Analysis
-
max time kernel
179s -
max time network
186s -
platform
android_x86 -
resource
android-x86-arm-20240514-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system -
submitted
22-05-2024 09:14
Static task
static1
Behavioral task
behavioral1
Sample
66c297922e1a5179b99bf81b1bd9d492_JaffaCakes118.apk
Resource
android-x86-arm-20240514-en
General
-
Target
66c297922e1a5179b99bf81b1bd9d492_JaffaCakes118.apk
-
Size
28.6MB
-
MD5
66c297922e1a5179b99bf81b1bd9d492
-
SHA1
651d39d9e12b009dbdc000889325c979d0c4b9e7
-
SHA256
c3b38aa9cfa03ca08c7a094e6d59686b57da674437536ab2ae05e7322792f374
-
SHA512
7cbd3fb1df12e72f237997b5e339c5e01d1264cce5ae3b5a6984c2c9c43e3f249e12fb5f176495ab82e9348d13b1e8994d23ad0ea6a0fbf2475cfe3a60c07e46
-
SSDEEP
786432:cerK5FNwrhcZIMu28D6q4AQfWPFWrG0/zVu4erRFIFx:7rKwl/Mu28D61AQfWArG0/zzx
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 2 IoCs
Processes:
/system/bin/sh -c type sucom.zhishang.fightgeekioc process /sbin/su /system/bin/sh -c type su /system/app/Superuser.apk com.zhishang.fightgeek -
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
Processes:
com.zhishang.fightgeekdescription ioc process File opened for read /proc/cpuinfo com.zhishang.fightgeek -
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
Processes:
com.zhishang.fightgeekdescription ioc process File opened for read /proc/meminfo com.zhishang.fightgeek -
Loads dropped Dex/Jar 1 TTPs 5 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.zhishang.fightgeek/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.zhishang.fightgeek/mix.dex --output-vdex-fd=50 --oat-fd=51 --oat-location=/data/data/com.zhishang.fightgeek/oat/x86/mix.odex --compiler-filter=quicken --class-loader-context=&ioc pid process /data/data/com.zhishang.fightgeek/mix.dex 4277 com.zhishang.fightgeek /data/data/com.zhishang.fightgeek/mix.dex 4380 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.zhishang.fightgeek/mix.dex --output-vdex-fd=50 --oat-fd=51 --oat-location=/data/data/com.zhishang.fightgeek/oat/x86/mix.odex --compiler-filter=quicken --class-loader-context=& /data/data/com.zhishang.fightgeek/mix.dex 4277 com.zhishang.fightgeek /data/data/com.zhishang.fightgeek/mix.dex 4277 com.zhishang.fightgeek /data/data/com.zhishang.fightgeek/mix.dex 4277 com.zhishang.fightgeek -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
Processes:
com.zhishang.fightgeekdescription ioc process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.zhishang.fightgeek -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
com.zhishang.fightgeekdescription ioc process Framework service call android.app.IActivityManager.registerReceiver com.zhishang.fightgeek -
Checks if the internet connection is available 1 TTPs 1 IoCs
Processes:
com.zhishang.fightgeekdescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.zhishang.fightgeek -
Reads information about phone network operator. 1 TTPs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes:
com.zhishang.fightgeekdescription ioc process Framework API call javax.crypto.Cipher.doFinal com.zhishang.fightgeek
Processes
-
com.zhishang.fightgeek1⤵
- Checks if the Android device is rooted.
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4277 -
/system/bin/sh -c getprop ro.board.platform2⤵PID:4306
-
sh -c getprop ro.yunos.version2⤵PID:4330
-
getprop ro.board.platform2⤵PID:4306
-
getprop ro.yunos.version2⤵PID:4330
-
/system/bin/sh -c type su2⤵
- Checks if the Android device is rooted.
PID:4361 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.zhishang.fightgeek/mix.dex --output-vdex-fd=50 --oat-fd=51 --oat-location=/data/data/com.zhishang.fightgeek/oat/x86/mix.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4380 -
logcat -d -v threadtime2⤵PID:4483
-
/system/bin/sh -c getprop ro.miui.ui.version.name2⤵PID:4508
-
getprop ro.miui.ui.version.name2⤵PID:4508
-
/system/bin/sh -c getprop ro.build.version.emui2⤵PID:4540
-
getprop ro.build.version.emui2⤵PID:4540
-
/system/bin/sh -c getprop ro.lenovo.series2⤵PID:4568
-
getprop ro.lenovo.series2⤵PID:4568
-
/system/bin/sh -c getprop ro.build.nubia.rom.name2⤵PID:4592
-
getprop ro.build.nubia.rom.name2⤵PID:4592
-
/system/bin/sh -c getprop ro.meizu.product.model2⤵PID:4616
-
getprop ro.meizu.product.model2⤵PID:4616
-
/system/bin/sh -c getprop ro.build.version.opporom2⤵PID:4643
-
getprop ro.build.version.opporom2⤵PID:4643
-
/system/bin/sh -c getprop ro.vivo.os.build.display.id2⤵PID:4667
-
getprop ro.vivo.os.build.display.id2⤵PID:4667
-
/system/bin/sh -c getprop ro.aa.romver2⤵PID:4691
-
getprop ro.aa.romver2⤵PID:4691
-
/system/bin/sh -c getprop ro.lewa.version2⤵PID:4718
-
getprop ro.lewa.version2⤵PID:4718
-
/system/bin/sh -c getprop ro.gn.gnromvernumber2⤵PID:4743
-
getprop ro.gn.gnromvernumber2⤵PID:4743
-
/system/bin/sh -c getprop ro.build.tyd.kbstyle_version2⤵PID:4770
-
getprop ro.build.tyd.kbstyle_version2⤵PID:4770
-
/system/bin/sh -c getprop ro.build.fingerprint2⤵PID:4794
-
getprop ro.build.fingerprint2⤵PID:4794
-
/system/bin/sh -c getprop ro.build.rom.id2⤵PID:4818
-
getprop ro.build.rom.id2⤵PID:4818
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.zhishang.fightgeek/databases/bugly_db_leguFilesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
/data/data/com.zhishang.fightgeek/databases/bugly_db_legu-journalFilesize
512B
MD59cd5ff196ada755b285e1a0769aaf4a6
SHA1e067f29e2897cf4e5be72003f608d387473c0ac7
SHA256387787699f60d9a3c5e23fadfac92d7f7dfb5318cdd27c604f6ce36a20d41d6a
SHA5123e417ea52d83989980d323a109a6498c69bab98f38147e688ad85b5e35b5652e5a042d0c8e35f53116ee6c90165569e4155c0639e43e9ed2f33697e377487019
-
/data/data/com.zhishang.fightgeek/databases/bugly_db_legu-shmFilesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
/data/data/com.zhishang.fightgeek/databases/bugly_db_legu-walFilesize
185KB
MD5ce55146e13e09cbc618656ca55c83730
SHA1ef0f1438c5e856f8453539af2ab91bd9b9b7227a
SHA25645aa2a4bb4d5b25c2900e3d632be716a132143b3aab002c0ea7739b0583c2cdd
SHA512dfe25088ae5b43c5ecd5299228614e9bf7e1072c4109b77867c872a9be4a46860bc343384cb0995ba68f6430950bac3fb92c4fc70a2364b41f36ce3495f4b0be
-
/data/data/com.zhishang.fightgeek/databases/cache.db-journalFilesize
512B
MD54e20585bfe171a784b54d594c06a4a24
SHA120eb313535d2e5887ac6f4bc4850dc1954f45a70
SHA2563af1eed2c6042418f97b8e2e9a9de61e70221ce4054ce9973e78908597e391dd
SHA51272c74ecabd90e521f1163e4df8d981eaf91e173b33869340ca99d9e5e5cc141431233a2efc079157e31d6c8732c82a83a8d9cfda041a51bc244641c2d6aac68d
-
/data/data/com.zhishang.fightgeek/databases/cache.db-walFilesize
32KB
MD554803d718c555f19e87a2b314a828208
SHA19b820cc639ae452929e40e8b113ef812c246b221
SHA256a6e69375cd5530b00b371d0654b58ba81a88c75db31827d62891e864c1391cba
SHA51276a091c72f3e1771c5513e8c66d950cc78ae265047fca24e2918fec22f6ffebc65cb3fa1a249a802fdf66eb3c9727bcef7533358fee06f5db6dd0df4bdbd344a
-
/data/data/com.zhishang.fightgeek/databases/cc/cc.dbFilesize
36KB
MD55d7ea1a23af19b4340cc8d90f28297d5
SHA14cfe95b23a9e98378d69c4290af81b51fbe76aea
SHA256474c4a54534ed96beacad7cc9a805a3f53ec9c0522fc7bcc59771cf500a6a0da
SHA51233071f4c92da0a3df01c4a61dd165df7c7e0f4f37753cafe02d19fc876a5e7fcbb01c069c804e140ab8bfa0644a55f50fd1373646d1c439f817baa5ffbd47f7b
-
/data/data/com.zhishang.fightgeek/databases/cc/cc.dbFilesize
36KB
MD5ce6135aa1b1fe4f2c2db2a546d2a5558
SHA179b59582154017aadab783dc266fcb158c252940
SHA2567b45f576c08c7f78220168cca4a0e33198b13e9bdc8b1da406ddb6887412000c
SHA5122839075fe374c8567c839ae35ce2d33ec72fdaebf170aa7d224b555e5b0e74d4a43f2f67d17ed806dae841da883e9620d788ea052d06152678afa927307c7ce4
-
/data/data/com.zhishang.fightgeek/databases/cc/cc.db-journalFilesize
512B
MD5ca4008af77b634faf3d5738f97cf17aa
SHA1de0ddb93e4c0bae5be0393e391619328e1b73145
SHA25644c0cb0a4acffe94be66d64051bd194ce829dcdb50ea74237ad05643e81e5e12
SHA512f03859ecb3afa75cd72caa88b06f15d592eebb70a35534b8254a78c4c437262480dd7891d27dc856bc32f22c40950386352bd9f4d33b5f4eb0dd73b5f9281f74
-
/data/data/com.zhishang.fightgeek/databases/cc/cc.db-walFilesize
48KB
MD51a83ead06e838808aff0f81d3d2d9cba
SHA136317a4f423abc2a460f47766a15fc050a6119fd
SHA256b60cef3669a269b06d564c6eb54798b5face2c72de0f8c8ab9e126658e461a8c
SHA512b731205641b97372808e221d71d26d5f5780070f6f1d31430d75454358fd6df5838f02322dfeaa4cb7adb7c1a64b733d6a55b43433f4b5ef8f7b6ccc4a2a43c5
-
/data/data/com.zhishang.fightgeek/databases/cc/cc.db-walFilesize
16KB
MD52d7b786ed4174d32e4d6ab4475099707
SHA155b51a6dfb76a6e048d0bbc547381ffe6ecee31b
SHA2566e3b77f821597c57460a322642c21e96138212fd033967a91973aad74cedfac3
SHA512d79505d1a8c846a32f4dc80455c93da1161d2893567a06418bb6cb4a9c282a854389c7b6b20f2e6269dc43cd75692652ed65d51b1c9eba0d750d6ceeba0fe06f
-
/data/data/com.zhishang.fightgeek/databases/record.dbFilesize
24KB
MD55f84623f5d1d193d210b632e1bdbd4e2
SHA171d2e79f695a68f9668aee61031cfcf139e3342f
SHA256efc329809aa24d36b27e1e12ab844f1b8ed78ef02208dc3e9c0807f15dbc7050
SHA512d005d62d55ec2f4d696582bb7301aadba1392ffd292b63ad20f4307e63286208e3b279b53e25d5448be3cac3721b4ae3cd5f7bab36bc70a9f018341b8494a7ba
-
/data/data/com.zhishang.fightgeek/databases/record.db-journalFilesize
512B
MD567676a4f5f8b30b17cae38221aa1899c
SHA1eb10b49c3f607b9e0bf24c3ca7987017598753b2
SHA2564d68304f5f2005d2d1828d363b6df621a92b99ae198029a62d81987f18532bfa
SHA512b4e434a04f504ec2c3ca0d179b1a4a6e0816ccfb2b7d9ec92c2033a924837427d731aa839d92dd8de0f4a51fe9542f0250cdcab95aba981d870a63ec5dc87744
-
/data/data/com.zhishang.fightgeek/databases/record.db-walFilesize
36KB
MD57883f189a3d7bfd883e8685578ea7aad
SHA16e164420cc8e1a5a9666a98077c3fe4cb484b6ce
SHA25630c2ac5324f60f68fe40eaf4a570e559cdc9d8204c1fb0850acb3933df1a7610
SHA5129689b66ddd60f4fa36bea7f2464a00e5795327df3fb752b74b5aa1ba70cf54806a271c6024bdaff84daa56a2d8c9d8380468c3f1b72e47f92e7768f4cbfe8afb
-
/data/data/com.zhishang.fightgeek/databases/ua.dbFilesize
32KB
MD5355405be7d9539cdd580a197d7a61fc1
SHA14ab015cec85109bc7b75a7c60a6f662234aebb56
SHA2567c85551631151ffca9759a29979246a32e8a077677e7ccc970cfd2588d453352
SHA5121a53e344b659745a3c9d9c0347fce9b90ce529aad5d275b23262aba2cc040998b59c3a2d1671afa1a4076db41cd2441ed974a189b301c2bd64eeb5a446574975
-
/data/data/com.zhishang.fightgeek/databases/ua.dbFilesize
32KB
MD5d604a3bf1f8d992cc320ea5b1f7609bd
SHA1247f88df0b55c7d523ea5398637711a0e4a483a4
SHA256329940b4d46326d58e73c842dd099704061d0ef7338777bf31ad895f29013c17
SHA51267e28f6713cb5c238a9664df128f01a89a2efb7c8c9330c1e45bc0d40ebab81fa20df5166743d84d81dc0386a89ff0329f022281c098339baa2e851ff0a1e1ab
-
/data/data/com.zhishang.fightgeek/databases/ua.dbFilesize
16KB
MD50770c730df01125cf0a86fe0319db647
SHA16f6e826d4ca21ce185e53a98de6db1e0057f75a7
SHA25645b6550df794b335418efcfbc87f763d6a61389b510d3423bce9868483c583da
SHA51235213d09a4433a94ed007f4d3318e98eb09e2bbb60f5a2dfd8841ea1513463e3af4547e0c1d0943a1c36779d24e16139c389f79ae2caa43212a8f36d1154f18c
-
/data/data/com.zhishang.fightgeek/databases/ua.dbFilesize
16KB
MD5d589e50922498f784162827c57615fa0
SHA1d42496d645c09c4816193ca69d2d9857584233a4
SHA2562ef726f96be33ac2a47ad970c6ff06e8ee421fdba2ae22d802302e131fb19205
SHA512161902c5da4440ab528433aa9679fc2240d6acff9d3d2885fda31d0086e6ff85b5ab54688195cda6bff559368f14fa4b44aa090c514388155a1d4391f415d8e3
-
/data/data/com.zhishang.fightgeek/databases/ua.db-journalFilesize
512B
MD5857f53be63c5b0021d60d20038433cb9
SHA10705f671accbf2214ab8a7495812fcc4237a1a7e
SHA256baf81f1a3bc7ff0dfc4146a252979c4ad2eed607ffba4f87f721721deb5a9aec
SHA5122250f135ba34bf14a7a047ba0e8f2dbffdd221347cad9db3fa29c07bd0244372c056d8c316d9dd556109a4ee6902ddf006d9c0e710c4813eeaf6e7e913fb27df
-
/data/data/com.zhishang.fightgeek/databases/ua.db-walFilesize
56KB
MD5e3dd9898f429887e3639ad9c5a91f779
SHA1998a997ee94c2e378a26c46b6821cb36c2ef24ac
SHA256c9421cea0a16e16e05eb185a0e315277f88cb441a3b23c20c65c8f07f9a6fbef
SHA5124c2a0fb74357d5dd9a6cc09549b5c0c441de730cece50966838f2af818e0c7f271ba3022f81a8d8ea4e25cc86cd83839e73fe58818a500324453e35292f4588e
-
/data/data/com.zhishang.fightgeek/databases/ua.db-walFilesize
8KB
MD55fe97cf9a19c30774cd9d1fe2f3d6f61
SHA105494e41932cd6e1c4360f15e3ba36e3c84c5ca6
SHA2561dbe3f5531c31af522b2d18fb30ce73527c37ca56d0068f13c8f0f8ccc452d95
SHA512fcd78cecacc5ce66d8dc0bd930bf6f047b3d2ed2bd652e762d849f8b325c3d12d369aad77feb000cdc663d2fb37bb55e4d388280dc0aee4d61d2c799c9f328f4
-
/data/data/com.zhishang.fightgeek/databases/ua.db-walFilesize
4KB
MD5abeeaa0cd8ffa3452f81f9c04c74d822
SHA11ea8c9e8b11b517fa7f3fd35320255dc6ceaaca0
SHA256c6cc755ec98daf9f446278797208eb7b12ad1c15c00ca44d804e03e1bba8596f
SHA512a308ca561b9d556922679fb6b372df3e15c98c8fc686b0d529d99314d811dd8d36ea23136cee7f1b71e7ebdf939a81658794c04f663d4b4662d5eb82d7a53f19
-
/data/data/com.zhishang.fightgeek/databases/ua.db-walFilesize
4KB
MD5ab18f91bc9edd5cb42da9eeca5aa5cce
SHA1a9dab0d55387d9711c6ad747122a3a551fd72c95
SHA25687e0557c6b22858723aa0a7e0bca83f726f2a4a11a7d727ab277075dbced6778
SHA5120be3bebb5da8d0e270e9df3248e8730f49d51b97691ab6e3ef527d30d20441a3df2ebb2004c0baceea3840500ebaf4ce5d8105481b69c45718d57a4b3c308609
-
/data/data/com.zhishang.fightgeek/files/.imprintFilesize
1020B
MD5a2923780905b58a3f0492bc33a111813
SHA1ae4f2abd7225a228a8acef819950444541065b1f
SHA256c66e5c59a44f59ed099c0f2ad94fb0a326c39e9f5cc5d8329b4363571523b7df
SHA512133aada5a881b70cde28653ea5295b95bd3928bb08507cae44474ee28cdf484decdff6593110c6241114cdd74513a8a93bcb021477eed5e5b0a984b5478fb662
-
/data/data/com.zhishang.fightgeek/files/.umeng/exchangeIdentity.jsonFilesize
162B
MD5bc6b1503883bbc37f337b7880a38704d
SHA1d11237aec6bc59ba6ede47eeb3f94605761e4210
SHA256811cea5b805012704fc27f93aca48479124e04835ca0d58a1315b93d5eab67e4
SHA51229ee548cf890c79452982f313d80ef3d8bb05f26b1066f63b7aaed650cf6b18b0c7d3b4307cfa16f3814a11217ef906fbe907e50a642ba33d2cddab1620930c5
-
/data/data/com.zhishang.fightgeek/files/exid.datFilesize
58B
MD5f54c28a59bd46ce9d7c4bb94a334410a
SHA14d7ac4084d5193115bd13a9b1e8f4143c66a6412
SHA256b205280ff9018931910161377d134d04314e7d99b1208af13a49749aa49ea4ec
SHA512db0e0171662a91c1f38fff25da260096bf9474f6c706829006d408f8b89b3b03abea24aed458fd33f349c431bd5870f975b014365504c8d74f16de4593ca4aab
-
/data/data/com.zhishang.fightgeek/files/umeng_it.cacheFilesize
415B
MD5f193040914e3a062f0c2cb375e02af3d
SHA1714cf15b87cf8ab4939f586413e556ac210967ac
SHA256bbc41b7384144cdce2136d05925673b3cb5ecb0906d2976e430405ebe669cf35
SHA5129c1b49f8db144e1c2cab58a1546699180558103e2c9f98f2ac096839a427f2c6e6b0911c32e9c360cb3d6fa354d17ad084d1511c80eba08317335f7d4d4d406c
-
/data/data/com.zhishang.fightgeek/files/umeng_it.cacheFilesize
211B
MD5959f5a31ddd918f0e9041cbbc3859b45
SHA1ad79fa0867994618e91460edd203519480147358
SHA256fbcf9d49d041f67194d826ab3bbf8bf578b59ae082701f21bea18ad1f08e5649
SHA512a76b41deb9e16cf70f56a7cc69c13d6d74e9407b4d6745aed0c9e52589476e485edca45567fd1f75a74aadaf941f904f15a1f75cfcb3992fecbde9e611ccf315
-
/data/data/com.zhishang.fightgeek/mix.dexFilesize
292B
MD563f77f99bd2c2b772a479923bde11974
SHA1c7632e7d301e4463fafce85f84e9c3d7da3fdbbe
SHA2564c76a3af64cdd2f8713ffe2733dea50dbe714d0ca41c17d1847ee5b62a7ca615
SHA5123aae4a89d1ed51fdd911cb367eb10afe3c2264e4222085891b18a60d5412f85d10bf5c8f3c6642db70abb9aa42732bac5c42c42ee32d587100f53c21b5beb16c