084e4fe454b83425feaea2a1b067c0eabf27c7a36cc56d27000bdfef0a00c24d

Analysis

max time kernel
176s
max time network
188s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
22-05-2024 19:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

685a0fd0b0f15322f19822dbd7e54086_JaffaCakes118.apk
Size

25.5MB
MD5

685a0fd0b0f15322f19822dbd7e54086
SHA1

7b161150ee57fd0c2a9c5132497471724a092769
SHA256

084e4fe454b83425feaea2a1b067c0eabf27c7a36cc56d27000bdfef0a00c24d
SHA512

6181e505af3c97332bb98f39f75c63cd92ca0c1ab99cf1f21b26c36d9902ce8f340a5a86fc523725cdb259b83af4f31054270d3ad23de18d2eb53e6a99a40756
SSDEEP

786432:vB59S1fmvPgDLy65xjNQrrxPncnYSD/fXmchgJUREvH2Q:vWfcYK65pEllI/fX9gJURcWQ

Score

7^/10

discovery evasion impact persistence

Malware Config

Signatures

Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.cdel.jianshe.phone

description ioc process

File opened for read /proc/cpuinfo com.cdel.jianshe.phone
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

System Network Connections Discovery
T1421

Processes:

com.cdel.jianshe.phone

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.cdel.jianshe.phone
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

com.cdel.jianshe.phone

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.cdel.jianshe.phone
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

com.cdel.jianshe.phone

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.cdel.jianshe.phone
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

com.cdel.jianshe.phone

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.cdel.jianshe.phone

description	ioc	process
File opened for read	/proc/cpuinfo	com.cdel.jianshe.phone

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.cdel.jianshe.phone

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.cdel.jianshe.phone

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.cdel.jianshe.phone

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.cdel.jianshe.phone

com.cdel.jianshe.phone
1⤵
- Checks CPU information
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4325

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.cdel.jianshe.phone/databases/personal_clock.db
Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.cdel.jianshe.phone/databases/personal_clock.db-journal
Filesize
512B

MD5
86fd98dcd8af8ee5f4184ecf3dbe83fa

SHA1
46c97c9ca4b70f921f4ff62982ea8105234ff7e6

SHA256
ebb2f099f1c2cb2d556d7915bf96f5e5fadd495b03a48d7726baf143c2fe9794

SHA512
72e676111a4be3aeb295e0780832c1ca49f638dfd6d772b4b765e0e43897e5cdc1f3a0659a43458b2c9a3186976749fe1d8457508e753af1516936216032f5b5

Download Submit
/data/data/com.cdel.jianshe.phone/databases/personal_clock.db-shm
Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.cdel.jianshe.phone/databases/personal_clock.db-wal
Filesize
36KB

MD5
9696055dbcde846b74124ef824c129a1

SHA1
44a71422637f445953f2a550f383f8bdf57c4a9e

SHA256
20ded0a38b07002669f6810cdaddd03dd744c66b56d187caf5d05dc6020e1e94

SHA512
8776a804a0c32508677b111954fbe74fa6528a2df6cc3e86c22724cd874aa2d5c0e014d7588ba3324cdaf3fb0ce19e4defe515ee2cf636a1867ade09dc3bfd83

Download Submit
/data/data/com.cdel.jianshe.phone/files/jianshe.db
Filesize
4KB

MD5
5b735789e21dadc54f38a8781077a155

SHA1
9eb63dac406bf340fce806c3711b41f74b555127

SHA256
f854ad8b103b3acfb2f98bb29f2c034436d1e49798287d5e095ba7402fd68c24

SHA512
9ae9ea3a7325c2b1c30b092c0ec09c86fdf4e2c2e6ae120b389c11a4c5ef83fe9bc3825be8681818292a9ecd653b996050faadd75ba60bf71808d8fa29e14fae

Download Submit
/data/data/com.cdel.jianshe.phone/files/jianshe.db
Filesize
356KB

MD5
91223cc313b57c557cb6e855e882ce4d

SHA1
33f509d8fae22b1aac4ac634657e9136ce64a595

SHA256
269023fd34e7322f7610685b8cbb86e19239560cc31869c9ae5067e1eceb4120

SHA512
a2e92d0501686d61cb21a92daff4e9d5c50bdfc99e877b10d0a1100211401a050e25e655b1ab708154f147a026eb2130b773dc840d185f3ba17dfa4af44c938b

Download Submit
/data/data/com.cdel.jianshe.phone/files/jianshe.db-journal
Filesize
4KB

MD5
a87304d55f3c6472ef8c64b3a2bccd20

SHA1
61372d2499cd3f5b5ace4e6042a8f103b07ba1e0

SHA256
a5e2d7f6387f127dd890886fb871c16b16377ff1e8f5642e2933643992245dc4

SHA512
5ce256e6b0656afa75d80e1dc1a04f3772a4a104376dde5a4d2c2f37deaed341f09404e34de563081c02eb0d041e4dfcfdd6b9c1f4c5255acde4eb2e11e96b62

Download Submit
/data/data/com.cdel.jianshe.phone/files/jianshe.db-wal
Filesize
32KB

MD5
4d4de72d520e10fc41bd4b93ca34f665

SHA1
331460abc808450f5d1b4bba7ae61f8e0bbe2f24

SHA256
7b897f2f1b538c90d6e3b281c0636e0ad5ed5b7cced21ec55e4ef6ca82c274c8

SHA512
17aced11a0819a2568f1473edc0aa43cba00de2ccf7c260118e1c14c3a50bd32e3b3c36f29bd32d9a68a2ac8a55218e04b152090b97090438e5f07a4f24b92b0

Download Submit
/data/data/com.cdel.jianshe.phone/files/jpush_stat_cache.json
Filesize
140B

MD5
2dbdcba25d8e31f0465d371aa2bfab05

SHA1
e77f5093f13b2a5ddcfb5830ebbc680fb3c25b86

SHA256
1922621e4cc1cb5a89a6780459fbe5aa28834ed846829cd1d146169ebacffecd

SHA512
4a4122faf46794b077cdef9841b59374f6029552b5a84bddec0895f580b0839326c9cfb978e42fe4a48101e7e5bd4a5c5ea1e8408e00ea004bf7aac931d67e9a

Download Submit
/data/data/com.cdel.jianshe.phone/files/mobclick_agent_sealed_com.cdel.jianshe.phone
Filesize
561B

MD5
d2d8ea2b6f1d81ca71f8060b2732d8d2

SHA1
951c9183187127f0e3e92358af30ce47851cc917

SHA256
df0c3802d4ac7ea08c71a26acd84b3472637a1607b68a25bd9bd66bc45c8e188

SHA512
c5d2b230b04cb280043b604100421b955bc7193d5eef886cdec815efc4255b10d624c8516312a8c6029111a549860232bc2f6b9e87b9a7f256522ba2c08f55cc

Download Submit
/data/data/com.cdel.jianshe.phone/files/umeng_it.cache
Filesize
211B

MD5
6a98298f03ee38da40e40626b4e17397

SHA1
8865cbb0528c67280bfa85ebb9c75a7db6f7f0fb

SHA256
60b80fdd3720523920904629c3f0e11d07dcd0fa26a35a72128d8585179b29c2

SHA512
3ae4fdd4d7b1e9b8a3d8fb7e3bf1336c32f3a1c801cece6f22c9707e817d839a4f1510f5b54eb567e9bbce15f56f1a4fe3b2e0d2603dd6881979aa8e02574404

Download Submit
/storage/emulated/0/com.cdel.jianshe.phone.txt
Filesize
10KB

MD5
65e209ed8db699c5e36d84a6b4e2c68c

SHA1
6c449ba000253b22afe26c3bf7adba8c2bbcbf38

SHA256
6278f2726801755c2db0cd01dc8e0461c7d47662546d7a017483d7eefa324d2e

SHA512
927a645daf47416852ee7e0f3d493e361084714af06110dd9d8d38a41c1f3067c32d48dd75bdcf6ad900a481e2ace250fde51a8969ee0b8423fa9cd10881c9b4

Download Submit
/storage/emulated/0/device
Filesize
15B

MD5
748d9beeaa1899252a7365b780b95fb0

SHA1
2158cbe9044f2b138df0094615afe6616e526c9d

SHA256
59290d2d5a77605f8140feb82e44e8438115fb2f93dc56ed4c225b88c21baaa8

SHA512
cdeb0c4cebf1cc96ebda6940763a940df76120ee991bc7f003480caf055a970f16e4a19ef2ba2c56fa056d539b981e16542ec7239a7b91dd3828585bc2d1e440

Download Submit