9cd77c1ac11b9eabaef39cee2f72609745a174f845fa3f37fe56d6e6cb2c59cb

Analysis

max time kernel
17s
max time network
139s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
22-05-2024 13:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

677fd6071cfae7220ede6f2a96c679b5_JaffaCakes118.apk
Size

14.5MB
MD5

677fd6071cfae7220ede6f2a96c679b5
SHA1

94e6f94de818e8aea46cc5704dd9b5637046ef7e
SHA256

9cd77c1ac11b9eabaef39cee2f72609745a174f845fa3f37fe56d6e6cb2c59cb
SHA512

50b2e670fa6f34042b3ebc1e646d7709cb8ed11004dd8077adae0de470199ff8a7dae85069cf922713cdb0793a3d422d09efb70b248dd013dbf14ab0d594cec0
SSDEEP

393216:WbL3Sw3MxaowFkOcLC/lGjCmrN1vbRk4FKtVD0PuO:SLiwcxPRuYnrN1vbR1FsDZO

Score

8^/10

discovery evasion impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs
evasion

T1426

Processes:

com.kuaima.kuailai/system/bin/sh -c type su

ioc process

/system/app/Superuser.apk com.kuaima.kuailai
/sbin/su /system/bin/sh -c type su
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
evasion discovery

T1633.001

T1426

Processes:

com.kuaima.kuailai

description ioc process

File opened for read /proc/meminfo com.kuaima.kuailai
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

T1421

Processes:

com.kuaima.kuailai

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.kuaima.kuailai
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

T1624.001

Processes:

com.kuaima.kuailai

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.kuaima.kuailai
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

T1421

Processes:

com.kuaima.kuailai

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.kuaima.kuailai
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

T1471

Processes:

com.kuaima.kuailai

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.kuaima.kuailai

ioc	process
/system/app/Superuser.apk	com.kuaima.kuailai
/sbin/su	/system/bin/sh -c type su

description	ioc	process
File opened for read	/proc/meminfo	com.kuaima.kuailai

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.kuaima.kuailai

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.kuaima.kuailai

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.kuaima.kuailai

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.kuaima.kuailai

com.kuaima.kuailai
1⤵
- Checks if the Android device is rooted.
- Checks memory information
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4267

/system/bin/sh -c getprop ro.board.platform
2⤵
PID:4299

getprop ro.board.platform
2⤵
PID:4299

/system/bin/sh -c type su
2⤵
- Checks if the Android device is rooted.
PID:4327

logcat -d -v threadtime
2⤵
PID:4355

logcat -d -v threadtime
2⤵
PID:4372

/system/bin/sh -c getprop ro.miui.ui.version.name
2⤵
PID:4393

getprop ro.miui.ui.version.name
2⤵
PID:4393

/system/bin/sh -c getprop ro.build.version.emui
2⤵
PID:4420

getprop ro.build.version.emui
2⤵
PID:4420

/system/bin/sh -c getprop ro.lenovo.series
2⤵
PID:4445

getprop ro.lenovo.series
2⤵
PID:4445

/system/bin/sh -c getprop ro.build.nubia.rom.name
2⤵
PID:4470

getprop ro.build.nubia.rom.name
2⤵
PID:4470

/system/bin/sh -c getprop ro.meizu.product.model
2⤵
PID:4496

getprop ro.meizu.product.model
2⤵
PID:4496

/system/bin/sh -c getprop ro.build.version.opporom
2⤵
PID:4533

getprop ro.build.version.opporom
2⤵
PID:4533

/system/bin/sh -c getprop ro.vivo.os.build.display.id
2⤵
PID:4562

getprop ro.vivo.os.build.display.id
2⤵
PID:4562

/system/bin/sh -c getprop ro.aa.romver
2⤵
PID:4588

getprop ro.aa.romver
2⤵
PID:4588

/system/bin/sh -c getprop ro.lewa.version
2⤵
PID:4613

getprop ro.lewa.version
2⤵
PID:4613

/system/bin/sh -c getprop ro.gn.gnromvernumber
2⤵
PID:4638

getprop ro.gn.gnromvernumber
2⤵
PID:4638

/system/bin/sh -c getprop ro.build.tyd.kbstyle_version
2⤵
PID:4667

getprop ro.build.tyd.kbstyle_version
2⤵
PID:4667

/system/bin/sh -c getprop ro.build.fingerprint
2⤵
PID:4692

getprop ro.build.fingerprint
2⤵
PID:4692

/system/bin/sh -c getprop ro.build.rom.id
2⤵
PID:4717

getprop ro.build.rom.id
2⤵
PID:4717

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.kuaima.kuailai/databases/bugly_db_legu
Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.kuaima.kuailai/databases/bugly_db_legu-journal
Filesize
512B

MD5
1fe24b5c8df9ed861e0e0839c3a4f427

SHA1
40248e01ce3768baa1e929b5cef3956619679122

SHA256
f0ada529b678761a7f283851e7d953a374b3b290b7573c52116c9436359849ea

SHA512
2dc018141b2368f0d348f95132a44343f1281543b96424bf80ee4e580c5483cd637ba7104cb21de8568dfdd97c831eb12c8befe8f5d8893d914dc6957ee6eac8

Download Submit
/data/data/com.kuaima.kuailai/databases/bugly_db_legu-shm
Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.kuaima.kuailai/databases/bugly_db_legu-wal
Filesize
197KB

MD5
e1e5c665619d970ac367d42314383f20

SHA1
0bb8c2f9f405fa77b2dfadf289cfeb21f1d45527

SHA256
cf8d6c532e6937e7da01bf7b006f5508756022659f5f8bb2ee05db70dc71836f

SHA512
b45e6b1027ad145149181e5729a89d796b6a07e1d8576939ef933b79dd3316e1f53f3af361b36b9ac2e2b474bcf3972e726dee6ea37bf11dc81a7bcd2460f135

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads