e2fb0545911ade1f6d4b9428cbb0c691cc99872e2f4bb1be156103886f4691fc

Analysis

max time kernel
179s
max time network
179s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
22/05/2024, 10:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

67043dff2c401976df404257112c85ba_JaffaCakes118.apk
Size

17.7MB
MD5

67043dff2c401976df404257112c85ba
SHA1

97217d8bf1b855002f0b0bbd80413fbdddea5401
SHA256

e2fb0545911ade1f6d4b9428cbb0c691cc99872e2f4bb1be156103886f4691fc
SHA512

8fb6a424bdd005a066f6adb7446b55303d42be7fee10aaaffde3f55887ea2b18460f87bfecd11e191029cd42b908a81dedd247b5f161dcb6a1fbf249b3075d39
SSDEEP

393216:7kyKuUy6QOXvH01+tip/PiV7tisSZdlUSOK2bU:oyKNy6N/U1+tky7thS1USOK2bU

Score

8^/10

collection discovery evasion impact persistence

Malware Config

Signatures

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	cn.cntvnews:remote

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	cn.cntvnews

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	cn.cntvnews

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	cn.cntvnews

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	cn.cntvnews:remote

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	cn.cntvnews:remote
Framework service call	android.app.IActivityManager.registerReceiver	cn.cntvnews

Checks if the internet connection is available 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	cn.cntvnews
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	cn.cntvnews:remote

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	cn.cntvnews

cn.cntvnews
1⤵
- Checks CPU information
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4256

cn.cntvnews:remote
1⤵
- Requests cell location
- Queries information about the current nearby Wi-Fi networks
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:4326

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/cn.cntvnews/databases/cntvDb.db

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/cn.cntvnews/databases/cntvDb.db-journal

Filesize
512B

MD5
07b72dd2457449f66e45ac6f273d4d8b

SHA1
67dcb90d68ddc64a509b75ba4951b02b7faedc31

SHA256
bfce36d9a69476fa80f4c127f606afe18e341aa2042f43a6800798b1e9066581

SHA512
89a9319e28df6bd488bbc4952d840d206e76b7053187134304bc9644159bbb24802dc40027e836a1bdb1cbc651d20901c6b00ddf714e64731a9437671f05f1c7

Download Submit
/data/data/cn.cntvnews/databases/cntvDb.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/cn.cntvnews/databases/cntvDb.db-wal

Filesize
36KB

MD5
33a1a9d166dae2aa607b3620aea7bac9

SHA1
b856a26a3f3fe06ae2a1504eb9f73869e5b105b4

SHA256
2c19afeb6f1340389f39a418621695a21bc4d656af1e43874e22fb454a9b5c8b

SHA512
3a4fe0ad1562f1a3d47825be12bba707c72811418159c4f248157268a153093f3bfdb856b9cc5574cfa06a6c75d62227b3094a06baa9aea41a97fc4347f37675

Download Submit
/data/data/cn.cntvnews/files/CMRequire.dat

Filesize
1KB

MD5
c6b4183134d1326d3cf9f0ee279bf698

SHA1
ff06609662fc54c746c0c04a966de9b16deca435

SHA256
91d0e64387b52f57086a09e7aa21a88a28b95a00ba7d5cbf9cabb58011399c50

SHA512
7cd5b2855164731415dadba50404beecfe0bdad6b2ac22d8eb6c2fcbe2a30cb62c50a59a774ea103fbc3ee86a40b620a0d522d1d1b18ea93cf034916c8024a5d

Download Submit
/data/data/cn.cntvnews/files/VerDatset.dat

Filesize
172B

MD5
caaa975d7bf4952bd5dd695ade33f1da

SHA1
119373fbb2db036712df72ec9b26c0c2840dfbb1

SHA256
d0f94264a6b5c355dbf5c0516202c732bcae471a2401542b2ca43307727a0d02

SHA512
db2acdecd236eab67cb67151032f53e51c9c04e754f3c21d74e05cacb1ea5edecbbccbd66ee760624b9cac97b8dd77f568324e8abc2b9c16aa73131db81c8b06

Download Submit
/data/data/cn.cntvnews/files/cfg/a/ResPack.rs

Filesize
525KB

MD5
0357e8edde36315c0e0a4f5385de625f

SHA1
2e6c6f15010e88dac5078f34e31a8ddf5e032f2f

SHA256
44764ad74b21113fb17b21899bd0d4c81740544e868eaad680553b3bd0cb016d

SHA512
497385b4e3b512f6a4365486d40bf1ed298422087f23a352ed2cec96331b9b012814ffba9c3ba83af5f777df16b53bbe1bf3ab8313902db49011f01a3024cf93

Download Submit
/data/data/cn.cntvnews/files/cfg/a/mapstyle.sty

Filesize
248KB

MD5
46a9f9a5221dbe4ff71bfcd2ee045c5c

SHA1
915cb3bc2f0096dede38afc1cd7f09c8782360a9

SHA256
ad3067eb308a9420b727b4f24dc5134bc75b36bdda7a7a7c5651090698dd10a9

SHA512
185530752b639d743f99e28369f75626900420dccf598a639065ecb08c562ff98c4a1f6abbec9724d1684ed053774d60402cd2f20e3586a534c8715e7cec2ac2

Download Submit
/data/data/cn.cntvnews/files/cfg/a/satellitestyle.sty

Filesize
166KB

MD5
3f1348cd6165c9a66a9892565c917ca1

SHA1
96f0c939438c494cf3fd89246d458e92c0c7203b

SHA256
5fbe3817e4047e14c40b567be4955d7579c8bf7b7824bf8370f5e194ebf9767a

SHA512
405c3d1d5f4899cf723509f8e293f2ca1d95a79f7892e93401309372335a6a286f2eae9ee9312f69af10c5bcabd091cd90608898a129542b0abe0617c500d023

Download Submit
/data/data/cn.cntvnews/files/cfg/a/trafficstyle.sty

Filesize
4KB

MD5
6a86f30539dfc9332cd235fc48fcb62c

SHA1
5c202003f6346edb85175b8df7c460793f5512c6

SHA256
34bfd1e28c3625f50a23240c4b08ac50a90fd35c5e5f88aed1cf36fa8fe5e18f

SHA512
f63edb8270e6cd35e5c6896e2b9153144af0d29303e367a4fa81941b1b2bb0de57fa484badb7ec7f05ebdfa67d77b00c3651572c5f05e9314389887f5546d235

Download Submit
/data/data/cn.cntvnews/files/cfg/h/DVDirectory.cfg

Filesize
69KB

MD5
4e9eab735928758b860e48b2f9befd7b

SHA1
7223dfdd00f8059d3b83c28c6f7d78d2dcaa0569

SHA256
1a5650bc57e525ff23c7f0cd058d4574142e772c51a89867a13f89e13b93d6b4

SHA512
c7465fab9518be687ee63cbe044f28a4d5c60f1c043fab0ec66a856b2b542c9d99d9ef5812c7eb2033f797805ba37b821572b83eeeebdaac4854a4bf53977599

Download Submit
/data/data/cn.cntvnews/files/cfg/h/DVHotMap.cfg

Filesize
10KB

MD5
c16f5ca1517683c46e02a6b71aab3c00

SHA1
2d09a048d1b8d556d89d4d723947e9e234b5e59b

SHA256
13d4fbc0d1cb7c2761641a3632c440f6f1d919dce731b8c32cb35e652b0b39f9

SHA512
a692b79382747548fd8be8ed94c06198b143c167be1e96f60d8ea7ee9432a0eb1a0cd73d0704523e487d59443bf7ad13eb36e47b67864e227917d33225e3e62b

Download Submit
/data/data/cn.cntvnews/files/cfg/h/DVHotcity.cfg

Filesize
1KB

MD5
883c30365d5d377966125dd0c079debd

SHA1
d296ec1e3f4badb6e3e6166c1473fb55d4265761

SHA256
50112e7ed210b33224fbe1cce568c8e95a14fb47f7d39ec905369e2feb9668aa

SHA512
00b1604e206a5d929071aa1cac99d83320eacdbb064d517973a5a36757a8a9eb8a103452c98f24e7c8d29adb4b2843e804bfdcb32902da7e364a0c30f8609b7f

Download Submit
/data/data/cn.cntvnews/files/cfg/h/DVVersion.cfg

Filesize
86B

MD5
298924848d2517a508f43ff0cc51bd3b

SHA1
b9fcde7b86653ead6deb57280a6049cf87745710

SHA256
0b6eb1f518059d8c472bab90091bb26d9ab877f6c70fac375412ff1582b8ca3b

SHA512
63b88c5b9b971ec52a5f724485d9998bfedb073e84ed63bcf0337e726923510d97a8ddf87371b5620f89ba788af01db58300638fff5031856c77dec8e18b4342

Download Submit
/data/data/cn.cntvnews/files/cfg/l/DVDirectory.cfg

Filesize
69KB

MD5
65685a117c72fe8fbf5a92b07073c99e

SHA1
b115b527f74e4c291edcaab19b316a446aca8f5b

SHA256
19bcea79613a5c3bb71dfe6b311241fcbf3534b538f0b147c7e849b58b24b2b8

SHA512
e5821a5212f0790db33ec7274f018b08f499557ff7f2f118021a7905573e8dd66e716fb02144919d96eeec7da9db921c756a88cf0a050f65a9f8de3894dcc253

Download Submit
/data/data/cn.cntvnews/files/cfg/l/DVHotMap.cfg

Filesize
10KB

MD5
cc3fad9057e0940ad4d4c7ad27922023

SHA1
403cbbcd7b819733b5caf49ed2a58d654441e99d

SHA256
f6d90bd8621889ab994374b4f51a1c3f9b028aab1a2129b8b3b0e1d7c5c37864

SHA512
ebaf2b8c56bc15826ef38b36e72ae41765fc723470c6dcc40bf9f31118f252777072ad39a535a79f53b6aa29811b4b21cebbc9810c47e34ef9400246d789ab21

Download Submit
/data/data/cn.cntvnews/files/cfg/l/DVHotcity.cfg

Filesize
1KB

MD5
1c6abcbbd253448057930ad1cc59ac75

SHA1
a5845d1c4bc87b8b4785b456d76edcb8309eda4e

SHA256
a46b498ba6586aaa2f246bb34e47f4290ac60273cb86ff662475b0def7172136

SHA512
71aba5b2a1020d1925b3844c861cbe595de3b21d665eedb13f1ef0d80477fc091663e0625b09c5f49d4f9d0770970dd0d188b84635e9c75c1bdba9f2a7171631

Download Submit
/data/data/cn.cntvnews/files/cfg/l/DVVersion.cfg

Filesize
127B

MD5
d54b7b380a5ff46c78283013a07d8e0f

SHA1
f697c5f7028ba2679a96d6bc5291c38ff96d7982

SHA256
c7ad837b097687d92e0d944815fc70adcb0e1cdc82db28f728d13e8a48d7532c

SHA512
ade792589c33179c51305f201bfb6db28c05b2ea098d12bfefc1a5cf9bd3014d53830ce2e71f027719ee1b83b2394c7654b5ddf4fdc7f678840869d2a2787ef4

Download Submit
/data/data/cn.cntvnews/files/ver.dat

Filesize
96B

MD5
f222b515034ecaa203762dd4a6ab7b09

SHA1
7fc2d056e3be061a19963e36d1e28929085c040a

SHA256
8031517a079f783e6afcde648125d8c70738079b5d850c09187e6710c43aadd8

SHA512
c2c2cfed0c0bd7294f727aca6e1cdd6b53ff75e028233c3949d4e67bbaf6f94bb3b05dd13efdb60285c429217a71a53d1c966e05c5ced6813437a6a16de357a2

Download Submit
/data/data/cn.cntvnews/files/weibo_sdk_aid1

Filesize
46B

MD5
4028c8b91f544d6bd51a266683ff791e

SHA1
d8bacd93b5724c8500f66cc46632704115635afd

SHA256
7cda4149bb95d3c082f01b19b365228fd339ce4fcfa02969294e13bdae41270b

SHA512
a8fdcbe785c7f9eabff76f227db4e8c1d099dc8adc81a41283f8fbf118fd0fbff93be1aaacd3c966888f30f247215125317efa56495f022486f5262cd2cc3831

Download Submit
/storage/emulated/0/.DataStorage/ContextData.xml

Filesize
52KB

MD5
e7eb15c03ba3cd7b1f1ef8e6d4252138

SHA1
190eefd2599160f25e3a9c5fc7fcfe035ddb3bad

SHA256
519b97f0769c678e1965a2011275d4666c9b6f3972de40f895fdf3ec18bee753

SHA512
83afd41f8967b3d35aa3d1861d7678f2dd19ead639df565fea475dbe23da8e74d5e6a123b158617f4fe98f5962de0809a3ae0961abed08902b72051bcb3d57bb

Download Submit
/storage/emulated/0/.DataStorage/ContextData.xml

Filesize
32KB

MD5
ba57a9acb9f060ff0077c7e75a9abb6c

SHA1
fcac507af2e13c2d712afcccc06f2b25324cac8a

SHA256
b3a6bd3d21365fc0ed6426dd98e763e9b5554977a4c3448692efffec4efb6582

SHA512
a73206a404e4076d22ef40bd814c9b2f53e96b2b479cc281fe1a7a9e603405b6c7e53ea63903fae9f86e6d1d6819d5530017ccc233faafe43ab25ae4d393c6e9

Download Submit
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

Filesize
512B

MD5
3836bb2b98e496e40e379d52c641da42

SHA1
4a4fe0b493c1ad22cf62c15b6ffd467ce01cf6a4

SHA256
c4275aac3c754bcb569db63e9b85e1f2abbd50971976b0f19741689d80c6782a

SHA512
5672de121d1b74c5992a3fdf935ba5388d4f4dd7240d4c9dae2094939087571022b3696d969196bb5e63c2346932930524c894fc6dd57c188bdfc33a71874a24

Download Submit
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

Filesize
28KB

MD5
0d3e99204c6401ea499fe9e6d9855497

SHA1
09829f00ca458eab7374d5079393a2cd69a2348a

SHA256
63ad014cb50908591939d6a1536f85eece807425af4f4e8a1f9b9eeab13cc5ca

SHA512
8d9a50aa9abd17e508ed3ac35a3033e8f9e550d1088baa951f53e6c4697c5ac026d22b90e36e27341d64baa3f0202bd89ca97583e99feb25f8c26b5776c59c68

Download Submit
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

Filesize
380B

MD5
f0d7dc1b0e1eec8f66b5dbef001de6fb

SHA1
ad48a0ed9f340215b99f83ffdf71ce0f47a60ac0

SHA256
37cda222f3bebbda51ec4d4cbc6c6e04df0967f28475bbbf26ce92142b44d43a

SHA512
4cfdfe55a3d948b653fc3b95beb8dc455bb365b56543d0304f93dee36597fa1576a59568d0f6c137bb0383f7ad51576ee21a1d7e13a32e18cbff43e1ed60f028

Download Submit
/storage/emulated/0/baidu/.cuid

Filesize
89B

MD5
f15bfea78074eb755b3cb37481151899

SHA1
40605218f6ed502074a5cfce27325da547c5c7d1

SHA256
a68f9f6140f7594cced470b2ed4bee2ccba33b624f783b8eb3edcc97d628aef4

SHA512
11cdad7af947ea0de7d4e05a2e178c5b84e16e92981cbd39725b37461d7544ff49dabf4e52d740e13cdc3fa91f095d9e56a48adcdcb207fe262c2d1f4fd4d9da

Download Submit
/storage/emulated/0/baidu/tempdata/conlts.dat

Filesize
148B

MD5
f3b77c492c44479beacbadff98eab6e0

SHA1
d64fb6076a6bbbb62ac29f670b05ff7de3f14919

SHA256
f035d112f981925ca36b72235a51e1bdfa579f372cadee371c5bfe2fd43f74af

SHA512
fb4f190362b67cd4eca9b158ffcdc86608d76160816b4d87c71707bdd275a8e43c9f5ace101700d7dac4be244e185209aec2c531c9a2462ebd486ba2c1a0d0f0

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads