c35c7507fbd5e9db6805a7edbfaa59c3e999be2d0f43db90d1f37de7d2ce42d1

Analysis

max time kernel
105s
max time network
177s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
22-05-2024 14:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

679beffb869959c5a7cd1c7999975360_JaffaCakes118.apk
Size

3.9MB
MD5

679beffb869959c5a7cd1c7999975360
SHA1

ac787eb55b7fab6be973081562361ee84c994c75
SHA256

c35c7507fbd5e9db6805a7edbfaa59c3e999be2d0f43db90d1f37de7d2ce42d1
SHA512

28ac8ab81f797cedfd003cdbfc9c756deea98e04cdc42fe97751670ba1eb9e5e484c6736b97585ddbce011e777c2517441176f9b539e74e43dbd6589f346ead9
SSDEEP

98304:arOWdCBdRVXMm8ZgQ0kyPraOiaT7qVcf0nZq+PN2uwDv:arTdCBpz8ZYkiBiY7qVcsnZl7wz

Score

8^/10

discovery evasion impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs
evasion

T1426

Processes:

io.virtualapp.luohe/system/bin/sh -c type su

ioc process

/system/app/Superuser.apk io.virtualapp.luohe
/sbin/su /system/bin/sh -c type su
Checks memory information 2 TTPs 2 IoCs
Checks memory information which indicate if the system is an emulator.
evasion discovery

T1633.001

T1426

Processes:

io.virtualapp.luoheio.virtualapp.luohe:x

description ioc process

File opened for read /proc/meminfo io.virtualapp.luohe
File opened for read /proc/meminfo io.virtualapp.luohe:x

ioc	process
/system/app/Superuser.apk	io.virtualapp.luohe
/sbin/su	/system/bin/sh -c type su

description	ioc	process
File opened for read	/proc/meminfo	io.virtualapp.luohe
File opened for read	/proc/meminfo	io.virtualapp.luohe:x

Loads dropped Dex/Jar 1 TTPs 5 IoCs

Runs executable file dropped to the device during analysis.

evasion

T1407

Processes:

io.virtualapp.luohe/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/io.virtualapp.luohe/mix.dex --output-vdex-fd=49 --oat-fd=53 --oat-location=/data/data/io.virtualapp.luohe/oat/x86/mix.odex --compiler-filter=quicken --class-loader-context=&io.virtualapp.luohe:x

ioc	pid	process
/data/data/io.virtualapp.luohe/mix.dex	4270	io.virtualapp.luohe
/data/data/io.virtualapp.luohe/mix.dex	4354	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/io.virtualapp.luohe/mix.dex --output-vdex-fd=49 --oat-fd=53 --oat-location=/data/data/io.virtualapp.luohe/oat/x86/mix.odex --compiler-filter=quicken --class-loader-context=&
/data/data/io.virtualapp.luohe/mix.dex	4270	io.virtualapp.luohe
/data/data/io.virtualapp.luohe/mix.dex	4421	io.virtualapp.luohe:x
/data/data/io.virtualapp.luohe/mix.dex	4421	io.virtualapp.luohe:x

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs
Application may abuse the framework's foreground service to continue running in the foreground.
evasion persistence

T1541

Processes:

io.virtualapp.luohe:x

description ioc process

Framework service call android.app.IActivityManager.setServiceForeground io.virtualapp.luohe:x
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

T1424

Processes:

io.virtualapp.luohe

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses io.virtualapp.luohe
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

T1421

Processes:

io.virtualapp.luohe

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo io.virtualapp.luohe

description	ioc	process
Framework service call	android.app.IActivityManager.setServiceForeground	io.virtualapp.luohe:x

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	io.virtualapp.luohe

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	io.virtualapp.luohe

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs

persistence

T1624.001

Processes:

io.virtualapp.luoheio.virtualapp.luohe:x

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	io.virtualapp.luohe
Framework service call	android.app.IActivityManager.registerReceiver	io.virtualapp.luohe:x

Checks if the internet connection is available 1 TTPs 2 IoCs

discovery

T1421

Processes:

io.virtualapp.luoheio.virtualapp.luohe:x

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	io.virtualapp.luohe
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	io.virtualapp.luohe:x

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

T1471

Processes:

io.virtualapp.luohe

description ioc process

Framework API call javax.crypto.Cipher.doFinal io.virtualapp.luohe

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	io.virtualapp.luohe

io.virtualapp.luohe
1⤵
- Checks if the Android device is rooted.
- Checks memory information
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4270

/system/bin/sh -c getprop ro.board.platform
2⤵
PID:4302

sh -c getprop ro.yunos.version
2⤵
PID:4322

getprop ro.yunos.version
2⤵
PID:4322

getprop ro.board.platform
2⤵
PID:4302

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/io.virtualapp.luohe/mix.dex --output-vdex-fd=49 --oat-fd=53 --oat-location=/data/data/io.virtualapp.luohe/oat/x86/mix.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:4354

/system/bin/sh -c type su
2⤵
- Checks if the Android device is rooted.
PID:4371

logcat -d -v threadtime
2⤵
PID:4566

/system/bin/sh -c getprop ro.miui.ui.version.name
2⤵
PID:4586

getprop ro.miui.ui.version.name
2⤵
PID:4586

/system/bin/sh -c getprop ro.build.version.emui
2⤵
PID:4612

getprop ro.build.version.emui
2⤵
PID:4612

/system/bin/sh -c getprop ro.lenovo.series
2⤵
PID:4639

getprop ro.lenovo.series
2⤵
PID:4639

/system/bin/sh -c getprop ro.build.nubia.rom.name
2⤵
PID:4719

getprop ro.build.nubia.rom.name
2⤵
PID:4719

/system/bin/sh -c getprop ro.meizu.product.model
2⤵
PID:4796

getprop ro.meizu.product.model
2⤵
PID:4796

/system/bin/sh -c getprop ro.build.version.opporom
2⤵
PID:4822

getprop ro.build.version.opporom
2⤵
PID:4822

/system/bin/sh -c getprop ro.vivo.os.build.display.id
2⤵
PID:4847

getprop ro.vivo.os.build.display.id
2⤵
PID:4847

/system/bin/sh -c getprop ro.aa.romver
2⤵
PID:4872

getprop ro.aa.romver
2⤵
PID:4872

/system/bin/sh -c getprop ro.lewa.version
2⤵
PID:4897

getprop ro.lewa.version
2⤵
PID:4897

/system/bin/sh -c getprop ro.gn.gnromvernumber
2⤵
PID:4921

getprop ro.gn.gnromvernumber
2⤵
PID:4921

/system/bin/sh -c getprop ro.build.tyd.kbstyle_version
2⤵
PID:4950

getprop ro.build.tyd.kbstyle_version
2⤵
PID:4950

/system/bin/sh -c getprop ro.build.fingerprint
2⤵
PID:4975

getprop ro.build.fingerprint
2⤵
PID:4975

/system/bin/sh -c getprop ro.build.rom.id
2⤵
PID:5000

getprop ro.build.rom.id
2⤵
PID:5000

io.virtualapp.luohe:x
1⤵
- Checks memory information
- Loads dropped Dex/Jar
- Makes use of the framework's foreground persistence service
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:4421

sh -c getprop ro.yunos.version
2⤵
PID:4475

getprop ro.yunos.version
2⤵
PID:4475

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/io.virtualapp.luohe/databases/bugly_db_legu
Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/io.virtualapp.luohe/databases/bugly_db_legu-journal
Filesize
120KB

MD5
4951aa63f6ae7faf60cd9a3410a20d13

SHA1
f379331caf6c5306b7da199e968aa09bc11a441d

SHA256
d6d88fabac19f50a283ccd2b205c0a9fe5197c3118ac72b3c5f14494a98d2b93

SHA512
21698f182f0baa95be93b8bf51fca0d0265f6b45717a3cd121e89a58de8ece1fe090412dc30e71bb5ca827c5c9e331fd8b1ea6bd00609da42844b65457c6f9fc

Download Submit
/data/data/io.virtualapp.luohe/databases/bugly_db_legu-shm
Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/io.virtualapp.luohe/databases/bugly_db_legu-wal
Filesize
193KB

MD5
a6ea04386505d209f0a14785d23063da

SHA1
f340a944e9e653b9c9e798681426af9212b938e5

SHA256
d13fbee9b163d669cd9efb4ef12a25e6551dd9e0fb0d32fffb8d1624d7879e27

SHA512
fd953e83a49d154b44fa9c6ddc64e40b35cd64bf19742f6c498ba0404fd6967682fd3acee08ecf75b3e8143397b7ac0b7b7fd1e36b2cfa92c3e8f3d659ab2a5e

Download Submit
/data/data/io.virtualapp.luohe/mix.dex
Filesize
292B

MD5
95e1b139e47487e78f46f36eb46aa0e1

SHA1
088454602621c175c4ececa42b21f51c26efe624

SHA256
9924e6cae74ada5e5c352dc0ac84a9722525f9503db09030496474673cec5f1b

SHA512
ec37dfb33e2da15a28bb2b2eb34541f8f8b11f5023ac5d6ec5d8c088e5cc5b39bf865d1ccbf818b0d5f1cf6df24de33cc8f1861f111b3f7f7d933e871fc0cc79

Download Submit
/data/data/io.virtualapp.luohe/mix.dex
Filesize
292B

MD5
63f77f99bd2c2b772a479923bde11974

SHA1
c7632e7d301e4463fafce85f84e9c3d7da3fdbbe

SHA256
4c76a3af64cdd2f8713ffe2733dea50dbe714d0ca41c17d1847ee5b62a7ca615

SHA512
3aae4a89d1ed51fdd911cb367eb10afe3c2264e4222085891b18a60d5412f85d10bf5c8f3c6642db70abb9aa42732bac5c42c42ee32d587100f53c21b5beb16c

Download Submit
/data/data/io.virtualapp.luohe/virtual/data/app/system/app-setting.ini
Filesize
72B

MD5
82e69c3b296acc06179f03444401066b

SHA1
3789845a88c5016785c4a0683a850265d4b2c471

SHA256
5aaeb00645c3ec6ce54352f009ce1a5d404b01063ac5cf1559d6097e3b25ce79

SHA512
b7d55784df61d0b7365efcc9513f2eedd2a2fdf11a1032a026a6b0debe6544132c5e28458bd96babb64dac5c63a4ca86205983c14a329bc6234bed650f31b8ea

Download Submit
/data/data/io.virtualapp.luohe/virtual/data/app/system/app-setting.ini
Filesize
124B

MD5
88688dcd411eede89da5f888948f223b

SHA1
a34c9728c9756e22cdb5418c22ebfeebef85cd60

SHA256
ab102be8e830042131c1e17d398fff214d68b5a52f659f76cfcda72b23d3c116

SHA512
bd1707b601f8e3453b370a2fc3e057d4d6a0c6a70a5f3dc35ebd16e4ce9f5a5883ebe522bd6a0823d1bc74c7817ce5ba498bcae2ff714f6f3936503e2f3bed57

Download Submit
/data/data/io.virtualapp.luohe/virtual/data/app/system/app-setting.ini
Filesize
212B

MD5
60dfdaf375e6ae7bde622d087628d0f5

SHA1
5d7f54bffefa67ffb519e7c7ebf241db42331e7b

SHA256
287aa683db3292d6f2c9612a7da9a8d4a2f3df708b78b870d661b0bfc90d5282

SHA512
c7d5a79d4da79efe30ebd6c33b0f029615592ee4d5b482174c0a3495751fbf87d9b24c9448117fad997c4cb4a55db2433718aa0cb3930e23476f1f4f06b827dd

Download Submit
/data/data/io.virtualapp.luohe/virtual/data/app/system/app-setting.ini
Filesize
308B

MD5
015daaf768fc70eac2bedc41df82b3c3

SHA1
494c0ca0fcadfde7e685ff441bd0b2619b91d65a

SHA256
a7939ae86a22bedc9abde6434c58de09d48c7a818244a305b9b62cf9c952d5f6

SHA512
1cc2887cb61fae41ac8ce86ed418db07a9c83e10fbabf7705d8bb23420e9648be06547d5cdd7fc372b3bbf7cd7a347792371e5abc21d26bb22876411ed884aae

Download Submit
/data/data/io.virtualapp.luohe/virtual/data/app/system/app-setting.ini
Filesize
404B

MD5
79b1f995b26b9bf5a112a97e401aa4e8

SHA1
5bf1db7d06dd1e13aa472627ab97d1b569ea52a1

SHA256
1c7ed0022489d80622054b3652f5a6f92a3b847e6b0904779e70ce3eaddde2a9

SHA512
e04cc09c1d5a1d5406d5869c7aba4cb7c999fe033c90596c32f84c6340019c818402d8a49ab6e53c96ca748cc28af449d785055eb75d2116e61e8c8e33de8967

Download Submit
/data/data/io.virtualapp.luohe/virtual/data/app/system/app-setting.ini
Filesize
804B

MD5
9743be6f8f92a765e212debf847e99e8

SHA1
d562c58578367ece59f46415ad90b0931613801e

SHA256
72f00bec276e9bc178945ac8fd8d984b614d09bbdfc72e66b8a300c98bde4aa2

SHA512
39095cf4aff97a5c934e1b30d0083687070a8faffce92c8cc54886158a3f72c4a0d6e8b0cf41534eb93777a9ff14e7b6c397d2d4b0ed60780927b778d1271bf5

Download Submit
/data/data/io.virtualapp.luohe/virtual/data/system/users/0.xml
Filesize
159B

MD5
2ae695aa5dab64b4ae05c43c6a35eec1

SHA1
b1ed2ac2cb72be31802f1f216066ccce1033d366

SHA256
865a155fc1d774c31095dc3a9bd570cc2d7eb6b37d5935b1c6915782cb53adb1

SHA512
fc9f5c96a0e35c03c66f70d1353503820e53de924c41d375c29b5bc202c8b276a3bcfffe213fd07f5814ff1f156a12ca81d63db960be9ad5fa350373b09872b4

Download Submit