Analysis
-
max time kernel
13s -
max time network
190s -
platform
android_x64 -
resource
android-x64-20240514-en -
resource tags
androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system -
submitted
22-05-2024 13:05
Static task
static1
Behavioral task
behavioral1
Sample
675a0bfbd1e3eb249af20e918560bda8_JaffaCakes118.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral2
Sample
675a0bfbd1e3eb249af20e918560bda8_JaffaCakes118.apk
Resource
android-x64-20240514-en
General
-
Target
675a0bfbd1e3eb249af20e918560bda8_JaffaCakes118.apk
-
Size
27.2MB
-
MD5
675a0bfbd1e3eb249af20e918560bda8
-
SHA1
7898f2b765fafe48575bb33d190aac08b196a372
-
SHA256
6a52d3f3172cdf0f243c451959a50baf1c546012975b093f10ebc2f963c107f4
-
SHA512
d7d916ad5db13fa35f87fe36077e32bee2b7936c71aeb573240ad1903cb17499b2ddcd4b3e06dec53d0241eeac101a31d8b74391f514359874c7b9685c43d232
-
SSDEEP
786432:QdCyufQtAMXNk4+Xxj3tR7eLIyWCAerN12Du5juty:QdCZMXN7KxjdRZLef5jF
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 1 IoCs
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
Processes:
io.dushu.fandengreaderdescription ioc process Framework service call android.app.IActivityManager.getRunningAppProcesses io.dushu.fandengreader -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
Processes:
io.dushu.fandengreaderdescription ioc process Framework service call android.net.wifi.IWifiManager.getConnectionInfo io.dushu.fandengreader -
Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
Processes:
io.dushu.fandengreaderdescription ioc process Framework service call android.net.wifi.IWifiManager.getScanResults io.dushu.fandengreader -
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
io.dushu.fandengreaderdescription ioc process Framework service call android.app.IActivityManager.registerReceiver io.dushu.fandengreader -
Checks if the internet connection is available 1 TTPs 1 IoCs
Processes:
io.dushu.fandengreaderdescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo io.dushu.fandengreader -
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
Processes:
io.dushu.fandengreaderdescription ioc process Framework API call android.hardware.SensorManager.registerListener io.dushu.fandengreader -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes:
io.dushu.fandengreaderdescription ioc process Framework API call javax.crypto.Cipher.doFinal io.dushu.fandengreader
Processes
-
io.dushu.fandengreader1⤵
- Checks if the Android device is rooted.
- Requests cell location
- Checks CPU information
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries information about the current nearby Wi-Fi networks
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Listens for changes in the sensor environment (might be used to detect emulation)
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/io.dushu.fandengreader/app_crashrecord/1004Filesize
232B
MD5384d9b355c36e3c1cc9ff09fed98bf83
SHA1d099dc2d9a498ddcc73b353e63693b83f73e856e
SHA2564d866b116a8c78d95dc3a37084c12e2ade2b479309ccf5f0c91727758dabc63f
SHA51248eb87f8035dee34caae4341fddac12bcb3a2efa18d62997127ab32982a235c390557ee9fdd5405e77a9a794a349e7a3635bb5c45966ddfe14e2101c4932b0b2
-
/data/data/io.dushu.fandengreader/app_crashrecord/1004Filesize
58B
MD50d210bfb2a0e1f1b4c082a6a0f79de07
SHA1bb8ed9e364db79d1d9f2fcde3f15091893222faa
SHA256988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
SHA512536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1
-
/data/data/io.dushu.fandengreader/databases/MessageStore.dbFilesize
36KB
MD515669eb47bb19111cb64fa7508b227d7
SHA1c7585424afeb0fc7051697b771eb3d81e0e3aae3
SHA256ecb0e8c93a782292a1dfe20a90e204d1c1c804e2773f1831c9ca34826aa62071
SHA51213c2cb45912090ba0b670b36050eab5954e22d57b79e141d2236035dc1ea2000960d93ebc544fc4dee48765335a3d52baeb5d31c8a40407224c624fffebbc11b
-
/data/data/io.dushu.fandengreader/databases/MessageStore.db-journalFilesize
512B
MD5e31bb7adb90257133771745036bd3f65
SHA1238054d2c4e53802a79b4d252ef6f9c9da7190e2
SHA2561f049a31ecb19435096c7bfdfa8da7e55f2a196fa4dcf82b538921336527d191
SHA5122b0ebf969a17b006f44edb9ba5c9f66102667d7dd68d0e1b8b0ed9f656edfe036e586ca9c83baadc93147cea1027cb137a33a18e0b8d1ebf47e44f703bdbda3c
-
/data/data/io.dushu.fandengreader/databases/MessageStore.db-journalFilesize
8KB
MD5e440bada4cfc4eb4a94b397ef376bfdd
SHA13ba3a5fda01563624c7148d8bc1827ce2b5571b4
SHA25608e319a3a025fe38c3017f89e3545488e6c08a9f068f90216c9ab4da76684a9a
SHA512b87b98e28f7634e472d054d940a5ab45737ae933fbea91ea9858c1eeb27536a0da400a4b5c2545595e889bc5f9d4dde43cc8c83f727e673dbc5c248b6501a746
-
/data/data/io.dushu.fandengreader/databases/MessageStore.db-journalFilesize
8KB
MD53606876ea351100eade909fae770e1cd
SHA1a7ce30ed52fb431b042fcd3339dad647384d54ef
SHA256e3dc3bc95e0002745a85e63f32a2287d8751480f4c687af5f9bbf9a9944dcfbd
SHA51208d6bb24e03a089cea0c005e0c80eb5567b5026abf51987470fcdae8d98eb24ba63f84482cda540d43f31267c38b81df0aa3babeb51d00cfcb7994e0cf407548
-
/data/data/io.dushu.fandengreader/databases/MsgLogStore.dbFilesize
56KB
MD59cec591e3ef91ae568f4cb6e7c2a8745
SHA1ccf756b6b465ad9ad7ff6bfbeb4e8345ba3f6ff7
SHA25605be88f05e9bfd4d6496caab584a704e7956fb87036529a0c8028f1e2bda309c
SHA512f824b3268338787275c184bb740d152d53c1d8e57a044f587530735ef04d021a2671cc2aebb17ae3b497a0ad171060da484a565bfa62d32ed334ae5ffb538f51
-
/data/data/io.dushu.fandengreader/databases/MsgLogStore.db-journalFilesize
512B
MD5e7cf065d5845092cc0a98c9cba87c801
SHA19f90b6ce15260d5714f8864c4901e50767be396f
SHA256c3682f6c32f3a0e8475109c367a5af044c94e0f4230049843a032613337c5a89
SHA512b33ff63b5e085d87113b0efc2e3fcbddd2bf5d67c33bbad878c5b81c9a204e6de858cb2dd448ce95b57de990444e5b306bd37e872ba4de5354af629ed4efe132
-
/data/data/io.dushu.fandengreader/databases/MsgLogStore.db-journalFilesize
8KB
MD5d532f876a4100446a2b5d01a089c8e9b
SHA17ac08a1a718d672b05b6066f989c423f4954598c
SHA256edb34f3f242b372355a11ce9cfb8dc97b8f7c27463641937af8f01aa7b108a90
SHA512f0399d0c188842f371ffc2818f0d3684ee24adcb6cb886e83872b17572a040a375f35c8e9597c1cc0840011a3aa9e6293e49c45907ab65880eceb282e77d6c58
-
/data/data/io.dushu.fandengreader/databases/MsgLogStore.db-journalFilesize
8KB
MD58a8a8a02ec6df3c533a763b197bd206b
SHA14a639f12673810ec26f2c44fc78037bcbd7c69d9
SHA256798a47b9af110063bb05635dae1088870a4f3f4f1e07109a4e326d06172988dd
SHA512d52a6b38ed564fae108456d7109cf19af119f4446e8dd2f9edad642e07e8bf45940a866e0fd4d205917ae34ff4dd9737492edb3a2bb7c76d8855c9fe950c3ac6
-
/data/data/io.dushu.fandengreader/databases/accs.dbFilesize
12KB
MD5ea628e04765adaf4238a5dcdff4bbd51
SHA1a801947619ea8c368efe9c006a324dc6339ac60b
SHA256885e337c2156e4dbf2176a9677ade50418740532d222ccae5ad4aa371b54c6a4
SHA512c0287b0e7b690a7231a37d1745c49f3d861b22aa65dd769ba6a8b5ab9da55443f749957781ee05a405019c39e1be45d37a971b821bffd62a1d5620bc39119abe
-
/data/data/io.dushu.fandengreader/databases/accs.db-journalFilesize
512B
MD5a697389f007b9aac502ba581e3132737
SHA14226a330624ba7b6ece9b8c0f00d29e9341516cc
SHA25698aa9743cee5039dfab0841950609686741a4328c0c768a4e7c23e820a75526d
SHA512a911aee69ca171f4923a054453cb790d971df3ed7540e6da815df5d02a14bd741e4eea168a45ad2f6677432e817671537ca0d7d30b11650725640edcb4d83df8
-
/data/data/io.dushu.fandengreader/databases/accs.db-journalFilesize
8KB
MD586f5eb4f18ea118209ab7bdea645e560
SHA1ba398c75656b6c2944b2a6f9a479940af8895e04
SHA256f3430ae7b866f705e668505848e8d8322f01dcc731415ca12e44f6e6cf48a752
SHA5120df1864e199f48227a5015411e866aab2fd9a12d176fd279c83e52e8305f97b96715db2831e839958d9f1d6c11f7b04b4135388855e62c12b1805244d4146f64
-
/data/data/io.dushu.fandengreader/databases/bugly_db_Filesize
52KB
MD50cc4ef56f1a62f9a65ef7f2c121f6da2
SHA1830fea9b323e5821dd88bc968b2200f66ebfa593
SHA256f9b2964fc10d570423243e9b3599b52e68efc4687b5de7110fa395c274554981
SHA5123ca4db83a0893ca0b69795dee6ac1e6170783dd7b363a9e762a63c632f8f5de18d2b12d507bf79b4f406ef0b23fb161dd8697889bbacce9c94506df52f50ec4c
-
/data/data/io.dushu.fandengreader/databases/bugly_db_-journalFilesize
512B
MD51b0885306927dc9de404ad13d6689453
SHA19ce14b6a2439b2a7f08f31f4159114bbe4582276
SHA2560d91f8bbdb342fbac554a8372e3e3d3cdceb6c5ce9da06045bfe2bbed22358ac
SHA512f28210c948e1bd44209fc031f9c80ae67f2fde1c06a892bca22c88eeb838917e5802b0bd4a83f89d15bc0054d1202a3ba4b93e03e8409b73b6b97e1b3a04b326
-
/data/data/io.dushu.fandengreader/databases/bugly_db_-journalFilesize
8KB
MD56ee244bfc0d1bb08e9069dc085bb5446
SHA13fbbc0a0070b6ccd041199c7ceb5c6033456832a
SHA25641d2256525467741a027ef27403937b4160522da04b11a40d82dcc3ef10649c7
SHA512dbf3288e821ea4278384435ea3921dd70550c50b045ecc42e327fd5c7ed96bd4ea04982ffe14166729256aaddb654322651e3e03e096dc7e1e84a4a8f1da9468
-
/data/data/io.dushu.fandengreader/databases/bugly_db_-journalFilesize
8KB
MD51ece23db7b4328cecb70013449a1b07f
SHA145ac04c56641824bc88a5acc6bf2a71bf44ba0a1
SHA2562f2235d7ad24abde7e7a283029625da66f24f4ca2001dcd17b9f015baad36eac
SHA512e561de11a58fb646049cea691c0c996b7f809f8b811ddcd1c02cf8523212cd3ad42eee88367fadfa041fe8f40818fd78cb9a4e8940e1795fa065b7e6ca69f6d9
-
/data/data/io.dushu.fandengreader/databases/dushu-dbFilesize
316KB
MD59a4a87d4b791dba6a700fd3dd4c17b2f
SHA13685b6b29f1d1a8bc9b1febfc359784e0d1ae8ba
SHA256c4963d062eef0a1fb151d997d1407d82f652ad2f9310363fef45574e70816e94
SHA512efa96b2bcd1f17a6804689851d9c9692cb5fe2cafb9c99fffceeafe1800329ec5cd2d040e62c50a51623df631c2d62479b96853730173f101f26aa62eddb0048
-
/data/data/io.dushu.fandengreader/databases/dushu-db-journalFilesize
512B
MD5e9a4619990fb46f88358d1c1c695296e
SHA104b1e7d4c1f620c2b6137f8c010f215ca9ea8a70
SHA25668692a2808770df0bde8f06aaf07f2a8ff9b0f3ae93bf4899a93d78234773265
SHA512fd8d488da623f4381e7f7d4a171dec189a950d7cd063300d629849907709ae08af1c867d9283721cdb172bd07f5a05d8ef45dbaa232c66f403807fb7e6bca93d
-
/data/data/io.dushu.fandengreader/databases/dushu-db-journalFilesize
8KB
MD5d2653768a79c6d62d22f6cfc31baa01d
SHA1eb2cb83b0a3cddcd7d2e6512c6699e0a9d242cb4
SHA2566944990819b06809aace190ec7fb52133dade3cb75dbc32801e69fc5513921fa
SHA51280dd247dbdcced73e9f8be3ce2cbcc838299aebc00cda47ee2a51742053c4013cd7f5c0509a9cfd34944e78660775fff31a38223fe1686d18d786cedf90ebbb6
-
/data/data/io.dushu.fandengreader/databases/dushu-db-journalFilesize
8KB
MD56565d382dbb9aa9ca713abd69ee76eb5
SHA1fc202fb71319ce9d8d91679bb0aa911c3125d470
SHA2567db787cbca8ea24009f78d4455ca38c1026a76d8ceb33a8e45d67ed88771cf3f
SHA512ad843f102bb4cb794f84370f111fd18434a64175e8630b753924beb88602973f02409bf88d80e3850d44cdf1c66c990457ae3fc7ac77b8c4ba14924e528fe440
-
/data/data/io.dushu.fandengreader/databases/dushu-db-journalFilesize
16KB
MD5540e40d851b411699506f406dbf2ba7c
SHA1119ee11546600b79bf84b1447da9ed43e785f61a
SHA25637f3ea92814ba1d680de8e940fca48a7274dcd55083467266d4e17ebffbedee5
SHA512c53519e96d7ef49cd2c9605214129fe9855b95a6489f31ac2ed5d3ed43a2251e693e35410e73a63f4224b3bdd73753e3713494d636bb5f6cfbe302a76c3c4689
-
/data/data/io.dushu.fandengreader/databases/dushu-db-journalFilesize
16KB
MD553b79e62b4687652fb5350a3d7712fd7
SHA120f50a1a47dcf3566c129e02655f14ad6b4097ec
SHA2566f3b0e5aea1b0894bd4797242d0850380e34d7bbbc71818e3f5c6c1e676ddf29
SHA512ba77144b67637e1936e9d3f3c4ad0154ab64872d8b993460ef74e0690cb09eebc44d59e030c98d439ab269bab0000e54a0d29e8d6623342254d81cf4eb7577cf
-
/data/data/io.dushu.fandengreader/databases/fandeng.ubt.dbFilesize
28KB
MD5f303fe818c3ab06ec0eea9f84420f50b
SHA1201b495c2c20b6fc2edc168db7ac3d57dda3dd9a
SHA256c02280089d8d11dc21a0814f9f8d4fca8ec07ed2aff14d35b3207514d94094b1
SHA512f8b6201a36294737e355936f45c7f54123c944aab1c7aaaeccc08c0acc79681a6840d7f7e762ef9605f0d6b12ef680935e3275be2ffcb61f320ec25470616330
-
/data/data/io.dushu.fandengreader/databases/fandeng.ubt.db-journalFilesize
512B
MD5682a93d4b01707f67131c754ff44be52
SHA154d45cfd1972b7b827adee91fa73725b780480c4
SHA2560f3f004bc70a0b7680d327a43aff225b8eed89f40209ff1f0a740916a36cb69e
SHA512e435ec1b5e69a7c32c938b0b3d7b39d34e284c3859c0859f59f6ca92b7b6fa54981ad4ba04180825c6094844f87552f271e85e14a5fa612af44887528b6a1456
-
/data/data/io.dushu.fandengreader/databases/fandeng.ubt.db-journalFilesize
8KB
MD513358e5270c912ab34e61978ac3e3e7e
SHA1e039b422639f7c732caeeb1cb01e0b62393c04a9
SHA256bb61da9ef3eb60886bbdf6b11d204a7c00754ac250e6ec49cd9caae4f05cbf8e
SHA512372d56ce5165f29a4d96a3ad9a223340cc518b99fd471894a187ef87588fbe1a900884c841ebfe8627ef13cc5ba0de0044eb72bc7189aff13b4be6b3b07755f2
-
/data/data/io.dushu.fandengreader/databases/fandeng.ubt.db-journalFilesize
8KB
MD5e58c60c468b189a7711fbc3212287663
SHA1245b0866b3dd2459cf49885c952a313350435de5
SHA256fbba11f4c59a44330627d45f92db49821bbcba658255e87cda424b674a68e61a
SHA51294480a86640653a9b55f9b60beedec8444494c01bfeffd80d7f4e42814d9b1c32492980e1bf64142b39a030a420049b81fc8803911c57a5b1423e20a3c88f026
-
/storage/emulated/0/.DataStorage/ContextData.xmlFilesize
111B
MD50fd56fce0e43c772b470c8c4e86d09ba
SHA11405fc8d0ddc82ae9e9ac7bf53b5544ccf956fd5
SHA256aa26b897a10093eaf238aa721d977299f914b9e29dcf9eaca0686e6e1a578338
SHA512335a3b50f0791626be948022a02124fef1e963abe1929e1bdc2728100bf18e24fdd939d8b65347d6a93a656b75b9a216fd1edb62a2921073092fd29a07b9268a
-
/storage/emulated/0/.DataStorage/ContextData.xmlFilesize
213B
MD5f15415de9121385b72a200107674019e
SHA121cae5b42d08a185f6a6a21975f2f968cda78a1d
SHA256ae3e176c167b1cf4b91d7f57ad8b4d95e83639381f64b7c1a9bf8586b0b2fe7b
SHA5122d8b584b6923ca19e9546b809640b8f8f7307d298832c6971657b106f61a8868bbb8ab1f905e5a7fb6bb18ba9e3befa7c9c49e725a1ffe9aee6b8d0077440936
-
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xmlFilesize
65B
MD59781ca003f10f8d0c9c1945b63fdca7f
SHA14156cf5dc8d71dbab734d25e5e1598b37a5456f4
SHA2563325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793
SHA51225a9877e274e0e9df29811825bd4f680fa0bf0ae6219527e4f1dcd17d0995d28b2926192d961a06ee5bef2eed73b3f38ec4ffdd0a1cda7ff2a10dc5711ffdf03
-
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xmlFilesize
111B
MD53b1ef4489457375b51e156a45a88c148
SHA159128de4c40b8eec3c6c1979f4de4e7f09666369
SHA2560a09cdbb79752a7fedd83e6abf4a808eae23f6e0881479157f70170b7569d618
SHA512dd06dd9c7eba606bb63a00f5121ae560489904053b1af8cd3a0ea70ee86b9c84eb184d0d5689d9c2a1aae0c1136531bc6c68fd764a528410f9680cfd04e04f93
-
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xmlFilesize
167B
MD53825e9f3f705c9fed9adc3abfc197159
SHA1f858fc02ca2fbf85fa76ec3703151a4d2b9da77f
SHA2567f606e82d4991cff71e2bef3d14101a8e8716ab420a006ee6a8f700dce1ee982
SHA512dccdf1c64c5e18103b96e7c80b948106511e9b0ae8255f7ce1cc591ad910f6799af70716b1ca841cdff906377d7c06d2b529170244ad9c793fa07af589394852
-
/storage/emulated/0/Android/data/io.dushu.fandengreader/files/tbslog/tbslog.txtFilesize
1KB
MD54bc40be417eca5eaf570c8c3778e5d70
SHA1772758de1d4eda957e2b4f6078550c4d67a92e7e
SHA256b26577e4c1c80b494b8ed7aede4d3ab65ef97797f0454be60be1761e9fc59a9e
SHA5120e2d1369e83448369eff6296f8a88c4c38e05996968283cfbac34919e1e3cd0a6e90cde7c1569f3dec171114c7056dc4078c6c7c359e16e5acbdd369e891bf37