133a588b93ab1d6f267443097d750a96017257cde6e0609ec30e3405eef68927

Analysis

max time kernel
110s
max time network
184s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
22-05-2024 10:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6701a6808dfdf07b14605994c487b285_JaffaCakes118.apk
Size

16.0MB
MD5

6701a6808dfdf07b14605994c487b285
SHA1

b6341847488bfe4c4632ed6011d8d3e291dfdfaf
SHA256

133a588b93ab1d6f267443097d750a96017257cde6e0609ec30e3405eef68927
SHA512

52f7495ed4fc0a7273511e31b40dfebc9ca6f15ca393018a923744ca483ab21f9d6ae98008503f4b7eac03a4863f16a0c7b739e4bb6cec1238f195275f8d2797
SSDEEP

393216:a5MFAtDQNsPtVHEx0ld3QVQIe8wKoYCl5X:LOQ+VH3QKIetKo5l1

Score

8^/10

discovery evasion impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs
evasion

T1426

Processes:

io.rong.push/system/bin/sh -c type su

ioc process

/system/app/Superuser.apk io.rong.push
/sbin/su /system/bin/sh -c type su
Checks memory information 2 TTPs 2 IoCs
Checks memory information which indicate if the system is an emulator.
evasion discovery

T1633.001

T1426

Processes:

com.junzhao.shanfenio.rong.push

description ioc process

File opened for read /proc/meminfo com.junzhao.shanfen
File opened for read /proc/meminfo io.rong.push

ioc	process
/system/app/Superuser.apk	io.rong.push
/sbin/su	/system/bin/sh -c type su

description	ioc	process
File opened for read	/proc/meminfo	com.junzhao.shanfen
File opened for read	/proc/meminfo	io.rong.push

Loads dropped Dex/Jar 1 TTPs 13 IoCs

Runs executable file dropped to the device during analysis.

evasion

T1407

Processes:

com.junzhao.shanfen/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.junzhao.shanfen/mix.dex --output-vdex-fd=48 --oat-fd=57 --oat-location=/data/data/com.junzhao.shanfen/oat/x86/mix.odex --compiler-filter=quicken --class-loader-context=&io.rong.pushcom.junzhao.shanfen:ipc

ioc	pid	process
/data/data/com.junzhao.shanfen/mix.dex	4293	com.junzhao.shanfen
/data/data/com.junzhao.shanfen/mix.dex	4361	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.junzhao.shanfen/mix.dex --output-vdex-fd=48 --oat-fd=57 --oat-location=/data/data/com.junzhao.shanfen/oat/x86/mix.odex --compiler-filter=quicken --class-loader-context=&
/data/data/com.junzhao.shanfen/mix.dex	4293	com.junzhao.shanfen
/data/data/com.junzhao.shanfen/mix.dex	4293	com.junzhao.shanfen
/data/data/com.junzhao.shanfen/mix.dex	4293	com.junzhao.shanfen
/data/data/com.junzhao.shanfen/mix.dex	4437	io.rong.push
/data/data/com.junzhao.shanfen/mix.dex	4437	io.rong.push
/data/data/com.junzhao.shanfen/mix.dex	4437	io.rong.push
/data/data/com.junzhao.shanfen/mix.dex	4437	io.rong.push
/data/data/com.junzhao.shanfen/mix.dex	5250	com.junzhao.shanfen:ipc
/data/data/com.junzhao.shanfen/mix.dex	5250	com.junzhao.shanfen:ipc
/data/data/com.junzhao.shanfen/mix.dex	5250	com.junzhao.shanfen:ipc
/data/data/com.junzhao.shanfen/mix.dex	5250	com.junzhao.shanfen:ipc

Queries information about running processes on the device 1 TTPs 3 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

T1424

Processes:

com.junzhao.shanfenio.rong.pushcom.junzhao.shanfen:ipc

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.junzhao.shanfen
Framework service call	android.app.IActivityManager.getRunningAppProcesses	io.rong.push
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.junzhao.shanfen:ipc

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

T1421

Processes:

io.rong.push

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo io.rong.push

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	io.rong.push

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 5 IoCs

persistence

T1624.001

Processes:

com.junzhao.shanfencom.junzhao.shanfen:ipcio.rong.pushcom.junzhao.shanfen:ipccom.junzhao.shanfen:ipc

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.junzhao.shanfen
Framework service call	android.app.IActivityManager.registerReceiver	com.junzhao.shanfen:ipc
Framework service call	android.app.IActivityManager.registerReceiver	io.rong.push
Framework service call	android.app.IActivityManager.registerReceiver	com.junzhao.shanfen:ipc
Framework service call	android.app.IActivityManager.registerReceiver	com.junzhao.shanfen:ipc

Checks if the internet connection is available 1 TTPs 3 IoCs

discovery

T1421

Processes:

com.junzhao.shanfenio.rong.pushcom.junzhao.shanfen:ipc

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.junzhao.shanfen
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	io.rong.push
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.junzhao.shanfen:ipc

Reads information about phone network operator. 1 TTPs
discovery

T1422
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

T1471

Processes:

io.rong.push

description ioc process

Framework API call javax.crypto.Cipher.doFinal io.rong.push

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	io.rong.push

com.junzhao.shanfen
1⤵
- Checks memory information
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:4293

sh -c getprop ro.yunos.version
2⤵
PID:4335

getprop ro.yunos.version
2⤵
PID:4335

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.junzhao.shanfen/mix.dex --output-vdex-fd=48 --oat-fd=57 --oat-location=/data/data/com.junzhao.shanfen/oat/x86/mix.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:4361

logcat -d -v threadtime
2⤵
PID:4624

com.junzhao.shanfen:ipc
1⤵
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4410

io.rong.push
1⤵
- Checks if the Android device is rooted.
- Checks memory information
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4437

/system/bin/sh -c getprop ro.board.platform
2⤵
PID:4568

sh -c getprop ro.yunos.version
2⤵
PID:4606

getprop ro.board.platform
2⤵
PID:4568

getprop ro.yunos.version
2⤵
PID:4606

/system/bin/sh -c type su
2⤵
- Checks if the Android device is rooted.
PID:4668

logcat -d -v threadtime
2⤵
PID:4814

/system/bin/sh -c getprop ro.miui.ui.version.name
2⤵
PID:4834

getprop ro.miui.ui.version.name
2⤵
PID:4834

/system/bin/sh -c getprop ro.build.version.emui
2⤵
PID:4864

getprop ro.build.version.emui
2⤵
PID:4864

/system/bin/sh -c getprop ro.lenovo.series
2⤵
PID:4889

getprop ro.lenovo.series
2⤵
PID:4889

/system/bin/sh -c getprop ro.build.nubia.rom.name
2⤵
PID:4913

getprop ro.build.nubia.rom.name
2⤵
PID:4913

/system/bin/sh -c getprop ro.meizu.product.model
2⤵
PID:4955

getprop ro.meizu.product.model
2⤵
PID:4955

/system/bin/sh -c getprop ro.build.version.opporom
2⤵
PID:4980

getprop ro.build.version.opporom
2⤵
PID:4980

/system/bin/sh -c getprop ro.vivo.os.build.display.id
2⤵
PID:5005

getprop ro.vivo.os.build.display.id
2⤵
PID:5005

/system/bin/sh -c getprop ro.aa.romver
2⤵
PID:5035

getprop ro.aa.romver
2⤵
PID:5035

/system/bin/sh -c getprop ro.lewa.version
2⤵
PID:5059

getprop ro.lewa.version
2⤵
PID:5059

/system/bin/sh -c getprop ro.gn.gnromvernumber
2⤵
PID:5083

getprop ro.gn.gnromvernumber
2⤵
PID:5083

/system/bin/sh -c getprop ro.build.tyd.kbstyle_version
2⤵
PID:5108

getprop ro.build.tyd.kbstyle_version
2⤵
PID:5108

/system/bin/sh -c getprop ro.build.fingerprint
2⤵
PID:5135

getprop ro.build.fingerprint
2⤵
PID:5135

/system/bin/sh -c getprop ro.build.rom.id
2⤵
PID:5159

getprop ro.build.rom.id
2⤵
PID:5159

com.junzhao.shanfen:ipc
1⤵
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:5196

com.junzhao.shanfen:ipc
1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:5250

sh -c getprop ro.yunos.version
2⤵
PID:5326

getprop ro.yunos.version
2⤵
PID:5326

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.junzhao.shanfen/cache/image/journal.tmp
Filesize
512B

MD5
7688181982aae24002125ba5714eb35b

SHA1
f2b770e4bc921da184b6029421a42496755be415

SHA256
574902d78e8220a9cc4f2f953d84dbea20ebfb6317591f8b84bb10c5409d4854

SHA512
671b13af3d60d53cd776aa490d23d5b46ab50bea6b126cb5d104dc0a8efb61082a0c106efb6fcead814a70207c8b2face6ba7d6ee356f19399beeb7ab03784e2

Download Submit
/data/data/com.junzhao.shanfen/databases/ThrowalbeLog.db-wal
Filesize
32KB

MD5
15a47c42a8638cc8dacb3f6807c40f98

SHA1
f85093fee935a88f24dfedc55ba3c22a15828834

SHA256
119ef48a882d9fa7c8bf002bfafa9680a340c42cfcafae1214403c1c65b2982e

SHA512
6f94fcb0edf865d91c0acedeae09c1b5c276bba3708a3c8945e58f1e5710a5450dbfa6b5ca8a7b36b0080d87164bdebeddabb7bee150e729325734b25d9e74b0

Download Submit
/data/data/com.junzhao.shanfen/databases/app.db
Filesize
4KB

MD5
8e1314df744e2c401faa5dd04848da5f

SHA1
8bc90890d9ff7722dc920b65df509914d6c41902

SHA256
83000c5504d979ab822ebfe1abd2a576d7608b8df589c09f8263713509487453

SHA512
c1edfbafc277be8818de1a681afadd39afaec2710d98a51161b8c181c345d4df485331b9ec64b7e64242fdae285ad7c45892bcedabf3a1d633f81e02b5ee55e0

Download Submit
/data/data/com.junzhao.shanfen/databases/app.db-journal
Filesize
512B

MD5
a3fa4aa63ce49fba2bca885c18d2e2b5

SHA1
59b10db43e2fd8029190b0f399461816b21f075f

SHA256
cbc4611a000cda97db1857a22a725d62b277b37322333115a51c1d7e357fb168

SHA512
2cb91d7b724cc780ef496fbb02f5f19e4f309294b57cf29eab8ed3e4819ec1f09506533885093e0249cf0983da8be8e3af0cb2a4f97323c7fc8bcb3d75f5ee5a

Download Submit
/data/data/com.junzhao.shanfen/databases/app.db-shm
Filesize
32KB

MD5
1c4274aa7a9a5cac8c6d1df71e4588c6

SHA1
abaecd685e01cc68801292e3dc7085654a22feba

SHA256
3f6cd5f480ae69859b7841450f3d032c528ba385ebf9f371b9c8fdc6eb4231be

SHA512
1adb95935798607bd36cedcd183924d3068f50097d017b278da7caee7771532b61ec3606f6189b6dec8426eb038fe40be75079ce35894b1a8e0d1d815261150c

Download Submit
/data/data/com.junzhao.shanfen/databases/app.db-wal
Filesize
20KB

MD5
6b816ccdb8fd107ea88539e0ccb8e955

SHA1
9dee2a0b5c812f4fa8a9d05f1451ffd02e1858c4

SHA256
089b143e6c8bfd8cef7ea0e4a7c564a5f202acf3be9a1649c3a61c11440bb2c4

SHA512
5e433925941080c0a33f0870fcf7e31d6656076e2f44904fe09f0fa40d3d68c07be61df343d86cd6cd6caf826f5b0abd3aeefb07dafa3e384eafc79213935a47

Download Submit
/data/data/com.junzhao.shanfen/databases/bugly_db_legu
Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.junzhao.shanfen/databases/bugly_db_legu-journal
Filesize
277KB

MD5
dce86582047e8c00d4654b8065463d88

SHA1
24694381718d905cfcd87402298e88935eec0b2b

SHA256
c896b564a17010b2fa55fa41cffaf00e9e2a0da5805cfe42883b901fa55f3b6f

SHA512
bd9cea49db8604c8477b0b16702ff14d5f41f0743c9aa272d0288408c477c7108f6a10884e487830ac33c4044a066b0eeeb13e52f885b02d6b601474c46b31fe

Download Submit
/data/data/com.junzhao.shanfen/databases/bugly_db_legu-shm
Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.junzhao.shanfen/databases/bugly_db_legu-wal
Filesize
92KB

MD5
1e8ef4688105c192dbf983c55386f92a

SHA1
15ab3e733211cfe1f65fa5f6e4827b38d76dbdda

SHA256
e357cde67bd8f6abe4cda772ba0461f16deaf516cca0f758f0066e6565cf945f

SHA512
65c21cf96207702b010d6d190234cad763545714fa485975bd52d3c84c1655ddaa41781cb8a42cabc29fcfcc1ccb212394e83f58c5c18ffee5d41bbd75a9c841

Download Submit
/data/data/com.junzhao.shanfen/databases/trinea_android_common.db-journal
Filesize
512B

MD5
6396bb01e88e572ffb873d15b6e2bcbe

SHA1
e2649769db8f77b23fc03ccbd984d37b14541b2e

SHA256
c6558b1dbafccd8c272d9cf7f86bc4cf2ab34c222fd45cbf10bd64daea6a248c

SHA512
c6ae1390064c26601b1e6ff5f342392c9c3a2786f1689d93a256e06a7e000e17b5812651fb40917b50eb4b70fde4c3c7fdddfe6166d279ca0da6aaf75be8d924

Download Submit
/data/data/com.junzhao.shanfen/databases/trinea_android_common.db-wal
Filesize
48KB

MD5
7bd1e727f26e450d8c283776b3d39f13

SHA1
bbfd92841df8c9a2b37d39f5b922c99246b33cc7

SHA256
dd236521076cb8be5e8c324405d46d2a1db4a32f8c66376e4b72ae055d689cd2

SHA512
5fc58f327fcc5553b17d43d327db0885588c114868d76df870e2074e138526b46e48e20852068c2735e0146eda006c2bbc0592be01118325d3591ce8def03b4c

Download Submit
/data/data/com.junzhao.shanfen/mix.dex
Filesize
292B

MD5
63f77f99bd2c2b772a479923bde11974

SHA1
c7632e7d301e4463fafce85f84e9c3d7da3fdbbe

SHA256
4c76a3af64cdd2f8713ffe2733dea50dbe714d0ca41c17d1847ee5b62a7ca615

SHA512
3aae4a89d1ed51fdd911cb367eb10afe3c2264e4222085891b18a60d5412f85d10bf5c8f3c6642db70abb9aa42732bac5c42c42ee32d587100f53c21b5beb16c

Download Submit
/storage/emulated/0/Mob/comm/.di
Filesize
57B

MD5
70a42cba408700f9a6c01c7941a8829e

SHA1
eab01cc2c0671538795fb0b1146017dc099d0984

SHA256
499576707ce2623293166979e59c832be5b8636c64ad39aa63ebcf961910c35f

SHA512
8900d4dc8eed0430babbacb72942401bd22ef7fe5430cad90d3ce0c2c53010220d666aa0e2eb1026f3ec81d574c7fa12585b49222a5f15b01637f6ba134fe70c

Download Submit