Analysis

  • max time kernel
    168s
  • max time network
    191s
  • platform
    android_x64
  • resource
    android-x64-20240514-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
  • submitted
    22-05-2024 15:30

General

  • Target

    67bbc053a511d4218be918fa1f5f24f6_JaffaCakes118.apk

  • Size

    11.8MB

  • MD5

    67bbc053a511d4218be918fa1f5f24f6

  • SHA1

    4bb366aa59b5c51c87536ddba261c098f1750e2e

  • SHA256

    030736bd4310dcafc3e6c2322797b5ba842409cd8b28e1e35a5eb1de452ec2d5

  • SHA512

    b4591749751bb1c63ca335131869d7d138dbae46493d970192858e061caec1bf270e2bf910a335c480baf78c92ece9625fa2d090de248c18585355d501399d29

  • SSDEEP

    196608:TmZJWbK31F0LeKC1XEGjrY4XNfjteqI9dMlnJD5L6ixobxJrPobxJ8v:aZJ6+1UGjrY4XNfjUqNlJFeVzgc

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 3 IoCs
  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

  • Checks memory information 2 TTPs 1 IoCs

    Checks memory information which indicate if the system is an emulator.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Checks if the internet connection is available 1 TTPs 1 IoCs
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
  • Reads information about phone network operator. 1 TTPs
  • Requests cell location 1 TTPs 1 IoCs

    Uses Android APIs to to get current cell information.

  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • ibuger.kejileyuan
    1⤵
    • Checks if the Android device is rooted.
    • Checks CPU information
    • Checks memory information
    • Queries information about running processes on the device
    • Queries information about the current Wi-Fi connection
    • Queries information about the current nearby Wi-Fi networks
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Requests cell location
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5217

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/ibuger.kejileyuan/app_crashrecord/1004
    Filesize

    58B

    MD5

    0d210bfb2a0e1f1b4c082a6a0f79de07

    SHA1

    bb8ed9e364db79d1d9f2fcde3f15091893222faa

    SHA256

    988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d

    SHA512

    536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1

  • /data/data/ibuger.kejileyuan/app_crashrecord/1004
    Filesize

    243B

    MD5

    f8db1d5f8770fa0dbe4eb501d092e807

    SHA1

    9ae28262b9be593c8562985d4c7247efe4b6a4cc

    SHA256

    1cf732a2b98a94cae2af627f043cced730769e810d8a616556cdb219c92615de

    SHA512

    e0e7a3ccaa7f7a381f6179e887bcbc189660b71fe2642023866c01edffe2afbad5815fcaaa47b387bbe9a551d83c1f436f1b2ae30e31ba8734833ce8e86c759a

  • /data/data/ibuger.kejileyuan/cache/HttpResponseCache/journal.tmp
    Filesize

    36B

    MD5

    37e8e716e0e2f4a0b05cd9571d95b84d

    SHA1

    f8d068f6931707bddb8cd69f706f2224ad1fea3c

    SHA256

    7080cb592d5149c858b206d3fd0d5e3e7d601f120af00b2616bee928ee1291ca

    SHA512

    e62b850901835fdb73fa6224618422f721dd765861d42f6bc2dd013413e96bd910ac5313afd9b4f63da74beb12a15fac81b5157456c9caa3031862dab84423f6

  • /data/data/ibuger.kejileyuan/databases/0M3006CS7U0ZC2K3-access.db
    Filesize

    20KB

    MD5

    46daa88776c222a10a15dddc340ca10d

    SHA1

    9e6259904f83ac945b217a1d86c018c219d032ab

    SHA256

    78a0008c2a4cc8fdd20c743b136efe2c8eb4d30646377af2d0ea482b7c3943af

    SHA512

    ca50ce50c9f5000d81ab92366aa9e7497763c438d3d6b3e466b8a5f44672edbb49228dd79c92ea51c9f40eb6ad1c123fe5e0323fdb3d670c582b0f9e49d7197e

  • /data/data/ibuger.kejileyuan/databases/0M3006CS7U0ZC2K3-access.db-journal
    Filesize

    512B

    MD5

    4d05b4cabea1e644a31736c19d4a0c11

    SHA1

    dfafb4ac66039e87700b0785c3d621550034b646

    SHA256

    6f9155ea2e9e8acc8b826f4f33f0e84634a79949c6b10c3c86b2ce8ddc322e79

    SHA512

    9cd28cfb81f6012331c06c58aa7e57e1c8484c619d6690b9cc8c9dfa93be4747e40ceaa2ab35e33277557a4c1190b53562fa6f53dde3469375db4cba4b5c90a3

  • /data/data/ibuger.kejileyuan/databases/0M3006CS7U0ZC2K3-access.db-journal
    Filesize

    8KB

    MD5

    6e97e6bc1a12c4d63a899d71a62f2757

    SHA1

    ab3322d99ff96a0b1024a916bdab8b7e28fdb3a1

    SHA256

    5815362861b45122842a1dfec8114f5bf9fcde9f47de1ae4d5a0e3a23d368d56

    SHA512

    a0e6d7740f0498524dab94c525bf8494cebeface2895f9048077e0575c4a5cae883352c5248d4151149a3749a932fc666702e6210e7f5c3b439a5f4a22dc758b

  • /data/data/ibuger.kejileyuan/databases/0M3006CS7U0ZC2K3-access.db-journal
    Filesize

    8KB

    MD5

    f98002e25818d7ffad10d20494b73110

    SHA1

    77a8c4ba27502a142144a2009071ad63d08b1645

    SHA256

    6941d7e316a92799b6572e72369b50b72843d47aa8ed76c50de2e4e38ff4df3b

    SHA512

    d52af2c82226069593cf481b6370d035db39b0c75751b8f3f1ffa6d2a6d86f7a05bd64a9d015dafa433cbfbf43ab1f6a7df9b3211bbbdf5aa12c78b76da93924

  • /data/data/ibuger.kejileyuan/databases/OpenComUpload
    Filesize

    20KB

    MD5

    1c0cfcabefcd38e3adc13e2f11b12360

    SHA1

    499e845dafa29bdc95254f81e808240e87b1ec0a

    SHA256

    bfd5182a67c524e5cbd6ff6fedefb3378341acaf3d3a0a7d5de191dc87295b1b

    SHA512

    bdffec336fc63b79947b8ad7355a3e7c410c90a7e21a8cf3965688d6078c416fd18c0b6a720a2bc79c59ca7d8c3178abfc92d078ef3306371efeac4e8fe837b8

  • /data/data/ibuger.kejileyuan/databases/OpenComUpload-journal
    Filesize

    512B

    MD5

    7cd651fcbb4e78096740faf1da65abb2

    SHA1

    a2a491b275b0caf0ab02b5dd26bb6b2bdb97daa5

    SHA256

    7e5122a72da2d7e37165f644e041006842ba81999d15fc61ec8691b30c423c1d

    SHA512

    086df7893f5d08e242bbe825e4c3bdf808e4761d6288ac696f43f54eac3cb08958d0a2590e6620173f54d055303734306efda9fbbec441ec598dc2fa783b5e3d

  • /data/data/ibuger.kejileyuan/databases/OpenComUpload-journal
    Filesize

    8KB

    MD5

    54da15e0ab32aa454fe42bdfcb886c98

    SHA1

    65cdc7239198075bb05bb4fcd26a079b6661b314

    SHA256

    7f02a5e3d113c183a818fa25e8a77127373219b065ef8b803c565a24c38d47c7

    SHA512

    7ddfa51b441568e8bf8606ea48306435a5057b5f644b670ec3e278732f6bf5155845e107cf1410470519e6553545ce6ca6c5c9cbdefc0af06cc61c6532e30045

  • /data/data/ibuger.kejileyuan/databases/OpenComUpload-journal
    Filesize

    8KB

    MD5

    338c724f4d6afac8002a378b4d5ee4b6

    SHA1

    46a1be32e28b60b5ffc6227af4ac952434bdefcb

    SHA256

    d0a8a8116068b1dd8f145c6d4cc34cc723a6d1f4acfa9f73df3b3210fc8c8f90

    SHA512

    1acaa7abe88db4c989c235655288901833d2e43584c04e9e615645e7514ca8328646c3ea8ce2ee25182755cd687df2f5131c9238413819240bb3cbe301261308

  • /data/data/ibuger.kejileyuan/databases/ThrowalbeLog.db
    Filesize

    20KB

    MD5

    acfd145f966557a1caff4515c3159fa9

    SHA1

    3da073bcdf56e0345810b635f6565a7102bb4fdd

    SHA256

    5696b881d20731d50fcfad8c52478e9bba658367cb9a4e2427818d828b426937

    SHA512

    d8f8e4f23479a3fe34eaccda71fc7953efbdeff745a8d5b6e005d08110b1a9d3e453f75e3d4cb4281d9aaa0b49a309207c9852e01c8aab1de5339c9e22ac8c3f

  • /data/data/ibuger.kejileyuan/databases/ThrowalbeLog.db-journal
    Filesize

    512B

    MD5

    9ecb4f704bdff7cee251e4d544416f46

    SHA1

    4dd8e325e6a71ff5eed27b6605b240ba46714d0d

    SHA256

    da640f65ab1826c5fb3d6d8c4b4a6aa11b0cd9aa1f1321ae516f8fab94c33072

    SHA512

    6ccc43a7a3aa3532c81b63c4ae199f5426aa8ab5b71ed06cb31d94289c1c6a122f33409c2e919280d248e240dedd1579b2dd9a3892d141b17c357b4739a1e686

  • /data/data/ibuger.kejileyuan/databases/ThrowalbeLog.db-journal
    Filesize

    8KB

    MD5

    5654f31d05402f4540d7391e324d3478

    SHA1

    b95894e029a1f6df5c4e11863678cb2b7ebafc7e

    SHA256

    9ad139581318f50039c6c6d5c2727d7e69a7ecedbdc2bee77706fd97dc917e62

    SHA512

    ef6de09ad1cbc00929ec1e8c8a2915bde8c5cb2aa21cb162b454669edc86c46fd6f51caedd2ad7f8a10f867be2123d6179b6877547153f47d823ec58d9038ef0

  • /data/data/ibuger.kejileyuan/databases/ThrowalbeLog.db-journal
    Filesize

    8KB

    MD5

    6afd74452e33b81c75a83a9764cd9715

    SHA1

    f9174e9c46ec328d1c7d2f1cd7d4afd8a2094bfe

    SHA256

    7e6beac80544cf3cda294e08a7ef05d04baba038533e80410621239a4bf4d017

    SHA512

    24bb0872a4d703a4231df3684f76fb37ee732044f9f77c820372e846cc0f095bc23d9fd5bb1e905d79e16f1cea19a8cf4b0eab31e352a33489dd29a066f327bb

  • /data/data/ibuger.kejileyuan/databases/ThrowalbeLog.db-journal
    Filesize

    12KB

    MD5

    a74698c119556605104fcf483334e195

    SHA1

    666cdd215d617003d233edf2f2cc8d4624e95fef

    SHA256

    93edb89c52d4cc7c00bf63a8bc117e370958fd40fef458dfb8d9a28fe99987b2

    SHA512

    fea2382b002ca319f7b7161b1bcff994539c3ec41d7175442736e4590add1147956e022d4b56e8879956019c6777db44ffdb797284efb1d1f93987188da77e2d

  • /data/data/ibuger.kejileyuan/databases/bugly_db_
    Filesize

    52KB

    MD5

    123b477564f7f99b361ca644f30900d4

    SHA1

    b38cd57bcc66928a2cdc1a62403ea61410aee8f8

    SHA256

    6de2cdde612f81ef61bd0122c0b4f96365b20f814a1597e60fe4c721302dab99

    SHA512

    60292285ebbdcf30878dc5c273bde6a1c3336d2ec3c61db049ef36a88026ebab46c451e0122004f0b60bb52dfe0cc169f128f750c5590d413198c9292a25ff8b

  • /data/data/ibuger.kejileyuan/databases/bugly_db_-journal
    Filesize

    12KB

    MD5

    07c00658c9298c8b5e64bd0bf5ec4462

    SHA1

    0c468b0db82eb8d99a75159953a039af5cc9a22d

    SHA256

    9971fda19e87c730fb3e93eb8c364d2934f338eea8c16851a13925013da3d5ae

    SHA512

    997de36cb8d8393952c75e3737222908fefcd7f293a5b547e7ebfa08bece503ae8830f3fd03954dc91a9750f39df969f21d7e6e0633203a1661fc7bcd14a1de0

  • /data/data/ibuger.kejileyuan/databases/bugly_db_-journal
    Filesize

    8KB

    MD5

    e0441345c0611376e8ee349026c2a02f

    SHA1

    2c24e6a4955b1ac9407d5357de131a1b188aa474

    SHA256

    eb1283d8c0235b6fad15a79b960355159ba2ad1db340ec87ce9de725b4685cf9

    SHA512

    c9bb823b2aab654dabf7ab5f0cd7189e12d7442acc693e9d6452ddac2deb67334516f35567aabbe50bfe007a4f3b517a8ce406a7ada80b73e356ed5026b69f29

  • /data/data/ibuger.kejileyuan/databases/bugly_db_-journal
    Filesize

    8KB

    MD5

    48ccaa1697149ecdd5f01554f5aabd5e

    SHA1

    8d44343bb2522165c8aaf07f776ac3c35f53b72e

    SHA256

    307d0b7f9c1cbc9d8c8776776ce8ff0041e4fa54ccc2aebad71dfe07b423a3f6

    SHA512

    fe5594df5ca9b1b1049821ffa96116362be1a055c4a5853bc61dbb9059dede228c2fa71ae7a2c8d8688c31062b4998fe6fa4d59d97b0fb2bcfd3d4a0bdd51388

  • /data/data/ibuger.kejileyuan/databases/bugly_db_-journal
    Filesize

    512B

    MD5

    e070e19adec58df893604840464dfe1a

    SHA1

    fda12b5c887431200b9557f6d701a064eda74e48

    SHA256

    b938061dafb914ff952fd2aa46edcfb161ded2aac8054b260def4a173f8f9be6

    SHA512

    b27a742adcd8bca93bcd560503d8a10e728ea6682149d2ca6b90a52d3efdae53e1a12557c8a55f41658dbe2bddef2f4dbfdcb112680f4ab4a5cf6bceab3cbc1d

  • /data/data/ibuger.kejileyuan/databases/bugly_db_-journal
    Filesize

    8KB

    MD5

    75b57129016dc20a2ba6935cc5cd0a32

    SHA1

    b9173c44bae5be37359af0e1dfffdaaea4825517

    SHA256

    f0c3d3103b2194c8567f5acfdc99322cbaa79e52c36065103257bc570d48369f

    SHA512

    51e55bd070251f0a831de982f735cfcb38b044115e3e97acc728b2633251f33ccf7b6472be2dbf8a0f955e33169ee4e3fdd9750d6acd5de0ca64e0895e79bfab

  • /data/data/ibuger.kejileyuan/databases/bugly_db_-journal
    Filesize

    8KB

    MD5

    cf3f98d57fbb1cbc96050ded8d13330d

    SHA1

    2545285cb3d875dd67a8a76a0ecc99d33c5cbb6f

    SHA256

    cf4f8b2516fd21950591dd13e4d6e9c98cd5ef5273c1a4ff68f60bc6c190e867

    SHA512

    6fe31f08e529f26c9617df05ea9e61e0316376cf11ec76d7c115a3c2029ac05b0a70ec14c49b90d98ade9e7d22a9b804b4807fce21b18511b431e3a5bf39b0cd

  • /data/data/ibuger.kejileyuan/databases/pri_tencent_analysis.db
    Filesize

    40KB

    MD5

    b0a53b2ef495949c18199bbbc16a6e2e

    SHA1

    8943fad1fd6c6f69ab205486cc56e864d5de0f30

    SHA256

    cd30d520317d21e25bd784ce0d846f5bdb89f2fb7b1118d6f8ddb9f303e2206f

    SHA512

    aac089e2bb82f73ac20f609dd3f5519ef58934fa95a9879837487edd95ee05e05bfe484fa2f810f5fbdb27b7ef48fbdecb766ad1d109a2765fcf3b7ce05fe1ac

  • /data/data/ibuger.kejileyuan/databases/pri_tencent_analysis.db-journal
    Filesize

    512B

    MD5

    81ba3a00a39d85d0a860ed002190caf6

    SHA1

    9a9d6fcbb9e7ab9b2b93fb2e59574bbfdfa03f91

    SHA256

    4acaff9168669af152451b8ffa54557f0d9fdedf593200bc791dc179693fa913

    SHA512

    0986a4108ec91913a3a29402703453f4d8ae443c195dae298c1751ea9bcea63be862c59cbfc76b84d635d65fdb0a32676243e55ed7f562e163fcc421ca364d9e

  • /data/data/ibuger.kejileyuan/databases/pri_tencent_analysis.db-journal
    Filesize

    8KB

    MD5

    94d0a5ad015605a6f2082a0229aaa7ef

    SHA1

    7f81c6fc130a7b69f058b40feb7de1c00351caed

    SHA256

    1ca50ff6c80fa258e435fae2eb7bb725acdba36071017326556bbd9e31c77fde

    SHA512

    0ee980a1029a592242995afa35eb70cacb4502a63a4007f97eb3343bfb7bd23ade50a05383ed3c03fe5c38b8ca063a8bd8a1173f0c318f741efafc81daec3e6c

  • /data/data/ibuger.kejileyuan/databases/pri_tencent_analysis.db-journal
    Filesize

    8KB

    MD5

    289283705593e169231dcd3c6e8d964b

    SHA1

    6cec7af40138e18f96146ac09aee4ee91047cbea

    SHA256

    e61b0d3d66ee30722454976e996562b6d3e3a63338ae9379f282a0fd49c7ca8d

    SHA512

    4ad5a4f6fb35e47f090fcb1674775259e7b937255975f809945b0b94c94a12984af7d05c370cbdaefe3252bd708072b366db5355ee340e3ccbf8ac102bd6942e

  • /data/data/ibuger.kejileyuan/databases/tencent_analysis.db
    Filesize

    40KB

    MD5

    a14f2290451a16ae6419c9f9403fc669

    SHA1

    34138613d46dce18fe09f239b11ee30f033df271

    SHA256

    08e0d00c2b38652047417f8c1c1fa7e18e022089c1add28b319cf3de7dd0641d

    SHA512

    e4ad88c7d72c1807f8743d375ee6512266268181ff5bdb7020e1679267c0a695a2f9c8bfab58347a2914239f3dd11b3dd6b02a43828a42204c3147a37dac6a64

  • /data/data/ibuger.kejileyuan/databases/tencent_analysis.db-journal
    Filesize

    512B

    MD5

    7da27c7747437cc3f36b1eaabc06c804

    SHA1

    8835c0e17581097d2e4955c5232cd5e913f79536

    SHA256

    95e2257081118c1549cef0e479f7147b4f8ccf7fd64e739cfbb52245b2b8a63b

    SHA512

    55d91c9b2216d4d67f75987808f03158a210fd57d0680767f184a4788aca4fb0c9ec27e2f2edd60289c3db20e2806ab21d97fe56f48dd4983f2cc7e324321fc0

  • /data/data/ibuger.kejileyuan/databases/tencent_analysis.db-journal
    Filesize

    8KB

    MD5

    0de407d8fdfcab92bb45e25dfc93e228

    SHA1

    00c3ecfdacbd6ed57dd9535886f5613d3b3d8f40

    SHA256

    20c5751dfe5b0069e08587ef5eced5193f18469d29b0e98a6298e895594860c2

    SHA512

    905657890606ce82341227b8271e57a0b8d11ea75a320d93ef3d589a78bdd4d92ea6a30117d8bc2b36a02a8e8c19a51efa24d23dc5b5251870e96175004c7512

  • /data/data/ibuger.kejileyuan/databases/tencent_analysis.db-journal
    Filesize

    8KB

    MD5

    1991c95166f5e2859f1ddd62e143b3c9

    SHA1

    f28820ad3f7850bf7daf382ba54d727ed9141994

    SHA256

    4271ce03053d19e19a8d70952f85660639ae6da65f51d923183eed1f84d65238

    SHA512

    b21f44b4acfe56a6acd05565a03e23f0f478a565dd77113b86d503dd0a7d472b435ba76a92524a0ae14cb624fe1350858ad3506603f315395600c59ea1e34835

  • /data/data/ibuger.kejileyuan/databases/tencent_analysis.db-journal
    Filesize

    12KB

    MD5

    b33f32f0729e669a1e3625269ab9dca5

    SHA1

    343a9ca540a804138f157d860be157642d6945da

    SHA256

    2cc07b22b48bbf6d3cb28927794df4ca89a3f5dcc62dbbbd4362faa865e91c08

    SHA512

    e9647cba2475cb5bd765384232e57ebf07881e2c75649e890b03708759b2f642f6acf000b09704e1682651e06dfcf338026fbdc1bf96fe1945a6bb2754d81616

  • /data/data/ibuger.kejileyuan/databases/tencent_analysis.db-journal
    Filesize

    12KB

    MD5

    6e6112aabeb3258bdc10371fc1742635

    SHA1

    fedfcb1ad8bdfbd1f58b1b7f8f6d025774fa9cd1

    SHA256

    ba4bfa59d07f23c2c97c48886902c34e5e5c0238a50e711ad18d4c5c963d44d4

    SHA512

    809e4a084ef1b807d3c79c8bda11cd03833cf1a756f4d7e1e59f5154d9dad20d22c012d61ae95af5ecdcc918fbc5bc2668445cc1d20ba9c3e6d83ae7d0a89a5d

  • /data/data/ibuger.kejileyuan/databases/tencent_analysis.db-journal
    Filesize

    8KB

    MD5

    42e1edc20ada3655a1a4edeb164ef7ae

    SHA1

    4f5e29f41355600e8139f4bce038f5917ddb1bd2

    SHA256

    9209a1ca2179e1d1e0986752142512be7d663d2f9cceffd47ba4fa69cab41f18

    SHA512

    c1550f06bb8b32ef59ff1d4b8599fe49044239cfab03ad06e0ec9146f77033a0a4d882a663d4fc54f4b162c10555a59a3bc58b3efc841a822a4c88ca1c8d5f4b

  • /storage/emulated/0/Mob/comm/dbs/.duid
    Filesize

    480B

    MD5

    5b83fdea13f5de90ca42b3946bc7e7aa

    SHA1

    796208243c2068842c8ec5760d447ba857211a9e

    SHA256

    712e0f96bb9187cb3010dc7b04aba02f7a29dfc36d1c726a386b605f7cd10fc9

    SHA512

    f3685c25099ce3a5b040d4ba87ca936ff61ef99d92510a08e0ae3a1ae5990adb7edd1c6c1a92288483e2d44173ab595afb85299a641a1219f5fdb9d65131ec8f