b40420a5af7cfe8ba0e5c91fecb404707ce342f6a0362eee441fa734413aa0c4

General

Target

679fbc2f64b3ca5374307e3bf343ed2a_JaffaCakes118.apk
Size

5.2MB
MD5

679fbc2f64b3ca5374307e3bf343ed2a
SHA1

9d3209a7313019c2b82300bb9e144d2f9b094d71
SHA256

b40420a5af7cfe8ba0e5c91fecb404707ce342f6a0362eee441fa734413aa0c4
SHA512

1b2c5c4a87a12d6c17db0b1aa034d35b16f7f23fb072681390379860a7a3ffa79023ea6695e4ae86fd0defc9be07b6b77871a5e690744f96fc5690f7d04e9ea3
SSDEEP

98304:a3PndjirR4ebFpb9Us0JKUuIk9aSBBPXcajpyi7lvgGcfgL2AP4TIwDUk:a3PUtxeJbUtcaljlvv12APoIwh

Score

8^/10

discovery evasion impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs
evasion

T1426

Processes:

/system/bin/sh -c type sucom.che123456.app

ioc process

/sbin/su /system/bin/sh -c type su
/system/app/Superuser.apk com.che123456.app
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
evasion discovery

T1633.001

T1426

Processes:

com.che123456.app

description ioc process

File opened for read /proc/meminfo com.che123456.app
Loads dropped Dex/Jar 1 TTPs 1 IoCs
Runs executable file dropped to the device during analysis.
evasion

T1407

Processes:

com.che123456.app

ioc pid process

/data/data/com.che123456.app/mix.dex 4244 com.che123456.app
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

T1421

Processes:

com.che123456.app

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.che123456.app
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

T1624.001

Processes:

com.che123456.app

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.che123456.app
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

T1421

Processes:

com.che123456.app

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.che123456.app
Checks the presence of a debugger
evasion
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

T1471

Processes:

com.che123456.app

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.che123456.app

ioc	process
/sbin/su	/system/bin/sh -c type su
/system/app/Superuser.apk	com.che123456.app

description	ioc	process
File opened for read	/proc/meminfo	com.che123456.app

ioc	pid	process
/data/data/com.che123456.app/mix.dex	4244	com.che123456.app

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.che123456.app

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.che123456.app

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.che123456.app

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.che123456.app

com.che123456.app
1⤵
- Checks if the Android device is rooted.
- Checks memory information
- Loads dropped Dex/Jar
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4244

/system/bin/sh -c getprop ro.board.platform
2⤵
PID:4325

sh -c getprop ro.yunos.version
2⤵
PID:4337

getprop ro.board.platform
2⤵
PID:4325

getprop ro.yunos.version
2⤵
PID:4337

/system/bin/sh -c type su
2⤵
- Checks if the Android device is rooted.
PID:4389

logcat -d -v threadtime
2⤵
PID:4467

/system/bin/sh -c getprop ro.miui.ui.version.name
2⤵
PID:4488

getprop ro.miui.ui.version.name
2⤵
PID:4488

/system/bin/sh -c getprop ro.build.version.emui
2⤵
PID:4513

getprop ro.build.version.emui
2⤵
PID:4513

/system/bin/sh -c getprop ro.lenovo.series
2⤵
PID:4551

getprop ro.lenovo.series
2⤵
PID:4551

/system/bin/sh -c getprop ro.build.nubia.rom.name
2⤵
PID:4579

getprop ro.build.nubia.rom.name
2⤵
PID:4579

/system/bin/sh -c getprop ro.meizu.product.model
2⤵
PID:4603

getprop ro.meizu.product.model
2⤵
PID:4603

/system/bin/sh -c getprop ro.build.version.opporom
2⤵
PID:4627

getprop ro.build.version.opporom
2⤵
PID:4627

/system/bin/sh -c getprop ro.vivo.os.build.display.id
2⤵
PID:4657

getprop ro.vivo.os.build.display.id
2⤵
PID:4657

/system/bin/sh -c getprop ro.aa.romver
2⤵
PID:4682

getprop ro.aa.romver
2⤵
PID:4682

/system/bin/sh -c getprop ro.lewa.version
2⤵
PID:4707

getprop ro.lewa.version
2⤵
PID:4707

/system/bin/sh -c getprop ro.gn.gnromvernumber
2⤵
PID:4732

getprop ro.gn.gnromvernumber
2⤵
PID:4732

/system/bin/sh -c getprop ro.build.tyd.kbstyle_version
2⤵
PID:4757

getprop ro.build.tyd.kbstyle_version
2⤵
PID:4757

/system/bin/sh -c getprop ro.build.fingerprint
2⤵
PID:4781

getprop ro.build.fingerprint
2⤵
PID:4781

/system/bin/sh -c getprop ro.build.rom.id
2⤵
PID:4805

getprop ro.build.rom.id
2⤵
PID:4805

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.che123456.app/databases/bugly_db_legu
Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.che123456.app/databases/bugly_db_legu-journal
Filesize
512B

MD5
c3753af68c839a630b650c47ab47d367

SHA1
3aa5de71b6f87c69fc5431f713c9b423bcea751c

SHA256
6f9992933fc10158ceae840321e21c514958650c5c767d665a089fcba93007f0

SHA512
3b4bc2e3f60107394aa53fa50ddf52275cc13c3de83874c9deae5c74e1880fe6987445017cf8e66895b7fd0aaafa4854b44e78ad89d865e4c3be02cd45eb63f5

Download Submit
/data/data/com.che123456.app/databases/bugly_db_legu-shm
Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.che123456.app/databases/bugly_db_legu-wal
Filesize
160KB

MD5
ef52cee9f45cc5352d2f19f65490aa85

SHA1
53173d37555094b8279261e62e201a51c00efc01

SHA256
057e8ed1a0b032e9ea7b499a07e7b27e6dd8d97e3542461a44e51b68201fa56a

SHA512
b3ae09062fb49fc3c3e5e2325ff97dca004361c2b95bdfcf2d03bbf7447272aec00931e87b2cb1f4389a4208ba48961b00b47c1973316047cf1fddbaee794548

Download Submit
/data/data/com.che123456.app/mix.dex
Filesize
292B

MD5
63f77f99bd2c2b772a479923bde11974

SHA1
c7632e7d301e4463fafce85f84e9c3d7da3fdbbe

SHA256
4c76a3af64cdd2f8713ffe2733dea50dbe714d0ca41c17d1847ee5b62a7ca615

SHA512
3aae4a89d1ed51fdd911cb367eb10afe3c2264e4222085891b18a60d5412f85d10bf5c8f3c6642db70abb9aa42732bac5c42c42ee32d587100f53c21b5beb16c

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads