Analysis

  • max time kernel
    13s
  • max time network
    190s
  • platform
    android_x64
  • resource
    android-x64-20240514-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
  • submitted
    22-05-2024 13:05

General

  • Target

    675a0bfbd1e3eb249af20e918560bda8_JaffaCakes118.apk

  • Size

    27.2MB

  • MD5

    675a0bfbd1e3eb249af20e918560bda8

  • SHA1

    7898f2b765fafe48575bb33d190aac08b196a372

  • SHA256

    6a52d3f3172cdf0f243c451959a50baf1c546012975b093f10ebc2f963c107f4

  • SHA512

    d7d916ad5db13fa35f87fe36077e32bee2b7936c71aeb573240ad1903cb17499b2ddcd4b3e06dec53d0241eeac101a31d8b74391f514359874c7b9685c43d232

  • SSDEEP

    786432:QdCyufQtAMXNk4+Xxj3tR7eLIyWCAerN12Du5juty:QdCZMXN7KxjdRZLef5jF

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 1 IoCs
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Requests cell location 2 TTPs 1 IoCs

    Uses Android APIs to to get current cell location.

  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Checks if the internet connection is available 1 TTPs 1 IoCs
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • io.dushu.fandengreader
    1⤵
    • Checks if the Android device is rooted.
    • Requests cell location
    • Checks CPU information
    • Queries information about running processes on the device
    • Queries information about the current Wi-Fi connection
    • Queries information about the current nearby Wi-Fi networks
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5235

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/io.dushu.fandengreader/app_crashrecord/1004
    Filesize

    232B

    MD5

    384d9b355c36e3c1cc9ff09fed98bf83

    SHA1

    d099dc2d9a498ddcc73b353e63693b83f73e856e

    SHA256

    4d866b116a8c78d95dc3a37084c12e2ade2b479309ccf5f0c91727758dabc63f

    SHA512

    48eb87f8035dee34caae4341fddac12bcb3a2efa18d62997127ab32982a235c390557ee9fdd5405e77a9a794a349e7a3635bb5c45966ddfe14e2101c4932b0b2

  • /data/data/io.dushu.fandengreader/app_crashrecord/1004
    Filesize

    58B

    MD5

    0d210bfb2a0e1f1b4c082a6a0f79de07

    SHA1

    bb8ed9e364db79d1d9f2fcde3f15091893222faa

    SHA256

    988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d

    SHA512

    536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1

  • /data/data/io.dushu.fandengreader/databases/MessageStore.db
    Filesize

    36KB

    MD5

    15669eb47bb19111cb64fa7508b227d7

    SHA1

    c7585424afeb0fc7051697b771eb3d81e0e3aae3

    SHA256

    ecb0e8c93a782292a1dfe20a90e204d1c1c804e2773f1831c9ca34826aa62071

    SHA512

    13c2cb45912090ba0b670b36050eab5954e22d57b79e141d2236035dc1ea2000960d93ebc544fc4dee48765335a3d52baeb5d31c8a40407224c624fffebbc11b

  • /data/data/io.dushu.fandengreader/databases/MessageStore.db-journal
    Filesize

    512B

    MD5

    e31bb7adb90257133771745036bd3f65

    SHA1

    238054d2c4e53802a79b4d252ef6f9c9da7190e2

    SHA256

    1f049a31ecb19435096c7bfdfa8da7e55f2a196fa4dcf82b538921336527d191

    SHA512

    2b0ebf969a17b006f44edb9ba5c9f66102667d7dd68d0e1b8b0ed9f656edfe036e586ca9c83baadc93147cea1027cb137a33a18e0b8d1ebf47e44f703bdbda3c

  • /data/data/io.dushu.fandengreader/databases/MessageStore.db-journal
    Filesize

    8KB

    MD5

    e440bada4cfc4eb4a94b397ef376bfdd

    SHA1

    3ba3a5fda01563624c7148d8bc1827ce2b5571b4

    SHA256

    08e319a3a025fe38c3017f89e3545488e6c08a9f068f90216c9ab4da76684a9a

    SHA512

    b87b98e28f7634e472d054d940a5ab45737ae933fbea91ea9858c1eeb27536a0da400a4b5c2545595e889bc5f9d4dde43cc8c83f727e673dbc5c248b6501a746

  • /data/data/io.dushu.fandengreader/databases/MessageStore.db-journal
    Filesize

    8KB

    MD5

    3606876ea351100eade909fae770e1cd

    SHA1

    a7ce30ed52fb431b042fcd3339dad647384d54ef

    SHA256

    e3dc3bc95e0002745a85e63f32a2287d8751480f4c687af5f9bbf9a9944dcfbd

    SHA512

    08d6bb24e03a089cea0c005e0c80eb5567b5026abf51987470fcdae8d98eb24ba63f84482cda540d43f31267c38b81df0aa3babeb51d00cfcb7994e0cf407548

  • /data/data/io.dushu.fandengreader/databases/MsgLogStore.db
    Filesize

    56KB

    MD5

    9cec591e3ef91ae568f4cb6e7c2a8745

    SHA1

    ccf756b6b465ad9ad7ff6bfbeb4e8345ba3f6ff7

    SHA256

    05be88f05e9bfd4d6496caab584a704e7956fb87036529a0c8028f1e2bda309c

    SHA512

    f824b3268338787275c184bb740d152d53c1d8e57a044f587530735ef04d021a2671cc2aebb17ae3b497a0ad171060da484a565bfa62d32ed334ae5ffb538f51

  • /data/data/io.dushu.fandengreader/databases/MsgLogStore.db-journal
    Filesize

    512B

    MD5

    e7cf065d5845092cc0a98c9cba87c801

    SHA1

    9f90b6ce15260d5714f8864c4901e50767be396f

    SHA256

    c3682f6c32f3a0e8475109c367a5af044c94e0f4230049843a032613337c5a89

    SHA512

    b33ff63b5e085d87113b0efc2e3fcbddd2bf5d67c33bbad878c5b81c9a204e6de858cb2dd448ce95b57de990444e5b306bd37e872ba4de5354af629ed4efe132

  • /data/data/io.dushu.fandengreader/databases/MsgLogStore.db-journal
    Filesize

    8KB

    MD5

    d532f876a4100446a2b5d01a089c8e9b

    SHA1

    7ac08a1a718d672b05b6066f989c423f4954598c

    SHA256

    edb34f3f242b372355a11ce9cfb8dc97b8f7c27463641937af8f01aa7b108a90

    SHA512

    f0399d0c188842f371ffc2818f0d3684ee24adcb6cb886e83872b17572a040a375f35c8e9597c1cc0840011a3aa9e6293e49c45907ab65880eceb282e77d6c58

  • /data/data/io.dushu.fandengreader/databases/MsgLogStore.db-journal
    Filesize

    8KB

    MD5

    8a8a8a02ec6df3c533a763b197bd206b

    SHA1

    4a639f12673810ec26f2c44fc78037bcbd7c69d9

    SHA256

    798a47b9af110063bb05635dae1088870a4f3f4f1e07109a4e326d06172988dd

    SHA512

    d52a6b38ed564fae108456d7109cf19af119f4446e8dd2f9edad642e07e8bf45940a866e0fd4d205917ae34ff4dd9737492edb3a2bb7c76d8855c9fe950c3ac6

  • /data/data/io.dushu.fandengreader/databases/accs.db
    Filesize

    12KB

    MD5

    ea628e04765adaf4238a5dcdff4bbd51

    SHA1

    a801947619ea8c368efe9c006a324dc6339ac60b

    SHA256

    885e337c2156e4dbf2176a9677ade50418740532d222ccae5ad4aa371b54c6a4

    SHA512

    c0287b0e7b690a7231a37d1745c49f3d861b22aa65dd769ba6a8b5ab9da55443f749957781ee05a405019c39e1be45d37a971b821bffd62a1d5620bc39119abe

  • /data/data/io.dushu.fandengreader/databases/accs.db-journal
    Filesize

    512B

    MD5

    a697389f007b9aac502ba581e3132737

    SHA1

    4226a330624ba7b6ece9b8c0f00d29e9341516cc

    SHA256

    98aa9743cee5039dfab0841950609686741a4328c0c768a4e7c23e820a75526d

    SHA512

    a911aee69ca171f4923a054453cb790d971df3ed7540e6da815df5d02a14bd741e4eea168a45ad2f6677432e817671537ca0d7d30b11650725640edcb4d83df8

  • /data/data/io.dushu.fandengreader/databases/accs.db-journal
    Filesize

    8KB

    MD5

    86f5eb4f18ea118209ab7bdea645e560

    SHA1

    ba398c75656b6c2944b2a6f9a479940af8895e04

    SHA256

    f3430ae7b866f705e668505848e8d8322f01dcc731415ca12e44f6e6cf48a752

    SHA512

    0df1864e199f48227a5015411e866aab2fd9a12d176fd279c83e52e8305f97b96715db2831e839958d9f1d6c11f7b04b4135388855e62c12b1805244d4146f64

  • /data/data/io.dushu.fandengreader/databases/bugly_db_
    Filesize

    52KB

    MD5

    0cc4ef56f1a62f9a65ef7f2c121f6da2

    SHA1

    830fea9b323e5821dd88bc968b2200f66ebfa593

    SHA256

    f9b2964fc10d570423243e9b3599b52e68efc4687b5de7110fa395c274554981

    SHA512

    3ca4db83a0893ca0b69795dee6ac1e6170783dd7b363a9e762a63c632f8f5de18d2b12d507bf79b4f406ef0b23fb161dd8697889bbacce9c94506df52f50ec4c

  • /data/data/io.dushu.fandengreader/databases/bugly_db_-journal
    Filesize

    512B

    MD5

    1b0885306927dc9de404ad13d6689453

    SHA1

    9ce14b6a2439b2a7f08f31f4159114bbe4582276

    SHA256

    0d91f8bbdb342fbac554a8372e3e3d3cdceb6c5ce9da06045bfe2bbed22358ac

    SHA512

    f28210c948e1bd44209fc031f9c80ae67f2fde1c06a892bca22c88eeb838917e5802b0bd4a83f89d15bc0054d1202a3ba4b93e03e8409b73b6b97e1b3a04b326

  • /data/data/io.dushu.fandengreader/databases/bugly_db_-journal
    Filesize

    8KB

    MD5

    6ee244bfc0d1bb08e9069dc085bb5446

    SHA1

    3fbbc0a0070b6ccd041199c7ceb5c6033456832a

    SHA256

    41d2256525467741a027ef27403937b4160522da04b11a40d82dcc3ef10649c7

    SHA512

    dbf3288e821ea4278384435ea3921dd70550c50b045ecc42e327fd5c7ed96bd4ea04982ffe14166729256aaddb654322651e3e03e096dc7e1e84a4a8f1da9468

  • /data/data/io.dushu.fandengreader/databases/bugly_db_-journal
    Filesize

    8KB

    MD5

    1ece23db7b4328cecb70013449a1b07f

    SHA1

    45ac04c56641824bc88a5acc6bf2a71bf44ba0a1

    SHA256

    2f2235d7ad24abde7e7a283029625da66f24f4ca2001dcd17b9f015baad36eac

    SHA512

    e561de11a58fb646049cea691c0c996b7f809f8b811ddcd1c02cf8523212cd3ad42eee88367fadfa041fe8f40818fd78cb9a4e8940e1795fa065b7e6ca69f6d9

  • /data/data/io.dushu.fandengreader/databases/dushu-db
    Filesize

    316KB

    MD5

    9a4a87d4b791dba6a700fd3dd4c17b2f

    SHA1

    3685b6b29f1d1a8bc9b1febfc359784e0d1ae8ba

    SHA256

    c4963d062eef0a1fb151d997d1407d82f652ad2f9310363fef45574e70816e94

    SHA512

    efa96b2bcd1f17a6804689851d9c9692cb5fe2cafb9c99fffceeafe1800329ec5cd2d040e62c50a51623df631c2d62479b96853730173f101f26aa62eddb0048

  • /data/data/io.dushu.fandengreader/databases/dushu-db-journal
    Filesize

    512B

    MD5

    e9a4619990fb46f88358d1c1c695296e

    SHA1

    04b1e7d4c1f620c2b6137f8c010f215ca9ea8a70

    SHA256

    68692a2808770df0bde8f06aaf07f2a8ff9b0f3ae93bf4899a93d78234773265

    SHA512

    fd8d488da623f4381e7f7d4a171dec189a950d7cd063300d629849907709ae08af1c867d9283721cdb172bd07f5a05d8ef45dbaa232c66f403807fb7e6bca93d

  • /data/data/io.dushu.fandengreader/databases/dushu-db-journal
    Filesize

    8KB

    MD5

    d2653768a79c6d62d22f6cfc31baa01d

    SHA1

    eb2cb83b0a3cddcd7d2e6512c6699e0a9d242cb4

    SHA256

    6944990819b06809aace190ec7fb52133dade3cb75dbc32801e69fc5513921fa

    SHA512

    80dd247dbdcced73e9f8be3ce2cbcc838299aebc00cda47ee2a51742053c4013cd7f5c0509a9cfd34944e78660775fff31a38223fe1686d18d786cedf90ebbb6

  • /data/data/io.dushu.fandengreader/databases/dushu-db-journal
    Filesize

    8KB

    MD5

    6565d382dbb9aa9ca713abd69ee76eb5

    SHA1

    fc202fb71319ce9d8d91679bb0aa911c3125d470

    SHA256

    7db787cbca8ea24009f78d4455ca38c1026a76d8ceb33a8e45d67ed88771cf3f

    SHA512

    ad843f102bb4cb794f84370f111fd18434a64175e8630b753924beb88602973f02409bf88d80e3850d44cdf1c66c990457ae3fc7ac77b8c4ba14924e528fe440

  • /data/data/io.dushu.fandengreader/databases/dushu-db-journal
    Filesize

    16KB

    MD5

    540e40d851b411699506f406dbf2ba7c

    SHA1

    119ee11546600b79bf84b1447da9ed43e785f61a

    SHA256

    37f3ea92814ba1d680de8e940fca48a7274dcd55083467266d4e17ebffbedee5

    SHA512

    c53519e96d7ef49cd2c9605214129fe9855b95a6489f31ac2ed5d3ed43a2251e693e35410e73a63f4224b3bdd73753e3713494d636bb5f6cfbe302a76c3c4689

  • /data/data/io.dushu.fandengreader/databases/dushu-db-journal
    Filesize

    16KB

    MD5

    53b79e62b4687652fb5350a3d7712fd7

    SHA1

    20f50a1a47dcf3566c129e02655f14ad6b4097ec

    SHA256

    6f3b0e5aea1b0894bd4797242d0850380e34d7bbbc71818e3f5c6c1e676ddf29

    SHA512

    ba77144b67637e1936e9d3f3c4ad0154ab64872d8b993460ef74e0690cb09eebc44d59e030c98d439ab269bab0000e54a0d29e8d6623342254d81cf4eb7577cf

  • /data/data/io.dushu.fandengreader/databases/fandeng.ubt.db
    Filesize

    28KB

    MD5

    f303fe818c3ab06ec0eea9f84420f50b

    SHA1

    201b495c2c20b6fc2edc168db7ac3d57dda3dd9a

    SHA256

    c02280089d8d11dc21a0814f9f8d4fca8ec07ed2aff14d35b3207514d94094b1

    SHA512

    f8b6201a36294737e355936f45c7f54123c944aab1c7aaaeccc08c0acc79681a6840d7f7e762ef9605f0d6b12ef680935e3275be2ffcb61f320ec25470616330

  • /data/data/io.dushu.fandengreader/databases/fandeng.ubt.db-journal
    Filesize

    512B

    MD5

    682a93d4b01707f67131c754ff44be52

    SHA1

    54d45cfd1972b7b827adee91fa73725b780480c4

    SHA256

    0f3f004bc70a0b7680d327a43aff225b8eed89f40209ff1f0a740916a36cb69e

    SHA512

    e435ec1b5e69a7c32c938b0b3d7b39d34e284c3859c0859f59f6ca92b7b6fa54981ad4ba04180825c6094844f87552f271e85e14a5fa612af44887528b6a1456

  • /data/data/io.dushu.fandengreader/databases/fandeng.ubt.db-journal
    Filesize

    8KB

    MD5

    13358e5270c912ab34e61978ac3e3e7e

    SHA1

    e039b422639f7c732caeeb1cb01e0b62393c04a9

    SHA256

    bb61da9ef3eb60886bbdf6b11d204a7c00754ac250e6ec49cd9caae4f05cbf8e

    SHA512

    372d56ce5165f29a4d96a3ad9a223340cc518b99fd471894a187ef87588fbe1a900884c841ebfe8627ef13cc5ba0de0044eb72bc7189aff13b4be6b3b07755f2

  • /data/data/io.dushu.fandengreader/databases/fandeng.ubt.db-journal
    Filesize

    8KB

    MD5

    e58c60c468b189a7711fbc3212287663

    SHA1

    245b0866b3dd2459cf49885c952a313350435de5

    SHA256

    fbba11f4c59a44330627d45f92db49821bbcba658255e87cda424b674a68e61a

    SHA512

    94480a86640653a9b55f9b60beedec8444494c01bfeffd80d7f4e42814d9b1c32492980e1bf64142b39a030a420049b81fc8803911c57a5b1423e20a3c88f026

  • /storage/emulated/0/.DataStorage/ContextData.xml
    Filesize

    111B

    MD5

    0fd56fce0e43c772b470c8c4e86d09ba

    SHA1

    1405fc8d0ddc82ae9e9ac7bf53b5544ccf956fd5

    SHA256

    aa26b897a10093eaf238aa721d977299f914b9e29dcf9eaca0686e6e1a578338

    SHA512

    335a3b50f0791626be948022a02124fef1e963abe1929e1bdc2728100bf18e24fdd939d8b65347d6a93a656b75b9a216fd1edb62a2921073092fd29a07b9268a

  • /storage/emulated/0/.DataStorage/ContextData.xml
    Filesize

    213B

    MD5

    f15415de9121385b72a200107674019e

    SHA1

    21cae5b42d08a185f6a6a21975f2f968cda78a1d

    SHA256

    ae3e176c167b1cf4b91d7f57ad8b4d95e83639381f64b7c1a9bf8586b0b2fe7b

    SHA512

    2d8b584b6923ca19e9546b809640b8f8f7307d298832c6971657b106f61a8868bbb8ab1f905e5a7fb6bb18ba9e3befa7c9c49e725a1ffe9aee6b8d0077440936

  • /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
    Filesize

    65B

    MD5

    9781ca003f10f8d0c9c1945b63fdca7f

    SHA1

    4156cf5dc8d71dbab734d25e5e1598b37a5456f4

    SHA256

    3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793

    SHA512

    25a9877e274e0e9df29811825bd4f680fa0bf0ae6219527e4f1dcd17d0995d28b2926192d961a06ee5bef2eed73b3f38ec4ffdd0a1cda7ff2a10dc5711ffdf03

  • /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
    Filesize

    111B

    MD5

    3b1ef4489457375b51e156a45a88c148

    SHA1

    59128de4c40b8eec3c6c1979f4de4e7f09666369

    SHA256

    0a09cdbb79752a7fedd83e6abf4a808eae23f6e0881479157f70170b7569d618

    SHA512

    dd06dd9c7eba606bb63a00f5121ae560489904053b1af8cd3a0ea70ee86b9c84eb184d0d5689d9c2a1aae0c1136531bc6c68fd764a528410f9680cfd04e04f93

  • /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
    Filesize

    167B

    MD5

    3825e9f3f705c9fed9adc3abfc197159

    SHA1

    f858fc02ca2fbf85fa76ec3703151a4d2b9da77f

    SHA256

    7f606e82d4991cff71e2bef3d14101a8e8716ab420a006ee6a8f700dce1ee982

    SHA512

    dccdf1c64c5e18103b96e7c80b948106511e9b0ae8255f7ce1cc591ad910f6799af70716b1ca841cdff906377d7c06d2b529170244ad9c793fa07af589394852

  • /storage/emulated/0/Android/data/io.dushu.fandengreader/files/tbslog/tbslog.txt
    Filesize

    1KB

    MD5

    4bc40be417eca5eaf570c8c3778e5d70

    SHA1

    772758de1d4eda957e2b4f6078550c4d67a92e7e

    SHA256

    b26577e4c1c80b494b8ed7aede4d3ab65ef97797f0454be60be1761e9fc59a9e

    SHA512

    0e2d1369e83448369eff6296f8a88c4c38e05996968283cfbac34919e1e3cd0a6e90cde7c1569f3dec171114c7056dc4078c6c7c359e16e5acbdd369e891bf37