Overview

overview

8

Static

static

6

68153348e9...18.apk

android-9-x86

8

68153348e9...18.apk

android-11-x64

8

plugin-deploy.apk

android-9-x86

plugin-deploy.apk

android-10-x64

plugin-deploy.apk

android-11-x64

Analysis

  • max time kernel
    178s
  • max time network
    187s
  • platform
    android_x86
  • resource
    android-x86-arm-20240514-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
  • submitted
    22-05-2024 17:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    68153348e95a2fc5fa214ba287ba4678_JaffaCakes118.apk

  • Size

    15.6MB

  • MD5

    68153348e95a2fc5fa214ba287ba4678

  • SHA1

    9b7e0d5d87ad1e7df429a665091c8ee5d4f56405

  • SHA256

    3a1feb3a45aa2775c57d682586522c0e778d3b0a468dcc8f212ffa69b9541ca1

  • SHA512

    e4ebcb3e0671dce4db16ea52fc2af8c595672f71ec5527e4b6951211eb8633e9010d0f4000681c38a75a320fae8d2de98747fe3c6b74c9f5189c27c036b7f8df

  • SSDEEP

    393216:w5pnLjMlfGlqX3x2X7v0JJ8CWisF3/NLLBIl:upLtlqHxIvoKCLkC

Score
8/10
bankercollectiondiscoveryevasionimpactpersistence

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 2 IoCs
    evasion
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
    bankerdiscovery
  • Requests cell location 2 TTPs 1 IoCs

    Uses Android APIs to to get current cell location.

    collectiondiscoveryevasion
  • Checks CPU information 2 TTPs 2 IoCs

    Checks CPU information which indicate if the system is an emulator.

    evasiondiscovery
  • Checks known Qemu files. 1 TTPs 3 IoCs

    Checks for known Qemu files that exist on Android virtual device images.

    evasion
  • Checks known Qemu pipes. 1 TTPs 2 IoCs

    Checks for known pipes used by the Android emulator to communicate with the host.

    evasion
  • Checks memory information 2 TTPs 2 IoCs

    Checks memory information which indicate if the system is an emulator.

    evasiondiscovery
  • Loads dropped Dex/Jar 1 TTPs 6 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Queries information about running processes on the device 1 TTPs 5 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

    discovery
  • Queries the mobile country code (MCC) 1 TTPs 2 IoCs
    discovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 4 IoCs
    persistence
  • Acquires the wake lock 3 IoCs
  • Checks if the internet connection is available 1 TTPs 4 IoCs
    discovery
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
    discovery
  • Checks the presence of a debugger
    evasion
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 5 IoCs
    impact

Processes

  • com.cutt.zhiyue.android.app1138007
    1⤵
    • Checks if the Android device is rooted.
    • Requests cell location
    • Checks CPU information
    • Checks known Qemu files.
    • Checks known Qemu pipes.
    • Checks memory information
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Queries information about the current Wi-Fi connection
    • Queries information about the current nearby Wi-Fi networks
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Acquires the wake lock
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4218
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.cutt.zhiyue.android.app1138007/app_push_lib/plugin-deploy.jar --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.cutt.zhiyue.android.app1138007/app_push_lib/oat/x86/plugin-deploy.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4245
  • io.rong.push
    1⤵
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Acquires the wake lock
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4392
  • com.cutt.zhiyue.android.app1138007:ipc
    1⤵
    • Checks CPU information
    • Checks memory information
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4367
  • com.cutt.zhiyue.android.app1138007:pushservice
    1⤵
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Acquires the wake lock
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4459
  • com.cutt.zhiyue.android.app1138007:bdservice
    1⤵
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4506

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.cutt.zhiyue.android.app1138007/app_push_lib/plugin-deploy.jar
    Filesize

    213KB

    MD5

    e70723b8f6c4c7c09a6019733022cf53

    SHA1

    e3ca32166c65e4dc73c21347ab22d54a7b5a9a83

    SHA256

    32d35cd80b0302e3fcdd7349b4ff9a7b689ce080435109607ff79a834ff710d5

    SHA512

    461c0499193c5ef5aa4e2e5d358031e7d28c98c8e1e38d22b710271bf3b561c28232bfaadbc2c275357e31b7b0ad6bca798008328ac3cff3701c1c9cca2ddddd

    Download Submit
  • /data/data/com.cutt.zhiyue.android.app1138007/app_push_lib/plugin-deploy.key
    Filesize

    28KB

    MD5

    3e446f4678ab2ad4711dc00f58e0816e

    SHA1

    709208cb3e9fa1c69fc5142a198f74b1c8f31526

    SHA256

    f1d21e10b3d74b8f14dbea3a57546ef5f1540a1a81f50ede233c1655c506af6c

    SHA512

    1afab85ae215aa386e6050a81a5ccdfd2fb6c0bdb12a2b5cd88d07824d6a6ac3c3aab505fa7529725b73dbaa0d4d3e587896612ebc8d56d8349f13e738353409

    Download Submit
  • /data/data/com.cutt.zhiyue.android.app1138007/databases/rong_version.db-journal
    Filesize

    512B

    MD5

    bc94523b0d4d44c695fa024dbe420b84

    SHA1

    28ca764ba332295936f7eed1a9580ea05c162b2b

    SHA256

    061fa0477599ae546e83c4a91d9614c69e20067439fffd308e94d0523bf78708

    SHA512

    0ca1e8ea6cfd7db39eefc4560351141ad5f8be15dbb26d9650e88ff3f6ffbe92d0a47885f8ded5df4ca48e8c13283582efc4943799ae15f224b778fa749a9bbc

    Download Submit
  • /data/data/com.cutt.zhiyue.android.app1138007/databases/rong_version.db-wal
    Filesize

    80KB

    MD5

    8ac400a18fe29051bc2fc52f460fa297

    SHA1

    26f72fb4b76e7e27545d71369436cf81edbc46b9

    SHA256

    933e31605b213eac37f297a8b178eea04228a81d36df98a564b7452d6f58baf3

    SHA512

    ed08ccbf405fb70ac15229be110bdc517414740b0b66727393f2162f886a9403fb174c564207982047ec6a0e31418a63cba2ba6f278650ad8be36aba5388df26

    Download Submit
  • /data/data/com.cutt.zhiyue.android.app1138007/databases/zhiYue.db
    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

    Download Submit
  • /data/data/com.cutt.zhiyue.android.app1138007/databases/zhiYue.db-journal
    Filesize

    512B

    MD5

    abb7e57ec81e9ec747bbd13a4673c519

    SHA1

    e5017750c2f773e6cab3f8e816f1510466b61649

    SHA256

    11ea58f2b816964c5c808b899921b22897d1efede048a804c1036f54c6b3d630

    SHA512

    a704f45c23495697482aa4adfe636975540774dce5d7a55dede73209ec4502db7d87c88aad84c1da7d271c522b76b76b0369e04b3f58fbfa15c2438ebe72e0e1

    Download Submit
  • /data/data/com.cutt.zhiyue.android.app1138007/databases/zhiYue.db-shm
    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

    Download Submit
  • /data/data/com.cutt.zhiyue.android.app1138007/databases/zhiYue.db-wal
    Filesize

    32KB

    MD5

    884093028a9cc66f2aa3d1c9d940881c

    SHA1

    eff09e6cde7991f26a845ae7f2efc6dd4fc2a115

    SHA256

    3dc463087f2c086f4265f1dee803c82723af3a4c143f9fa6c39c75bfef11fdda

    SHA512

    376c1c677c153728a6c32d2c9de8cd891ebb6b240241d0d64baa5ec81471f98955fdd0d8ae88ecc43e80ebf83cc0c679b443088db46e508572f8accfc1f75aad

    Download Submit
  • /data/data/com.cutt.zhiyue.android.app1138007/files/mobclick_agent_cached_com.cutt.zhiyue.android.app1138007
    Filesize

    199B

    MD5

    26ed3e346d2e8c9d626c9469ceaaa4f1

    SHA1

    537a0cc1f7ceaba42c09e2c78edcd045d068ec2d

    SHA256

    28ea5042fecab1512b1cf4297885dc916c99c57887f931b12643bdc73150fe0f

    SHA512

    89255d8f21b70d3c61cd4f84aba64cf6fced099fadca6ebaa7f3e5df5c57d4f7d9ded5926e658351f3f12d252878e3daa06b11639f604ba64fd50a70a2cd9100

    Download Submit
  • /data/data/com.cutt.zhiyue.android.app1138007/files/tencent/js/config.json
    Filesize

    44B

    MD5

    df9afc7879f00c8a3c5b0ec6d09fc8e4

    SHA1

    d4c4ea174d3cdd56cebcb959a6d4f0fd933ac6fd

    SHA256

    bcdc1dc3c64ea91ba575597eb7e9da682d7cef57a22a67f7ff33543839b20442

    SHA512

    0c1948cc79028a5db4e5f483866eb48b7b4d5782c370548808c148fbb0fc65792b4f402c332f98a558c6e79f2b26bcd709763167cc8f451a114ae4ea386c24f6

    Download Submit
  • /data/data/com.cutt.zhiyue.android.app1138007/files/tencent/js/constant.js
    Filesize

    4KB

    MD5

    b692fc6edd0ec1d62a221ce68f9dbbc7

    SHA1

    bcaeb888705d788c73b12b78152b6c20ae9c2e7a

    SHA256

    4b19ebb45e9f843caf02e3ab4c16df37e5556f963e1afbff60faaee777a288a8

    SHA512

    430c439e519b2817b74f3d44af1cd3a0e8ea0a9647522bf2db5346de7322d0e47a769a2766d641fef833582998c75c3a21c889782ca8003e09e38089c21f9e9e

    Download Submit
  • /data/data/com.cutt.zhiyue.android.app1138007/files/tencent/js/platform.js
    Filesize

    20KB

    MD5

    fc8026593aca6fba4bfb07f20c76fcca

    SHA1

    3fcb2335819ebe6441d08e4cdbb96225fe2ca79d

    SHA256

    b63f03fdbc0728313716aaf6064ea98d7aa174f1e9d583269a43806cacd92f75

    SHA512

    a35f63dfcdd097b97123b1e05240c4de3542caec438c30a349cfd57f77662e8ca862bf1986d3f0b9bed601de86df9cf260d2a274a0543d8cc81b1685dd99ba89

    Download Submit
  • /data/data/com.cutt.zhiyue.android.app1138007/files/tencent/js/tencent.html
    Filesize

    4KB

    MD5

    5a117771f6fea5346cfdc85529ab6dfa

    SHA1

    a391daf7bd0fd2b0f440e409dd040fe002bc25b3

    SHA256

    162e5ec1c53a0ab52fd2258b87ab5990eb31075c56cf181da2fc1c50ff34ab53

    SHA512

    7335b0c4f512570c7b9814593f9bc1d6ac9f94f9354d450bcff9e0e11b98e20b7485a37e4b003f725215b3981ab9572c58cbcb6d3eb888a19408e02ad7804547

    Download Submit
  • /data/data/com.cutt.zhiyue.android.app1138007/files/tencent/js/tencent.js
    Filesize

    37KB

    MD5

    02f13a2cbbef94e80f50bce62efffdae

    SHA1

    212cdbe575dbd9fe40b7830f60ae14eab85e3d22

    SHA256

    5eef28625d10f5b962d175334cbdaf1a3430820c34c1ee14fd07f0f2527601da

    SHA512

    0698975154ce5d728aa5e9e1018c4391ab88467ae8a141c6bd9d5e8bc4e9d66c62c2f0b0d8966c423e2c13d82064e7893d5baaa2e943e3df48a094bacdb98828

    Download Submit
  • /data/data/com.cutt.zhiyue.android.app1138007/files/tencent/js/utils.js
    Filesize

    3KB

    MD5

    58a26503d705cb5ccde97f2791439e07

    SHA1

    f3d564fd7512b78d5b1d981863139a5254632d84

    SHA256

    1d3418e3709678997252c5db7d7806af8a6b9c8122d17f12cc977e2f8dc31f11

    SHA512

    5434286101aad9ff1c54cbf97270e6c2a78863d025c2bb5086f5d3e31476fbc6cb14ee16d36229ef58dd993e46a74ac45232556f94a445b98e6e227f4e5f9ea2

    Download Submit
  • /data/data/com.cutt.zhiyue.android.app1138007/files/tencent/js/verify.json
    Filesize

    289B

    MD5

    f173ddabd541bf23579f2ab677b69f99

    SHA1

    a1c6096a12d9e121f7e49ec16f9c0aff9c6ce4ea

    SHA256

    e085c105984c6c0f8c706e8d6fe4deb0ece151865992ec4dbdf2b8314c67aa43

    SHA512

    2b453d86ab597e2c59fbf3dd7311e7b6fbaa18531c2aad800e3bd769b4b2bf4036ecc11468343ba762be7a554dfe422b83ca5a08113ce3db9e9f64c0f6b4637a

    Download Submit
  • /data/data/com.cutt.zhiyue.android.app1138007/files/tencent/js/verify.signature
    Filesize

    128B

    MD5

    08ec5e7b54359b4efc65113940c67189

    SHA1

    7ccd5ba836f59480bcd3dc3e42d5dc369714f0da

    SHA256

    e7e3d26c0714e5fca4389cc4ced543f84440a5d39433d5a4ce67be9d52d48c88

    SHA512

    9edafe00f971315445adc2895525e7eb65ede649861182eed3e252169b5c3ddb20f121a8aad45c2c0ab4ea96d20a22ce827745153fefbc1b83e27948b2faf2a6

    Download Submit
  • /data/data/com.cutt.zhiyue.android.app1138007/files/tencent/temp/js.zip
    Filesize

    17KB

    MD5

    55aab6e3ebed1c89cf76e400353dfab2

    SHA1

    425598bf796d3226d2a1a7f5ad262ff88b829137

    SHA256

    8f490873dca4e47233bb7309ffe3d429cd352de4a118afa5cfd197f49e4978bd

    SHA512

    517d707d5df228d378a06fa93fc79dcdaaa5eea7800f7ce4c36350cb64196c621d13828ad6d95c0061adec832bfc2bf9f17e376e1581dfceb0f6784836927be0

    Download Submit
  • /data/user/0/com.cutt.zhiyue.android.app1138007/app_push_lib/plugin-deploy.jar
    Filesize

    530KB

    MD5

    5597a541eabd3fb792c581587550dc4a

    SHA1

    6500b0ff20c75717e1cb67dcee76b4641a4e8a35

    SHA256

    473b02216f8d2b5ffb26571e51ff322e3ce04ba45418408452bea103576ee8e2

    SHA512

    39b4acd82f67f11140cd1b0b4291e656a4a46ba63064509977f3f1de24a931dce83964f031e16ccab95cf0540ac5f613ca87d7665ce99f1c1ee4a0778e2c19e2

    Download Submit
  • /data/user/0/com.cutt.zhiyue.android.app1138007/app_push_lib/plugin-deploy.jar
    Filesize

    530KB

    MD5

    bdfa71feb08b80b649fddcd7488b03b4

    SHA1

    bcacf11199fd2c353034a7271b5dbfe2dd4cbddb

    SHA256

    f8bd07a7afce2d102976afaadd33dc70336a0b06682ac8d6fe9544a08d086d1d

    SHA512

    37dc848b995def498d0c832a76ed0ad429db18f26a5e9659c2b77a63bff555560160b6be4d22387eb529b2291bb27ae21718ddadb315bd1aa4c092d6330f049a

    Download Submit
  • /storage/emulated/0/Android/data/com.cutt.zhiyue.android.app1138007/cache/kit/journal.tmp
    Filesize

    31B

    MD5

    8c8bcb7d36cb5a71729c00c4e7f2d330

    SHA1

    a352667c61dc45f43cae74a7102fa692fba98d3e

    SHA256

    fddce724f39edc9ae1df4f8920e512cfd0fe3a9017b32031f1ca0e9ec06a1150

    SHA512

    4589f9c835a12ddaa04617822b93aba809aa85b392dc8596d47368a31648c542a0eb96643ca3a8d21d31aa1a790580a3258afdc3d202d31c5a324a4b591ccb62

    Download Submit
  • /storage/emulated/0/Android/data/com.cutt.zhiyue.android.app1138007/cache/uil-images/journal.tmp
    Filesize

    31B

    MD5

    8c92de9ce46d41a22f3b20f77404cc1d

    SHA1

    8671a6dca00edb72be47363a7071be65cf270373

    SHA256

    68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274

    SHA512

    30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56

    Download Submit
  • /storage/emulated/0/Tencent/OpenSDK/Logs/com.cutt.zhiyue.android.app1138007/2024-05-22/1.app.log
    Filesize

    141B

    MD5

    4a55c4276fd18d4451ebb0edf205b5dc

    SHA1

    9e19fdd30025b926405d5e114329a525022286ef

    SHA256

    6400e2f2f8a8ce7c45a9b959e1ea3a2214bf17b51b08a5910e6781bd9c2f6a3e

    SHA512

    1b7be267f33b35494131d0e4e9f115e7e2a773544d63f08b7a80e6e2e28767681167aa5b1b08e2105b7ec3b0b23aae1c7f478e6f794d7781e0bbf8df5e1ab2cf

    Download Submit
  • /storage/emulated/0/Tencent/OpenSDK/Logs/com.cutt.zhiyue.android.app1138007/2024-05-22/1.app.log
    Filesize

    141B

    MD5

    bc0970c2546b0ecacdf81ba6026ebe6b

    SHA1

    29868032939e8ba4ba34aa7595f83ddc179f246f

    SHA256

    181a6331a7bb4a9bcaa42ca9b453d7d1678ab37e2a6d1a1740c075fb28bfc1f3

    SHA512

    de0d2406fff1ea33d1c0e3aa767d2303a8583f4ab91eb03508fa7a74f30b194a226133fb5b60c8f5db3051f6673d2339334d64e2907d5031a6e3f39d59cf2a15

    Download Submit