the Android device is rooted.
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
- Listens for changes in the sensor environment (might be used to detect emulation)
- Uses Crypto APIs (Might try to encrypt user data)
-
com.gau.go.launcherex.gowidget.weatherwidget:pushservice1⤵
- Checks memory information
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
-
com.gau.go.launcherex.gowidget.weatherwidget:com.jiubang.commerce.service.IntelligentPreloadService1⤵
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
-
com.gau.go.launcherex.gowidget.weatherwidget:AppWidgetService1⤵
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
-
com.gau.go.launcherex.gowidget.weatherwidget:pushservice1⤵
- Checks memory information
- Queries account information for other applications stored on the device
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Hide Artifacts
1User Evasion
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD5e8e0527a01aefdb89afd2c508f131da1
SHA1f1103e6b260c657ceb3d95f1b023af3fda8b133a
SHA256f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce
SHA512fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34
-
Filesize
20KB
MD5552902ad0a8ba78aa6b93ddde3c1cc94
SHA1d4276128e30e171a4f8d0ca680cc59f1c38a7e8a
SHA2562d6ed23862eefaea98274ac2bb5f52c4bf9fef0663707d2fddcf34d2d3c4bc10
SHA5122dd20518a9342d8d812fb185cb67561e5305a0c345a075c79906109438629c875a94b7742b2f0f634777186d7d8e44659c475a268302170c404f6ad2bd2cca4d
-
Filesize
512B
MD5917b4374d1d8049198ea2bd0a48c4b00
SHA1eebae49980923359dcaaf3a5b6eaa600a3242ad2
SHA2562ee860b0d2fd3fb8dcc94220327615881717593fe2c79ed07ed9f052161bd98d
SHA51286c8ede7de948b54ee6effde84260e3fd3ce5b4ed9248b4efe09ecf5cf763951164223de19cf2453d0aefd1d47e86fdd62be079917cc9493369d974e0fe3263d
-
Filesize
8KB
MD502b49cc58d91c657dcd86e140d644a36
SHA1ab4220aee5ac255e4aac409d9b1b1424a888cc92
SHA256d23aebeaf0c23d5597a4e23f3b5e06b29abeefea0bdf2eafe8d950cb9017e9d5
SHA51272c0a3096e9ca6eae5d71cbe4c42b1293bcc43fd81df66a722aeecaca0a1fe32858007aa3e99d1a2f893118dbb0c7a0feddaa2a3df912c02e3e6127a7a751914
-
Filesize
8KB
MD5898983cd42cf08a3c1d2dfab40b519a6
SHA18bd3dea905d3946c268c9af1466968b191f7c049
SHA2561baafcc4a86ad2f1361d1ed28517b4b07d0f6b2d745150b2b02a0c5ef1467b4e
SHA512ac7f78318dc129eabcbbb06d2ab250f3cf84f04bcf69bcbe0df4218bc85dacd00a93b06e254fcdec73db2e0f18b7b9705f37c1c4aacd55ddb73c202843387c84
-
Filesize
160KB
MD5c995c51aa3366b6414694f9cab0b87dd
SHA12b2a3a785eba90d801e09cd8301a5cefe01881b3
SHA256099fb77a003de007f514a63d447bc108f69b7f03b2056c6163ea1c0e0d6c934b
SHA5129c4948ef4c0fe8ca2ed79f3f4894de049bbd37bb095af01297f52200cad1a81b6f9bcd3052f784b3b0698c0b9565886eabb06a642aa3d3f4b7c3b42dfb296935
-
Filesize
512B
MD56072a21215d3104c55bc23351c4b17b2
SHA17f78dfd19c13f749fc2ab6ae01d11ac6fec47671
SHA256236e6b454d3fbe2b832c997cdadeef8344c1d299aabb4efaea9292842d6b87ba
SHA512f3b3398e82f2624d8ffe034d0d56bfba91d3a755f0bd7fb90a9c36a2d4df4f8bf3e7751fba3499e02ca62fd6eaabdfe20986c2a1b23ba18bc60b3000c73f2e8f
-
Filesize
36KB
MD518524495f7d31cef3b3f245e1a198605
SHA1143b852764dc266a04fc72fa4bdc9a8448ef3ca1
SHA256189121b26a2a2080d3af2e8bec6857dba98cd8704746f568e0e1566aa83a65de
SHA512e681927072523b014aa2299e96989f5ccf19a0215774c4c17e6f3dccdade7efa8abd32951dc011696513259eba7eaacd011a8e4076333c8149069e1db78725e7
-
Filesize
16KB
MD51ca0e53f59d4928378136d92e8534d42
SHA11e542fc6b51c08b5a6612e4dcd2548bb897a05c9
SHA256ac7f29ce55dbc711dd0467373867648604edb0a509413cf867ac9a84b1870ef1
SHA5128d619aba8bd71b005cabaeaa9cfb3dccba77dc43776d45a9ba8d995f40fd7578c1c3c4f0edab5e94a569b25cfb620a64c0de63f4be7e5f1138d081d17002e277
-
Filesize
8KB
MD59e6accf68d6b49d857c2e17d57db04ed
SHA18aa1346c068c7ca83d4be6885f2b9a8da66638d1
SHA25665d1cb12e9e0aa93f11d9dc487d02d1f2646c7ae2255551e305889992f43abdd
SHA51251debd54f92bf0ad57d21c59df2854fa212434e73ed25be4094f01d328f70b3b4ba85a17eac794af7786760109f2fdef503a10d55ef6779a03b3481a6305583f
-
Filesize
248B
MD54f3be28694f80b7e458cf6d56983b9a8
SHA116757811c8de9a7c8123f0daf97d87133b69b774
SHA256c2bfa5c31d0e40426aa6fd1a38b25ffe0a52648a6baead7dc5cb84ae9ba9ae72
SHA5127acfb5c273901bc5a7d750337093580a604aacd016561a43dae731cc60c8350290041f970647a01d10d9cbe1ea796dd108e86f1d6af9ff18d51e2b81f620443d
-
Filesize
248B
MD5bc7fdf6d0a6289a741a5bd225c185d25
SHA176ea06bfa665e336601959e015b8300c2ba90dba
SHA25610874919ae6581707bdd2913d6686d00834d0c570676046137d6009cbcd83fc1
SHA512dbb40d06ab5e8287ee7fd7ed497ab5629e985d8e73ab22f1af6790cc7421c53bdaaa535a61aba1fed26cefeca2adaf6ece8c4a42dc6ed771799d1258fb8040fa
-
Filesize
248B
MD5d5a28014eb94fd77269f95afb2d07e03
SHA1cc44891dd56162fe3c823b3f3df5cf5ab0e9fb05
SHA2569015b5fabfdd1203efa94a7e8d70cdcd56830317d976491549ebc8c289891452
SHA512fc5fdc459ebb87504002ed8c1e83b4a38f7d46a677c6ea27a0b341238a92f87aa675789f6bad67fd7a88767ac7a224739ae8421ef978be5a2a283c71c1930746
-
Filesize
248B
MD512fad445b4a7f708dc8137f956439719
SHA1ea47939abbf6f40a153c4eb6e21b148097824df5
SHA256c63210b90fc38248178da7f2076c64cb035c320e379cb6fba36898930e85a001
SHA512ea13ef53c9558d789348e7800d7655e04c7937301f6e0d08d9211e3f94f67992c9f46d63b8723f34d0dcfbfe9cddfcf9f6a98534f916ad9ac8660cc4c8ed6003
-
Filesize
248B
MD58916838222cd865e4554047a34538d67
SHA138f31e0c4401f1913224f0516756517c06719847
SHA256e269e6fa6d064f33e311f6c1e3746974d0ca738232c5b01911806663872e42fc
SHA5126b257f5e93d3911da42df77964d5f70ec62d585bcf3aef8a6411de38a5fb14d0468e96bbc63a10948e7f5bed053785bee4e976d69033a8df61c2f9003f71e38b
-
Filesize
248B
MD5c7079a0e9d1d90b51727a3812c934cd9
SHA1e2346c0f7a3279d84ba783fa4bd11afc926098f2
SHA2560925fd01ad031c7889adfd10f1f08fdcb19d1c9cbf6a47457af22475838cdbba
SHA512feef905b9c7889cc987bc5861beb435995b7b6be315894e3cc5a853f30041d7eff945836e620b4c017bc9563ac4c0fb57f3da348ba8549a8e89642c15890bd7a
-
Filesize
248B
MD5609127e703ad3ab644fc01f6d43ee028
SHA1c72c66223bae485fd1c915cc3e1fec78e90499ce
SHA256ce6616323b0b7aedd45240a9b5a370ebe7275799d90c5e92df89709ccf638209
SHA5122763ff3557dd4960b5ec93be0883c73881bb8bbcb27e8146a03c6f288bee44503e50873f8f1e163e4dd99f050683eeaa47a5c14ab786a1ff0ec7c9cf9a90e801
-
Filesize
168KB
MD5d66d43ef6b3628f10f7d29c73ff3e117
SHA15e031b518f8f0fe5bf246ea1a41be3a635238eef
SHA256f3b763b4cdf00713023488fc10643a78434f589d9545682974dccfcd3054d1f7
SHA512e45259fcdae6c9fc2e26c5aa9b7e139901459452c0d65ff05b833a6893ff465631de5c8acc09698ef0129f0181dfb575727d9383b84d1338d662830cbd00ce22
-
Filesize
2KB
MD5577254836b09b4d30b5a5d5ad5729136
SHA131f309f0e41a9ee24b31e0b6032017268b6cc138
SHA25688382f5b8695c50f5921efc635f17649c5af51d478ad1d76cf7a5a5429772490
SHA512acea628223aa9ed625796e365f62dbd010e3221cff66b1a683a204212347e267ccbdc390c372ddd7048cae0391dce8135117dad2841d365301be8542eb27bea3
-
Filesize
5KB
MD5392b6c35e2bd2b01ebb1b5e1b0a1053f
SHA198eff5dd1db8b1df5399ed38afcc2f9793d936d5
SHA256066996b3b05ecb09f45e161a06c3369b9023e296aa330dd5a18ab2d6596a0d27
SHA51244e54171ddcbea9af2c74c8d91ad34d42b2a36d8a2a3c6675e9815c00490125d16c09a18c758186c353145f390f2250292ce8890b9043b39ac12bf3150a0ac34
-
Filesize
7KB
MD55f0b1c13b16c714b4f6f341c7773ef5f
SHA1489ccb13fad341738cead84c8d51f41b2d240be5
SHA25621d82ceba2be1e3279a1911378a007e8d64ca99e2e9dee2f77888c172c1a1bef
SHA512d28e827fd1dfad4358172b531cd450f53496db1af9f149fc15317df5347c856a5e26a72b1797a4fea794d6d54b5b99d48f47ef605edac34e14731789f6ae880a
-
Filesize
16B
MD5c69102c46a37607e02a66dff4bc2e1b8
SHA1bb3d3a48c5e56ea79efbeb9dd444e650d21cf9fc
SHA256ef51ac41a8dd7151d614025f2979bd919e590b066594eb927fdf9b2550150ffc
SHA5127b50a0c9a8fb7d015efbfae29ceddb4bd81cbc205a7d6d73e3f1231e7e368447f8008e5cab7bc909ca50d726d9d413b240a98fc61d30cb0a8b563928f07dcbbf
-
Filesize
124B
MD53a392f5a2cca7af302bc64fddfacb373
SHA132f960987614fc1d826fd7d884f87d65b0c2c60e
SHA25640742e626b0e49564a65780f90a337c8ded4fba4f3184c36ed3cebdb15c780a8
SHA5123a3871471e7d0b8fabad7dd742caea974af95ceca17845352ae0908844ed61befcce65f865edeed2f61bf4e92628bd9b657ddee1d0a1cbe960c6ec547a939059
-
Filesize
124B
MD59e9c5a16c655223ab3ea0eb0a72b7f44
SHA1383e966bcf85b664009f6d279910680eaff74434
SHA256613bc23878637b32a8b746f9f0d6c5b52b8e2c921139d127f612859db0a6ecc6
SHA5120da571db09f7960d5f2c095fa803bc8cc8f3bdf4276d91c2d8080dfc8ef88eb517c52d6b1a74acb98a6dcb1dbff955194b406d7223f0b7b98e263e505cc4a579
-
Filesize
124B
MD547ff2d5ac75cbafd994af71cb62e9a4d
SHA10cc755103f002e51d060208db9d50898436489a5
SHA256c7e30496a8a4d5f481c8ff374ea643bf74d228d205d4d0f236b88c81262034ad
SHA5128a7be0c20745444aa4aef0395626e3eb3249f2d89b1c69720eb44db2d8cbe42a33a3a861c18d7844f304ba9c1e084dc0f3f9316cf4449f9bca69e5b79e92b469
-
Filesize
20KB
MD5fde2ee00cbd121cfab5290b078aa3ceb
SHA1e2b77d5320e155e413d040a8c20020962065b2f8
SHA2562897b0812077c654a9b3fbb0b6303d5cde681eeba7ad9981de65716c7810d685
SHA512a9326aff8e454a2b4ac09984ef2a65fddd4dc146b4c44d839035549bff8c9fdaae490326d0b018f76c1ca2e4fb25426d74f550ca0950982fba632a023af99a56
-
Filesize
29B
MD5bbfe1c7b1cb0f8fc80a79164fdc691a3
SHA173e4e533d830a0b84dbe7782339a0a18566c1c46
SHA256f99c59a35a124fdbbb8941b81ff8c40111df178eb1592d39d73d787b12995696
SHA512ec4737bf7b534378292f82fe3bff6b0ba56c0563983584d52adf598a862c0094fb4cd471ac2172fa90d4dc54a69b1d9b63081095a74cf584a37fb371b27f4634
-
Filesize
43B
MD588ac528a7101f972d226a9ac3c376c13
SHA16b553c0426e52b9afe97f4d7ddd05c5e9cc4ee9d
SHA2560756197b35085622a95b65f505a49db58e3c0e458b0e4d496d11961bb9d6b30c
SHA512318dc63994943292e0bb36beb365d02844c5388f849987e0cbf942b1b3e5811b8949ae5db687c3ab922bd9f368bbf4e3aeaab19de7951e41e7a4de792b580d96