0c17c267e6af757129c5423da0c5aedb2ba54901820b14f546a82007ce5b3e5d

Analysis

max time kernel
176s
max time network
184s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
22-05-2024 10:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

67011e4d3d29a465b6f3ccddbdf440c7_JaffaCakes118.apk
Size

12.9MB
MD5

67011e4d3d29a465b6f3ccddbdf440c7
SHA1

1ce4eb32c75f862cff91870253dbc94f887cf621
SHA256

0c17c267e6af757129c5423da0c5aedb2ba54901820b14f546a82007ce5b3e5d
SHA512

9476d3fc08f9e4989508640ada257c84428246e41401194ba1de1c37cfb8de158707e9594b7621f720f36e2bf301f7024a5a5ea410ab399e0d518c567b7573ea
SSDEEP

196608:Gh5N1+xks5SHl/ilRwb1pRXKIVmLFdMLW4UnxNfF2+kQQ+bwPZC6Iqi12BCWyDRO:Vv58H1KIVmLFeVF/QqPZnB0kPahe1

Score

7^/10

discovery evasion impact persistence

Malware Config

Signatures

Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

org.unionapp.bzjxjy

description ioc process

File opened for read /proc/cpuinfo org.unionapp.bzjxjy

description	ioc	process
File opened for read	/proc/cpuinfo	org.unionapp.bzjxjy

Queries information about running processes on the device 1 TTPs 3 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

Processes:

org.unionapp.bzjxjyorg.unionapp.bzjxjy:ipcio.rong.push

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	org.unionapp.bzjxjy
Framework service call	android.app.IActivityManager.getRunningAppProcesses	org.unionapp.bzjxjy:ipc
Framework service call	android.app.IActivityManager.getRunningAppProcesses	io.rong.push

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

System Network Connections Discovery
T1421

Processes:

org.unionapp.bzjxjy

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo org.unionapp.bzjxjy

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	org.unionapp.bzjxjy

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 3 IoCs

persistence

Broadcast Receivers

T1624.001

Processes:

org.unionapp.bzjxjyorg.unionapp.bzjxjy:ipcio.rong.push

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	org.unionapp.bzjxjy
Framework service call	android.app.IActivityManager.registerReceiver	org.unionapp.bzjxjy:ipc
Framework service call	android.app.IActivityManager.registerReceiver	io.rong.push

Acquires the wake lock 1 IoCs

Processes:

org.unionapp.bzjxjy

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock org.unionapp.bzjxjy

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	org.unionapp.bzjxjy

Checks if the internet connection is available 1 TTPs 3 IoCs

discovery

System Network Connections Discovery

T1421

Processes:

org.unionapp.bzjxjyorg.unionapp.bzjxjy:ipcio.rong.push

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	org.unionapp.bzjxjy
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	org.unionapp.bzjxjy:ipc
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	io.rong.push

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

org.unionapp.bzjxjy

description ioc process

Framework API call javax.crypto.Cipher.doFinal org.unionapp.bzjxjy

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	org.unionapp.bzjxjy

org.unionapp.bzjxjy
1⤵
- Checks CPU information
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Acquires the wake lock
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4264

org.unionapp.bzjxjy:ipc
1⤵
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:4304

io.rong.push
1⤵
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:4332

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/org.unionapp.bzjxjy/databases/cc/cc.db
Filesize
36KB

MD5
ce6135aa1b1fe4f2c2db2a546d2a5558

SHA1
79b59582154017aadab783dc266fcb158c252940

SHA256
7b45f576c08c7f78220168cca4a0e33198b13e9bdc8b1da406ddb6887412000c

SHA512
2839075fe374c8567c839ae35ce2d33ec72fdaebf170aa7d224b555e5b0e74d4a43f2f67d17ed806dae841da883e9620d788ea052d06152678afa927307c7ce4

Download Submit
/data/data/org.unionapp.bzjxjy/databases/cc/cc.db
Filesize
36KB

MD5
5d7ea1a23af19b4340cc8d90f28297d5

SHA1
4cfe95b23a9e98378d69c4290af81b51fbe76aea

SHA256
474c4a54534ed96beacad7cc9a805a3f53ec9c0522fc7bcc59771cf500a6a0da

SHA512
33071f4c92da0a3df01c4a61dd165df7c7e0f4f37753cafe02d19fc876a5e7fcbb01c069c804e140ab8bfa0644a55f50fd1373646d1c439f817baa5ffbd47f7b

Download Submit
/data/data/org.unionapp.bzjxjy/databases/cc/cc.db-journal
Filesize
512B

MD5
b428771602b248ca6b7c5c8c606b8636

SHA1
40bf91ff40a01eb3497cc4665168af20ab80f848

SHA256
31f5a7d74acfcb75e0882f2c6f2029d67b40141385dfdf41d1ea638db61c7275

SHA512
9603dfa2c5fc0a03212530dbc42328742859edde671979f4c68df3ae118630cf0c0a6273085450584e0591adde7021880045ee2a1e08b27b3228d0d29547255e

Download Submit
/data/data/org.unionapp.bzjxjy/databases/cc/cc.db-shm
Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/org.unionapp.bzjxjy/databases/cc/cc.db-wal
Filesize
16KB

MD5
569c1df21df0a154211ef2fe5cb080f4

SHA1
f24190fbf93bab92015fc6c8d3ec87ff440b84fc

SHA256
aaa0167776de2b0fea35e0d4b49cd1fd3ac547e215ea1adf8a490161c5687ecf

SHA512
30a6d2b9d9ac3295b0c26ad9710c05e49de97fb9f803b60bbdc21ea6cf5645ed00b255d8c3ab0f5892efe1273ecbddca77147891400cfcdb137ec5484898cdda

Download Submit
/data/data/org.unionapp.bzjxjy/databases/cc/cc.db-wal
Filesize
48KB

MD5
34a3d3504e7c88d69f4563e78206e2c0

SHA1
0ad1fbe2ad64fb49025119e847affade5ab4264b

SHA256
4e8dd93d646efe1315ca3e1ef35219685418f20bf6d73ef9f0209b8a0ef1aace

SHA512
ec519823f704713cf8e739a7064fbfdc515eb31cb0d4d5729e69a84d4b8a352483c0cc3a4c1b32b234c3fa119f8492eeb11cb9e85eee770168f4fedf05a4d7f7

Download Submit
/data/data/org.unionapp.bzjxjy/files/.um/um_cache_1716375128111.env
Filesize
1KB

MD5
163059ff65b93a10ddbbf7ee9ada18aa

SHA1
d7d98abaea1e07d1e15d7668a10ead798e70052b

SHA256
a68ccbaacaa638534b1b24860b03dfca2cce6768d8f0043715c0c0e4a8d4a85f

SHA512
b751f4fd502dfe21ecc1318585c4bc89f80756ec25c43682b1cf8876304d6c7f9465c37a50144667bf5145c4ca6bab7ce82827865130a4c6810ae073006a3e82

Download Submit
/data/data/org.unionapp.bzjxjy/files/.umeng/exchangeIdentity.json
Filesize
162B

MD5
a9a72d3c5b28ea883a48d0d82f0ef569

SHA1
abdac90e16e8ebbc090c802833437b8b6c594b94

SHA256
db0eb2a72531cb97abe1f28434701fe07c7351ad5d9af134e0e2b88645472221

SHA512
2572792d7d3d1bbc7a8529adec0ac07fd618960a1c8127567cd1ad6843f831327f472d69f32bfac9b8d071b294317b8880e900391a85aea6133c1048d0f07723

Download Submit
/data/data/org.unionapp.bzjxjy/files/exid.dat
Filesize
57B

MD5
695f216a9730f9d61d5418f3724b1905

SHA1
e25e02675a22318861bd407ae9af5c1ecf663e2f

SHA256
2d2e19e4a9183d14542ddb9ea06239e88015542f1790df67e30e53ae95c60424

SHA512
2e07c0c87a4df27b82cebf3548496ca6b86c35a36aa3da6903901725d419808a93a938c4f7bafb16c5520ab9c22a6bb81fec71ac7cf479a41917f118ed9bdb74

Download Submit
/data/data/org.unionapp.bzjxjy/files/umeng_it.cache
Filesize
498B

MD5
6e078e252479c7fb5d6ec81defb3fca1

SHA1
605b93aed0d1a6d0c5a3db71d337b1952eed0ec5

SHA256
eda0b2be13235b59debdd499f26b43ce60ec7e9c96dbafc3ce1fba5af2622ae9

SHA512
581c87a95f1f7815b56d3a4a18684d58c59e6bd0f877ed664b9b787a6adf4ce73a5b4d62f8d1aa978f6316f4e447a874c2d86757a6a0b6593a00537fd657cb3f

Download Submit
/storage/emulated/0/.DataStorage/ContextData.xml
Filesize
111B

MD5
2d2a39965a7b2ddaf30e722edcb92248

SHA1
4b964a50943a6ec825e9c67b45fec4a0d79d1887

SHA256
ace9fc06397631c6ae4edea82f187d1fa2e3314fa40a63c707e7c3d8537180e3

SHA512
6329752c744caba3bddeedfb0ded9bf5cf6a9fbc91c25dd41dcc08ce84ecc892686a730103507f8f7ebbc73de50ac75cee0ee3e4fa9e0b4e4ed1fcd31d863e5f

Download Submit
/storage/emulated/0/.DataStorage/ContextData.xml
Filesize
213B

MD5
04dd09e7f4b0d15ca3cb5d0bde1410db

SHA1
d83acc613b641a766fae2549e20d3894ef28e61c

SHA256
cb4c0ceafe3eb6a5b2f67ef326de703f14e2caad975bd93ec3bcaaadee3bc27a

SHA512
1e9defef6ea3a946a3950dd6b52913c10da339835a1c8b80bc2521086a5cf661bab3ddb35860de4bc4cb69a0b0ab49ef3bdfc7d522f98ae703725b5f7e72f4a2

Download Submit
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Filesize
167B

MD5
19aab9ee7531d3dafa186d1676c30203

SHA1
ed3891387faf47a826a94d670d6974bf10147711

SHA256
17ef38fb62b54348c7761e0742bb557f0d41fad19f187f930fd6703556c3fd07

SHA512
c6a59f9424c65dd7618dfd5de043f048bf3865c475cdb07040f36932eac4671617045504161b80b24378038f613c36a3ce854bb924745a4a50dcb4573d696dae

Download Submit
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Filesize
65B

MD5
9781ca003f10f8d0c9c1945b63fdca7f

SHA1
4156cf5dc8d71dbab734d25e5e1598b37a5456f4

SHA256
3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793

SHA512
25a9877e274e0e9df29811825bd4f680fa0bf0ae6219527e4f1dcd17d0995d28b2926192d961a06ee5bef2eed73b3f38ec4ffdd0a1cda7ff2a10dc5711ffdf03

Download Submit
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Filesize
111B

MD5
44814fafb2bf8587b570871fe981e8b2

SHA1
a70fce43d6af6b2d09578d6182ddda4e1312e840

SHA256
31beb50ce88a590732429c07d75a9cec0d41b94b1913577f0063e0610e924a50

SHA512
26ca3fb6d817c9c086c086d8f89bb01bb382439d94cd7ff8137adcc1041e2c06ee354c0910072a86500b2807c80192f99c45ad9c886216a27d500984a42f1f4e

Download Submit
/storage/emulated/0/org.unionapp.bzjxjy/cache/image/journal.tmp
Filesize
31B

MD5
8c92de9ce46d41a22f3b20f77404cc1d

SHA1
8671a6dca00edb72be47363a7071be65cf270373

SHA256
68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274

SHA512
30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

Download Submit