Analysis

  • max time kernel
    167s
  • max time network
    168s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240514-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
  • submitted
    22-05-2024 16:36

General

  • Target

    67e69a3034f100bf3c3c8d311946aa1d_JaffaCakes118.apk

  • Size

    11.1MB

  • MD5

    67e69a3034f100bf3c3c8d311946aa1d

  • SHA1

    cac93b5b522b29bd4358f479cec49e2bd67a2f7e

  • SHA256

    caedf6c6c098a3142a429cbcc967228272a129003bd87b01866e28d6a91e8732

  • SHA512

    a7bb07a62b068f7181dc4f10c7bf7399f516a66a03cb917f0c0b47a7aad80a33f2589383303145c09065922f94fe65bb7b0815dfefdb650d49b6dfa894aae991

  • SSDEEP

    196608:F59ia3w4wNNA5RggFO6J5gzyrHuSYBMwoSp71/Zqe4lf0+44WiXupzXZZLOt4fy9:bvIOD9NHeUS9bw0+44Wey9CXIw

Malware Config

Signatures

  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

  • Checks memory information 2 TTPs 1 IoCs

    Checks memory information which indicate if the system is an emulator.

  • Checks if the internet connection is available 1 TTPs 1 IoCs
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.yxxinglin.xzid115477
    1⤵
    • Checks CPU information
    • Checks memory information
    • Checks if the internet connection is available
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.yxxinglin.xzid115477/databases/cc/cc.db
    Filesize

    36KB

    MD5

    4cfe777c9f6e7859f5efe2197401d8e5

    SHA1

    bb3774e8879ad5f6db0c37f151c3d6bc7b4b207a

    SHA256

    c422190539b6414072fc3950da19a17985c0c4c2172740b2f74682b520af5231

    SHA512

    6be469864edaf8eaa110f618f8abd27962da92e20945dcd38073ade2b60b10f00552d54d5db9d9f75ca133213031030e71e2e30113ff033e5ef507a28fe0b1de

  • /data/data/com.yxxinglin.xzid115477/databases/cc/cc.db
    Filesize

    36KB

    MD5

    86752a4be6564d8370f2f0e403995003

    SHA1

    29f7d50675f6e59f3b808eb6dcc8619384412115

    SHA256

    50484dcdc6b9c2801773018386a8143a52a5153eb2eeeaf5be8bbe46a49ca90c

    SHA512

    79c9435c1e0d41a3f97784be3e5a3cd8c0bd2d32ecdf326808bacb00c76d876d0447617d6e72ef04cd4b996c92eda4eb7bb200987ae7928ce2e0e7c8e807a5ec

  • /data/data/com.yxxinglin.xzid115477/databases/cc/cc.db-journal
    Filesize

    512B

    MD5

    d705cb06113c0c502f76b3f7e686a41f

    SHA1

    2d0c2aa16bf9425c6ec474ca301380744d4ecbea

    SHA256

    ae48662edb5c1546c5267b91e7bf864cced133e4423b732777e6a798699f0b31

    SHA512

    790c737b535304e0a2b871cdef04c6b16275b09fb1da2928143e7574f0dbbcf9b06bedee1d243f7be8d6f50c4cdc2831150eaa21126c03a56d5b48461d332520

  • /data/data/com.yxxinglin.xzid115477/databases/cc/cc.db-journal
    Filesize

    8KB

    MD5

    d54bf8e9a6a9032d636e44b03ba90de3

    SHA1

    a5f96305aa983a5675331e415eccb2f52bf64922

    SHA256

    083839a6067465e8be5a7bca01b9bb5f0a0ba0d30f9000d6b9049aa07b82735c

    SHA512

    af6c7c9ada9f5bfcafa23d88d673e4f8b53cdcace53692ceee3702e84a735f65cb08ce84097c5d776b68b7fb492c8619d0d6bf22b8ee3996223f159f18f321e1

  • /data/data/com.yxxinglin.xzid115477/databases/cc/cc.db-journal
    Filesize

    8KB

    MD5

    03a02d073418be8ebcb59b23b8ae04f6

    SHA1

    cbca1a56ecb0e147d57304846c7c0f75dda3fc50

    SHA256

    ba70c97f7d22c4b1beb3ddc40945e5f1c7ce116e92b81013ba4f8174498fb7ad

    SHA512

    b5a4ff97fbf642d0be1cd65ff76e7e72205421f7a343c797919aaf25dcca8e70fef18f144b60e4989a5b4bf7d660836f551118266d728f1366658b9874092bf4

  • /data/data/com.yxxinglin.xzid115477/databases/cc/cc.db-journal
    Filesize

    8KB

    MD5

    2902651545be6c12cb3fd5779da95608

    SHA1

    7b5a45ec52c5d881094eea24366ad75e5efe975f

    SHA256

    36f13b898e6842f98e8f42f3d31d7f4d8ccf89e2c3a22f6e3e4c54d8fbe065ef

    SHA512

    84d84fc0e9ddca2be2528f67bdbb5825a4c72b5902b1d896c322044ce65aa1b2b87df7ce06abcd1e4e5bfd847c47c02180f43d67915f400fda6abaf218f20579

  • /data/data/com.yxxinglin.xzid115477/databases/cc/cc.db-journal
    Filesize

    8KB

    MD5

    055c38a8b780ddccfd650188fd6a7828

    SHA1

    cd95d42319060bdf43614d61e3a1450cf46313b0

    SHA256

    bf06cbb4f49d4bf937fddb9e53815cf9cbb137a1636dbca899ee629169add4b5

    SHA512

    e58db5033da7e4b92961c22b1c90f5ed9ec9d99fac2f7f1a2de71d476e2c69b7e31e815f01388ba9463309ce4215de1710eed2a6c94b188f76d0b99952437414

  • /data/data/com.yxxinglin.xzid115477/databases/cc/cc.db-journal
    Filesize

    12KB

    MD5

    e3cdd3b6342befac3a35572496809e59

    SHA1

    53c4e0820a273068657bd5cc4e6563d7c3f89be5

    SHA256

    d8053c8120553b210eabb01336fbbce13ecc0cd6a874f54514a5eb7bd512205a

    SHA512

    f3540997273afc445ce4e94d4ac3f31282e24277a8119fbfeeb6eca6093bc3db98a2b8fb53de956131873b0fc1f7bdcbb3398255ce872ee80f479113b26a8191

  • /data/data/com.yxxinglin.xzid115477/databases/ua.db
    Filesize

    32KB

    MD5

    8231ce31a784ad099df95052d77e8e50

    SHA1

    6ec5ace15aeacccfa7a504bba9c021d306e21b0b

    SHA256

    4817b1e50c53db373fd614fa68369bde9276f121be33ae58803c9561d99efaf0

    SHA512

    080cf23656dafb323489d4dcfe0e6ac9a0b4f51d8a140b11a126978d91c68bc2edc267c8ab7d671367fd2582b0f5eab1b2fff63e77e51f761a78da8f87ef3168

  • /data/data/com.yxxinglin.xzid115477/databases/ua.db
    Filesize

    32KB

    MD5

    4cac7d31fb94d5c9581893537f64c5ed

    SHA1

    96bef3288546196ac3058b5eeddbe9da1d999fe5

    SHA256

    d1b111041f8aab3269f3da846b2ea199498d99f6905174a9d641f0faedca41c5

    SHA512

    0ab95e51a640148ac007d47afd5b9fd03ae5a3b9053e5e19a4f0b8089e17e41e311790ee9fe486b6752926799577bee041ed67b64d8772794e9d2329a96ce747

  • /data/data/com.yxxinglin.xzid115477/databases/ua.db-journal
    Filesize

    512B

    MD5

    5165f95bcf8b9349622b70e8d9fe6d3f

    SHA1

    34d641c4b09d34008337bc8da84570f52f9db81c

    SHA256

    176dabe0a1412f98142476b38dbb7d014dea5217e21b9b9296c17dda26e05fd5

    SHA512

    6d6b7cd90f2dbdbe94ca33e8441a099733cb4676c6c194e76b20b57e974984ab30074072b6d0ff7ae2598dc69b60feb35d3e25f8b69951a64390cb78386fc08f

  • /data/data/com.yxxinglin.xzid115477/databases/ua.db-journal
    Filesize

    8KB

    MD5

    fabbbfd2e90197f10da0326968a25a5c

    SHA1

    b8ee0d83af2c0837f61ad062d5cb16679cfe93b1

    SHA256

    f432eec3a1364812d57530f14665829305d0bef69b018fcf83a1c2b046290fb5

    SHA512

    0ce5c78a83b411d77a957a5bf38b7b670f33cc081df2ccb9c4cbbe7a88fd7c80886de7d7d9d9dbeff648c7087f2475e68fd1f016b01730497a4f94994fe21598

  • /data/data/com.yxxinglin.xzid115477/databases/ua.db-journal
    Filesize

    8KB

    MD5

    d508fa433b5a72a5c188b5765d999230

    SHA1

    da272a128dcc97eba497a564aa9a413e97dafc06

    SHA256

    818ceefaadc3c5cb3071cc437bd4156a84c5762051d818e68277d1dbcedcbc78

    SHA512

    64cabe78de974d9353cf04348cef672b7eb1ddff3509bd8a9c5ddeafafd04bd7cfdefef924d89e9e5715ec56f4e0ab8414ed7b63378066f62c74429765734fc1

  • /data/data/com.yxxinglin.xzid115477/databases/ua.db-journal
    Filesize

    16KB

    MD5

    e185d162e7ed758e5e1edb799f0439d8

    SHA1

    f7deeefeb610a9636a71f8bdc2ad678d7fca2e30

    SHA256

    6687d7c67543113874d0d8b1ca4d46dcd7378c8950ba28e4fc0cefa1170090d6

    SHA512

    65ab7f1b95dd3418c167c8f9424f61fd35e2b8105927c65463858b5486cf7f781ac4b6b4364579984fafe2a3bae1db0e81f044a1847d17e47452e99e66a58858

  • /data/data/com.yxxinglin.xzid115477/databases/ua.db-journal
    Filesize

    12KB

    MD5

    7fbfb8f807cf528258d59dca5f80d09c

    SHA1

    2cdba21d732f72b89a6feb38c328b2a7128910ea

    SHA256

    e822f217f49e03e0dee04877d8b46a38aa9d202161e2f92bca2bd95ddd166617

    SHA512

    769d9f2bf0d69e1ec00acbfdd4ebbe11939a43f06230527169095bb6a1e8139d58acf4c6692616b3474c49875005696635531e67b809ba2686c859ecd7d1da14

  • /data/user/0/com.yxxinglin.xzid115477/databases/RKStorage
    Filesize

    20KB

    MD5

    a8dd844c47107fdd6ea3f456ec54bb01

    SHA1

    1f3621fb596bc60390c70630f5ea67b0978d0e99

    SHA256

    169313326a38c579cc6e21cbd1e3fe2b055690d804aff46203ade7c0219cfca7

    SHA512

    4047b64f410a1494531a22038688b7872908daad27395661a0d953d4d2826fcdecda7c6967209d64dd1d60abbdaa7c86d7631b21cdc27577094eab0b42d33b8e

  • /data/user/0/com.yxxinglin.xzid115477/databases/RKStorage-journal
    Filesize

    512B

    MD5

    1a6a922b087404da1fd752b8f5e3444b

    SHA1

    39ce64a1736725264dfe99d544182e6b174805a3

    SHA256

    6cadd26e19def5b40ade20eb7331123addd59ad514a5f2b029b197214ae9edcb

    SHA512

    4a8ac4c6b02246fa84ffbdbe22266bb761eb0363cb62e275f84014239660d9c5d38d1a067eb8facb163ef6e605a9d0540f56a3ef8180a6c9eb7c4a6503355cca

  • /data/user/0/com.yxxinglin.xzid115477/databases/RKStorage-journal
    Filesize

    8KB

    MD5

    f062b694f4585d52e3dd6d3fef32a7db

    SHA1

    60d900f588c1286b6c48670282c0046c138b85a6

    SHA256

    a1751099fa17ac5d4a4da81669e2dd6874abab692ea08b38f423a93009e9fd33

    SHA512

    50c51a71fa17e6fba0f1d3500151558a4a39bf04f6ce07e38d84385f690cedda3cf0293da7a7957a208ce3f3f44037e170a20072393686301e204ed752c2b222

  • /data/user/0/com.yxxinglin.xzid115477/databases/RKStorage-journal
    Filesize

    8KB

    MD5

    7b93dfb83f9182c69926b516934865ff

    SHA1

    3cc92e279c65ff3c7f98b99969774e02fb31360c

    SHA256

    6111fed8fdbf244882a1f4488bf64dd2a459e9977f36a4c697cb24d7c48dc72f

    SHA512

    3845ff5044cad1f725ce647e275ca1dea93e66f78a3a6286188cd8e120c4bd5e991e34cc9e33129b5a80deb9a16d9c20da2ea45bfd11f9ca0124e9409fbc0b91

  • /data/user/0/com.yxxinglin.xzid115477/databases/RKStorage-journal
    Filesize

    12KB

    MD5

    185eb594015cae08c890e993a60841eb

    SHA1

    a0f40c68e8e858074b09e76fea99d4bb47a66898

    SHA256

    c695a98dc9560d237c1232fbc7625c8bc9f3b1b025ffc78654fa0661d46319d5

    SHA512

    dcf23a88d747e2b333a78cb8e0398e8e0d96e420f1e691b0114fd8d56069d065bfa6da08b9100d5f9e5a9b0454765a9c9c9ba29a8f33002e2ceffabdce161d05

  • /data/user/0/com.yxxinglin.xzid115477/databases/RKStorage-journal
    Filesize

    12KB

    MD5

    fb4514d980ece2d53ef41f0fbe7df950

    SHA1

    56c972e0b0509142d493a74a6d51dca3ee715606

    SHA256

    7614f0f127b7d6e492b25806396225db048f2d41cd3dd291beebe05ffa8844b1

    SHA512

    7c1b1df79a235c6d20803d875c6d0a2eefcc31dfd8e8762974e31ebe17589e464413ff70d271bccf951d3f80c89bf735702d6d8e143c7097b0a80459602f1036

  • /data/user/0/com.yxxinglin.xzid115477/databases/RKStorage-journal
    Filesize

    12KB

    MD5

    210687b316c9a8b865582ac810f45cde

    SHA1

    5ea6bd710d1c7e8f45bcbd136f8a4a8742d700ca

    SHA256

    672d59ce66bba6d75a6ccf02acacacf247e9d19873306b328cf63ef20044a219

    SHA512

    c6767ca43d9458014e42f0c1e65779da419d6e04c4ef435b0d699433599d26db312ccba4539588e6778ec340247cbcdf7a07372c0365ad9ac09b3f45d429c7f2

  • /data/user/0/com.yxxinglin.xzid115477/files/.imprint
    Filesize

    924B

    MD5

    d99e6da57bce2b1320fba073f64d1311

    SHA1

    09cf2c7399c9da4bc8b8c71e6c005b4c06492913

    SHA256

    a775a6b2f6f7af5749e7c7e181a7f222d7942043899f63deffd668c9bb8541ec

    SHA512

    e760582c104e5d0b1d14de8a54dd49167e06a2f63c0b45478d18c4aad2f41b477f9920acdaaae19e6ed4c7df32a927828226b24eac49f1f771c89cb58e33a724

  • /data/user/0/com.yxxinglin.xzid115477/files/.umeng/exchangeIdentity.json
    Filesize

    162B

    MD5

    70a1779634447ab38569ad19415f0d88

    SHA1

    308b82599a0e7f2bc6c1f9418750c3bc7c730125

    SHA256

    222f5789ccba9f227e5a50c0d76b84476cb5adfbb8d00812481e69edd8a624f8

    SHA512

    d52133e620a1f621c368d33d7162434014247955e9c501f3f72dab9390bbfa2f507cadbd988e8ac159d2dce153b9398a3dc45811a8c75d26729ff522b00b1029

  • /data/user/0/com.yxxinglin.xzid115477/files/exid.dat
    Filesize

    54B

    MD5

    651a6be4fb7079e5c73600b37c11548c

    SHA1

    9425c9a6db3476d4d836bafccf9651a423c5b914

    SHA256

    e16a88749cacbc2efd96326d3afe980a8199a7050ff47721c0a7b52a8842c801

    SHA512

    5a4925323ad710d78906549d2e3deb778882a49fab9505b8d5e839b62082f74d59277b776274a757f48602b0334efee8630c442a2500a617feff4123d1c6960c

  • /data/user/0/com.yxxinglin.xzid115477/files/umeng_it.cache
    Filesize

    433B

    MD5

    ae7a6f5478bf988e7f379a07c74b5991

    SHA1

    189c6d54b4ff5600c37e87be00aa31519252067f

    SHA256

    58ad546937abaa9a9ca69db7ca60ac869c290aa80e9f6bfaee23ec64d76759a6

    SHA512

    65a28c5166e17b89fcbe796125bc6b925c59d2b016766cbbaeb1092cce4cd3fb878722b6273186c9684b7420999fa7d4b040375e5b48215a1662fd9d663e51a3

  • /data/user/0/com.yxxinglin.xzid115477/files/umeng_it.cache
    Filesize

    220B

    MD5

    dfd811440f0b3311a5185d6f055a2621

    SHA1

    7e9926a93b867e3893954253780b28835e209540

    SHA256

    a482ee9c4570c71b3402135d8c4185f1938db60a977f2ae04197c3eea1bcdc86

    SHA512

    f49fe85fda36899f159d495a515746645504d0d36ebdc8cd3ac2d9ecaa2cf8db35e5a6012f88d03cbbbb99e92e57dd8b53a4bb0e6207d378cf3445c1136635d3

  • /data/user/0/com.yxxinglin.xzid115477/lib-main/dso_deps
    Filesize

    208B

    MD5

    9ffcb7d5cce3e6831dd888bb87d7bc13

    SHA1

    adfba9b22520caaab6edad8feae95adc3755249d

    SHA256

    3887f40cad06b240332b4b74eda306adcd51644dad15518494d0488e9d2b09fb

    SHA512

    9fe95a642d5f1103d38132c8e5828a4d54cf485ac7a2021b078b8c74e55692f6e9e9ff3aa6b8478c297f50e66f0cc7d0c9c19e5c0b65f03ed5eb5fb7fd5cc15a

  • /data/user/0/com.yxxinglin.xzid115477/lib-main/dso_manifest
    Filesize

    5B

    MD5

    c06857e9ea338f3f3a24bb78f8fbdf6f

    SHA1

    c5a0a2529d2deb60fec041b4fbd722a2ebe31702

    SHA256

    957b88b12730e646e0f33d3618b77dfa579e8231e3c59c7104be7165611c8027

    SHA512

    29f61516876c25379a7bf4faa2b3ca6f6b53eac90e7de47671fec4a818d51441b4025cd7909f7c0a0d113ab6c5ff00cb3700c286bac7319185b77905feec4fb1

  • /data/user/0/com.yxxinglin.xzid115477/lib-main/dso_state
    Filesize

    1B

    MD5

    93b885adfe0da089cdf634904fd59f71

    SHA1

    5ba93c9db0cff93f52b521d7420e43f6eda2784f

    SHA256

    6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d

    SHA512

    b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee

  • /data/user/0/com.yxxinglin.xzid115477/lib-main/dso_state
    Filesize

    1B

    MD5

    55a54008ad1ba589aa210d2629c1df41

    SHA1

    bf8b4530d8d246dd74ac53a13471bba17941dff7

    SHA256

    4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a

    SHA512

    7b54b66836c1fbdd13d2441d9e1434dc62ca677fb68f5fe66a464baadecdbd00576f8d6b5ac3bcc80844b7d50b1cc6603444bbe7cfcf8fc0aa1ee3c636d9e339

  • /storage/emulated/0/.DataStorage/ContextData.xml
    Filesize

    111B

    MD5

    b4a077c3d7c7f7c27c9c441c3ef80313

    SHA1

    8e7f742df1448147818f94ce4cbf402e597fdb3b

    SHA256

    93dc14b85147868bcba17d3fe8aa702e5b920a4c08f00abef590d3371eead7a7

    SHA512

    7db759eb38d6580a67a958ca95236a8951626484339b37b5c5db8629f3ac6a603683802d1975c6a26681f27b312526ae776cf2349fbcc3ce66ad73e3d746da84

  • /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
    Filesize

    65B

    MD5

    9781ca003f10f8d0c9c1945b63fdca7f

    SHA1

    4156cf5dc8d71dbab734d25e5e1598b37a5456f4

    SHA256

    3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793

    SHA512

    25a9877e274e0e9df29811825bd4f680fa0bf0ae6219527e4f1dcd17d0995d28b2926192d961a06ee5bef2eed73b3f38ec4ffdd0a1cda7ff2a10dc5711ffdf03

  • /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
    Filesize

    111B

    MD5

    eee627522f4029b21a541e5d92a338df

    SHA1

    31f7843fe8fc0276f368b505101dbf2563bcaa70

    SHA256

    84205da0307847af3889ed432c658a8cb124b99bbf88ede10d482763da147442

    SHA512

    cba4e45523c1ccc286203e310ec575d6e0fb90102797e1da0050e753f0923145c63ed456d0237e78205ebacfc1d928b04d697803441ca2c18e1212fbba7e456f

  • /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
    Filesize

    407B

    MD5

    e26b25e8461dbcfa363900ab5aebcbd7

    SHA1

    5400feade1fa81c1ed9e3c5613e12c65f970aab6

    SHA256

    57684c79a81a779e6f7bbca21c048016d7d728bfbab725b170e5dfca0e88b573

    SHA512

    425d4d658dce16ea27e005297ed88a1ddc3ae745e4c02a491b74af9eb34a774d922532d08121acf3597c90e41c16aae7272d4803b9c947f1046cbb585692c5ea

  • /storage/emulated/0/JXCP/aff/com.yxxinglin.xzid115477
    Filesize

    6B

    MD5

    8328002d9025596d84ad026f19895f0a

    SHA1

    763168363f99a7b84d3b273d9c599ed58f05f5e8

    SHA256

    ef825fd05f3e8f7080b3ed69b3e55a4249d2a5672bee5d56e116fd6fe6b0d173

    SHA512

    a78f18a4074793c0b4fa1ca4bfdd5935cdfc60a608205d812b1ebcf768baed87bebdbeffe6d15e044d117b9f1b901386ac12ce494a147620c5c1c4c45c0d12aa