2d57572ebdf6f6248d89d89195b31766b36c4a6acdcbc7431b218d947ee6f116

Analysis

max time kernel
19s
max time network
130s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
22-05-2024 15:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

67bf213ed99e9ea48e5b03fbf212e87b_JaffaCakes118.apk
Size

31.9MB
MD5

67bf213ed99e9ea48e5b03fbf212e87b
SHA1

ff0227da65743a5d6e3aaa4cf9db4faf2257475b
SHA256

2d57572ebdf6f6248d89d89195b31766b36c4a6acdcbc7431b218d947ee6f116
SHA512

f0d2386dabe0629b0c17d026d39703c5d183beb57fe11af3b3ee378f7ab62f77ff602d9dc2eb656cd7baa610b41ef2cd8a1a2119a11f2bb9f627b818f0ef683f
SSDEEP

786432:n0Sfgh0SJoSyWhHdf1qmolC+wfXBSqNRXhnlxARBYfFGiKOfzKKUbxtIQ/:n0yZG9yWhHdtqmolCnXdXhnzEBYsitK1

Score

8^/10

discovery evasion impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs
evasion

T1426

Processes:

com.wying.diany/system/bin/sh -c type su

ioc process

/system/app/Superuser.apk com.wying.diany
/sbin/su /system/bin/sh -c type su
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
evasion discovery

T1633.001

T1426

Processes:

com.wying.diany

description ioc process

File opened for read /proc/meminfo com.wying.diany
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

T1421

Processes:

com.wying.diany

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.wying.diany
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

T1624.001

Processes:

com.wying.diany

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.wying.diany
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

T1421

Processes:

com.wying.diany

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.wying.diany
Checks the presence of a debugger
evasion
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

T1471

Processes:

com.wying.diany

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.wying.diany

ioc	process
/system/app/Superuser.apk	com.wying.diany
/sbin/su	/system/bin/sh -c type su

description	ioc	process
File opened for read	/proc/meminfo	com.wying.diany

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.wying.diany

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.wying.diany

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.wying.diany

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.wying.diany

com.wying.diany
1⤵
- Checks if the Android device is rooted.
- Checks memory information
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4268

/system/bin/sh -c getprop ro.board.platform
2⤵
PID:4300

getprop ro.board.platform
2⤵
PID:4300

/system/bin/sh -c type su
2⤵
- Checks if the Android device is rooted.
PID:4328

logcat -d -v threadtime
2⤵
PID:4378

logcat -d -v threadtime
2⤵
PID:4396

/system/bin/sh -c getprop ro.miui.ui.version.name
2⤵
PID:4417

getprop ro.miui.ui.version.name
2⤵
PID:4417

/system/bin/sh -c getprop ro.build.version.emui
2⤵
PID:4443

getprop ro.build.version.emui
2⤵
PID:4443

/system/bin/sh -c getprop ro.lenovo.series
2⤵
PID:4468

getprop ro.lenovo.series
2⤵
PID:4468

/system/bin/sh -c getprop ro.build.nubia.rom.name
2⤵
PID:4493

getprop ro.build.nubia.rom.name
2⤵
PID:4493

/system/bin/sh -c getprop ro.meizu.product.model
2⤵
PID:4519

getprop ro.meizu.product.model
2⤵
PID:4519

/system/bin/sh -c getprop ro.build.version.opporom
2⤵
PID:4546

getprop ro.build.version.opporom
2⤵
PID:4546

/system/bin/sh -c getprop ro.vivo.os.build.display.id
2⤵
PID:4575

getprop ro.vivo.os.build.display.id
2⤵
PID:4575

/system/bin/sh -c getprop ro.aa.romver
2⤵
PID:4600

getprop ro.aa.romver
2⤵
PID:4600

/system/bin/sh -c getprop ro.lewa.version
2⤵
PID:4624

getprop ro.lewa.version
2⤵
PID:4624

/system/bin/sh -c getprop ro.gn.gnromvernumber
2⤵
PID:4648

getprop ro.gn.gnromvernumber
2⤵
PID:4648

/system/bin/sh -c getprop ro.build.tyd.kbstyle_version
2⤵
PID:4672

getprop ro.build.tyd.kbstyle_version
2⤵
PID:4672

/system/bin/sh -c getprop ro.build.fingerprint
2⤵
PID:4697

getprop ro.build.fingerprint
2⤵
PID:4697

/system/bin/sh -c getprop ro.build.rom.id
2⤵
PID:4721

getprop ro.build.rom.id
2⤵
PID:4721

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.wying.diany/databases/bugly_db_legu
Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.wying.diany/databases/bugly_db_legu-journal
Filesize
512B

MD5
6858aa6ce33276eefdf7da48e2cc96db

SHA1
31f6b2ce1aa280cf96105b6717419a964554ea1e

SHA256
dd288eff38c92d1f4e0f13fb84c2a98ec31481f3daecd17f781a23d00ebe18d6

SHA512
debb95560787d8253cf453d1600a07a922350e5192b2cde0c6a1fad07547d4aef5a24fb07e0a1b12b9345aced7d8d1bed0a3e4766427cda6011569e774208a99

Download Submit
/data/data/com.wying.diany/databases/bugly_db_legu-shm
Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.wying.diany/databases/bugly_db_legu-wal
Filesize
245KB

MD5
6a42d3880344729fb49a92707818030e

SHA1
3651df9136297f67723603b496dbfb7379232a3a

SHA256
4939f5c5605ce466ff3429325ba42202cdd101a4bf65f32a146153838f729512

SHA512
0795e9325aee398b624447c103a62e4e2626aa8e9edc04496e4c9bbfdb6ec7b7f6120c97d08c4cb2e254a94b744955db6db857322c87c597771876dd8ff27142

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads