530c1fac0943c157d372396ffc4e1990ffac3538c92c23292b1fa0cd1d68467f

Analysis

max time kernel
4s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
22-05-2024 18:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6842bc0a4a007d76ec5c2c236d6c9ecd_JaffaCakes118.apk
Size

8.0MB
MD5

6842bc0a4a007d76ec5c2c236d6c9ecd
SHA1

d67063bfcdf3dfeb8d2cbb34c921d7949af5be2d
SHA256

530c1fac0943c157d372396ffc4e1990ffac3538c92c23292b1fa0cd1d68467f
SHA512

307291dd3aceaad3b62874b2d63c463329e1fd5a63b5eee940e70d229dc6ac93c6f1f3936678a358a92e83c9af1c9dc78bc12a0f9856b1c9065cf37e72f81bc3
SSDEEP

196608:N/OuWRnfxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxM98MQ9HElcV/ZUhmc5:N2uWJxxxxxxxxxxxxxxxxxxxxxxxxxxq

Score

7^/10

discovery evasion impact persistence

Malware Config

Signatures

Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
evasion discovery

T1633.001

T1426

Processes:

com.esbook.reader

description ioc process

File opened for read /proc/meminfo com.esbook.reader
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

T1424

Processes:

com.esbook.reader

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.esbook.reader
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

T1421

Processes:

com.esbook.reader

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.esbook.reader
Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

T1422
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

T1624.001

Processes:

com.esbook.reader

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.esbook.reader
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

T1421

Processes:

com.esbook.reader

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.esbook.reader
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

T1471

Processes:

com.esbook.reader

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.esbook.reader

description	ioc	process
File opened for read	/proc/meminfo	com.esbook.reader

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.esbook.reader

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.esbook.reader

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.esbook.reader

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.esbook.reader

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.esbook.reader

com.esbook.reader
1⤵
- Checks memory information
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4209

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.esbook.reader/databases/easouBook.db
Filesize
36KB

MD5
8b57ce717843c3d7b409cfec741db1f0

SHA1
c803d7ea2f2148d02309bcf2e1ac68de819a7990

SHA256
97930da183c3c54ba7fa20a1f0a2062b3118e9e97e468220225dad8a719f993b

SHA512
3a6a30fc5ea83c814749366e0425833e4ac86eedde41355fe1124fb7c15b0191f802d30a920d0e4b3805f149378efa261124c2b3262be724c4ac67d00559d044

Download Submit
/data/data/com.esbook.reader/databases/easouBook.db-journal
Filesize
512B

MD5
98c715c29bdf3cb1418f5e47e82c3c83

SHA1
4c57b8dace258aa13d78d9188cad8dcc6a15d368

SHA256
d23c91feb9a3f876fa5849c92f860b9025dac0c9713582a187ab0f8166ad41ca

SHA512
f712be388d71be503a6c80dcca8c48466b9efb0bc2096fad0b96c300d28ee34932c127a6435cdcbc69e2e84cd3e85da05706674b58dcfc047504c2b18dfff98b

Download Submit
/data/data/com.esbook.reader/databases/easouBook.db-shm
Filesize
28KB

MD5
cf845a781c107ec1346e849c9dd1b7e8

SHA1
b44ccc7f7d519352422e59ee8b0bdbac881768a7

SHA256
18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

SHA512
4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

Download Submit
/data/data/com.esbook.reader/databases/easouBook.db-wal
Filesize
48KB

MD5
ddd2e4e0f4a6d4eb961552a4c0942f3f

SHA1
5c88798eb6e369982b07272c04b20a8a898e537d

SHA256
dba0891d0b75b73be2f5ebb7208a2ad4775fd2c0d6234e846913cc163659b9c7

SHA512
55cf8ba227c6b04d6bb35c640df005cc9a37ff6d3e740533aa8191682236efa9e417323c99b5db9c682c78fc30d47f70708c7409d5597cb37e2aa630108c57eb

Download Submit
/data/data/com.esbook.reader/databases/localEasouBook.db
Filesize
24KB

MD5
3e5677ed2d99b125948e9a7c9ff4e296

SHA1
214ca6afbd9bf188582235e8f61c5c18c94668f6

SHA256
8105e7cefcdef23eb8b3173eb2c53e5e3daf075667aeedea11e61047b6522235

SHA512
03fbd0a3ed568812a2c3e14866ea9b8ebd91eafb77bb848ae68864eb7b31e0f2ba7d9ab34d57a0e4310d494702f4424a1d5b2d1d83236c2e2dacb5a6b8ca60bc

Download Submit
/data/data/com.esbook.reader/databases/localEasouBook.db-journal
Filesize
512B

MD5
4c62720d9f6d20da2aa0645d11c15781

SHA1
c30f42a1ff0dbc802c784c71c64b37f76ee4242c

SHA256
e4094292b89e1c68331b734524e26296a7bb76803d2133409e1342593361bf57

SHA512
8eccb6715a6690e7e9f0d25629f53567cc1b3aa76c8fbf9e34d96c3ec9f7821bfb4fae28e09b609bee218f311b6bb1185dd90be0ee736eb8825eedb0bb9b9a1d

Download Submit
/data/data/com.esbook.reader/databases/localEasouBook.db-wal
Filesize
36KB

MD5
00a6e66889fb349a7433e8fc9f5b47d5

SHA1
3b153e4bf001f6e65f69828228bff14854f7ef56

SHA256
65ea51a2415684171ba739be4c9863a8e09b4ff7e93f783a62aecb9fb6712c2b

SHA512
a6cdc523ddf93d52ec88e530c5b713b47c995a5248a74644cc4ec496652a4251c1bff9c0d5ee7a11acc1f0ead659c54cc378436ee1c4171bdb8ffea1f9c7a5f2

Download Submit
/data/data/com.esbook.reader/files/CMRequire.dat
Filesize
1KB

MD5
25e57636aee83606d202f04f26c2913b

SHA1
1ef0ade456ba38aa31584d0fbce647d0ba74b399

SHA256
89c56da41f0046c9e733fed330d2636d623510c217f72c2d025df3343dc66783

SHA512
3a8d294b8be98abe4d18116cbf7c16d44a541d1d20dd4dfbbbf3bbd8cb7997abcbaf51790bbc1978135d888c4e89868a9a2575d9cfed65a331969de77ba07326

Download Submit
/data/data/com.esbook.reader/files/VerDatset.dat
Filesize
172B

MD5
caaa975d7bf4952bd5dd695ade33f1da

SHA1
119373fbb2db036712df72ec9b26c0c2840dfbb1

SHA256
d0f94264a6b5c355dbf5c0516202c732bcae471a2401542b2ca43307727a0d02

SHA512
db2acdecd236eab67cb67151032f53e51c9c04e754f3c21d74e05cacb1ea5edecbbccbd66ee760624b9cac97b8dd77f568324e8abc2b9c16aa73131db81c8b06

Download Submit
/data/data/com.esbook.reader/files/cfg/a/ResPack.rs
Filesize
684KB

MD5
37c7d7a469620c696b8812831a527d62

SHA1
2e54375cde7ad35666184f5c7aeb65d5887f746c

SHA256
f3f542caf19e546f5cc1d265d5e6e35fa5ff32bb24e9282a60ef21d4c8588d9e

SHA512
8726878886379a8174b1ea11bb0c21dc6ef9bfe0ff2eafdfc4260a8c8666be82e3fd95309915aa0b40ad1a34b2f8f62f7c33860247562e84cac7e156dbf995bb

Download Submit
/data/data/com.esbook.reader/files/cfg/a/mapstyle.sty
Filesize
131KB

MD5
db362e36518c847ae80caca571e3c8c8

SHA1
610911bf7869016fb7c9a2026b3024eacf0b4593

SHA256
95549560fbb3d96dc791c2d16fdd5f098784eee75ac293556fe9688fb2f0ec9d

SHA512
41fa2b9b61c131b0926d0f47f86eea56859ca0d4e44ac23647a73ff4b98214183cb0a523336dcae4e2ddb4be932e994e1950365fd3590eb2f7c3b96bd4bb8a41

Download Submit
/data/data/com.esbook.reader/files/cfg/a/satellitestyle.sty
Filesize
119KB

MD5
6034f2a3f8bc9639ae820bd977bde4a0

SHA1
599f7994853b61bc5ee09a75b6383a13a5a685f7

SHA256
753705cb1ab2a676a9ef48881cfb036f212c4a7e7a5d34d9f8708075078e5818

SHA512
acaf0d146e4e3739eeaa40d46f7002776ebc4074bb89d12a5c25b12f53190a0e367ef0bd3225835e7e4b39a70b06e9f7328b1e342a9c5829af7610c14d41898f

Download Submit
/data/data/com.esbook.reader/files/cfg/a/trafficstyle.sty
Filesize
3KB

MD5
1e4b535871c4feb2010b614713def5c7

SHA1
4c5dc67838d12b795b6882c6dbbcc6767e42184f

SHA256
efa3ec85127a21a8c8a74640acc5fe1d992952964d4f257682f832f63c2ad3fc

SHA512
0c5443dbfdafab2e6cb7740587f48ca9a2c971b93afafcebccd17691edaa7c7fb75dfd1b6c939dd591a5aa65977f55e64b6c3690ab0a660432269fc43bf3133c

Download Submit
/data/data/com.esbook.reader/files/cfg/h/DVDirectory.cfg
Filesize
69KB

MD5
4baa4ede52eacda76bd26d5838cc2de3

SHA1
38b65c75440581f43ddb32ef17480e5c87f0153f

SHA256
c0f2b002adafe50265789ca04bc8dab8c176e6a7eaae164fdb98ebcb9ff98eb2

SHA512
58fef595b1db5f8fa7dbfcaa3b6b676bdbec8931ffa833858e2452c2f35a1b192746d2315acd27551594377ac121ec80574deee632d4bfa94b6315b8a0d33feb

Download Submit
/data/data/com.esbook.reader/files/cfg/h/DVHotMap.cfg
Filesize
10KB

MD5
c16f5ca1517683c46e02a6b71aab3c00

SHA1
2d09a048d1b8d556d89d4d723947e9e234b5e59b

SHA256
13d4fbc0d1cb7c2761641a3632c440f6f1d919dce731b8c32cb35e652b0b39f9

SHA512
a692b79382747548fd8be8ed94c06198b143c167be1e96f60d8ea7ee9432a0eb1a0cd73d0704523e487d59443bf7ad13eb36e47b67864e227917d33225e3e62b

Download Submit
/data/data/com.esbook.reader/files/cfg/h/DVHotcity.cfg
Filesize
1KB

MD5
6c495e47c754a9b25437ff9a88c7a51e

SHA1
8c4e36fda1e1f80918a3a8f1812c4e68b2326a4f

SHA256
e68e66e643d690d203a5153156e9cd6383ae1b3c481afa4b19e903d4a82289a3

SHA512
f3c030504cf50fdbd284acbdd893c948fb7ddb7544ce01d11c94fb00fb554f878949b1867fd5ab6c25e76c4be717aa819a917d4f25c8eba904df1a2819becf1c

Download Submit
/data/data/com.esbook.reader/files/cfg/l/DVDirectory.cfg
Filesize
69KB

MD5
65685a117c72fe8fbf5a92b07073c99e

SHA1
b115b527f74e4c291edcaab19b316a446aca8f5b

SHA256
19bcea79613a5c3bb71dfe6b311241fcbf3534b538f0b147c7e849b58b24b2b8

SHA512
e5821a5212f0790db33ec7274f018b08f499557ff7f2f118021a7905573e8dd66e716fb02144919d96eeec7da9db921c756a88cf0a050f65a9f8de3894dcc253

Download Submit
/data/data/com.esbook.reader/files/cfg/l/DVHotMap.cfg
Filesize
10KB

MD5
cc3fad9057e0940ad4d4c7ad27922023

SHA1
403cbbcd7b819733b5caf49ed2a58d654441e99d

SHA256
f6d90bd8621889ab994374b4f51a1c3f9b028aab1a2129b8b3b0e1d7c5c37864

SHA512
ebaf2b8c56bc15826ef38b36e72ae41765fc723470c6dcc40bf9f31118f252777072ad39a535a79f53b6aa29811b4b21cebbc9810c47e34ef9400246d789ab21

Download Submit
/data/data/com.esbook.reader/files/cfg/l/DVHotcity.cfg
Filesize
1KB

MD5
1c6abcbbd253448057930ad1cc59ac75

SHA1
a5845d1c4bc87b8b4785b456d76edcb8309eda4e

SHA256
a46b498ba6586aaa2f246bb34e47f4290ac60273cb86ff662475b0def7172136

SHA512
71aba5b2a1020d1925b3844c861cbe595de3b21d665eedb13f1ef0d80477fc091663e0625b09c5f49d4f9d0770970dd0d188b84635e9c75c1bdba9f2a7171631

Download Submit
/data/data/com.esbook.reader/files/cfg/l/DVVersion.cfg
Filesize
127B

MD5
e962c995c0664b5cd8d067db1561cad7

SHA1
263524863998525598f663ba7134ecec2ab592b2

SHA256
b83792f572112503fa2c542595047271d632318a775061ae3a964948738639f8

SHA512
7337967c5759f8a078eed90adc45054e5642b1e319800549c80395dcdc1956baa8d9741348e1dc0be931f24cdb899b95d4beec35e52995703dad8d0feb04ab26

Download Submit
/data/data/com.esbook.reader/files/libcuid.so
Filesize
129B

MD5
3d54e3eee1b38d69a60bdaa07996d7e6

SHA1
0023c6cffe4818f9e4e2aae831d3ccb1f08f00a2

SHA256
c7457c35a7cc570df0751fedb3416605174d92acd4b211e142556d30feee3df6

SHA512
832f9095a3e1edd0553642d9e20c9a8a5e2db90ca07457d82b7964e23204ae1678374dc885b3de34d1664fd1902f7a9d805e8c5ed8c4b3f7d2cbd3ef031150c4

Download Submit
/data/data/com.esbook.reader/files/ver.dat
Filesize
6B

MD5
5f7335045aed321b93c6ebb7a4d7417a

SHA1
35fbd4bee538b385d7abfc56df4e701615f73784

SHA256
f9d1a10b6885f6c28d841e07df992a2f620dd69e65d0a318523c232982158ed9

SHA512
ae94d011816076c988605e82e75c18ca6cb1708a20f079ac6dadc4c874c16b653a9ade7ec1015deec39bf98b840be69eb6e0d3705321e0bc59c8460c4de6ec4f

Download Submit
/storage/emulated/0/backups/.SystemConfig/.cuid
Filesize
89B

MD5
bb22526db58b179984a397fcd7b13e6c

SHA1
747e4507c3e37853696e8b1090e42a63fcebeada

SHA256
2831f4272a2092073780084bcca31f1693a2415ee0fea1b76f6d8daf0b427cfe

SHA512
92d25025971504b0ff2d0504338db85edcdf5494824714e9d2f04973f774f832d3bc8f559f5eb9b38d5db9f0612828c8c37d9116c516bc01679b9b928bdf9fc1

Download Submit
/storage/emulated/0/easou_book/backup/bookBackup.db
Filesize
20KB

MD5
95729d48a43a718ba88c552658b61768

SHA1
737843f9d887c2c0d13db264cefe8735e6b3c212

SHA256
fa26b38313504baa6932c95b747763b242c0782d8cc32d34ab97eb73d6064c25

SHA512
1b0d6c20fdcd962658f64ef67df9bb29c01172746730dc0a8fcd044b42629e169787faaa2dd765e7d9b9bf288dcf44b108fee54a766f60881ac256fe2161fed7

Download Submit
/storage/emulated/0/easou_book/backup/bookBackup.db-journal
Filesize
512B

MD5
f688d3a79e2b92a7e34054993656b6b9

SHA1
0e4b0c3d9c0338cf2d700b82b6c087892520fa38

SHA256
037ca623d87a4698ebe026d1b45cadac64dd87a5b47edecd7ad016e3d84d58f8

SHA512
b8697c93e3b41b7765118a8bef2cab83d74c43656ae35259990c96dd09c22ba13214662a8ab6581e847a17aaee1d2c7bc4d764222c8fe77da0eef37967ee959b

Download Submit
/storage/emulated/0/easou_book/backup/bookBackup.db-wal
Filesize
32KB

MD5
fb63df49461729859d5ee4780e069381

SHA1
cea9534b793d6b5f71ad99172de52509ee3bba11

SHA256
889949b7762294f0667315865de01a28b32db927870646a15b191bd9294cf55f

SHA512
46e074d4d9db48286c67735ea5757cdc515196d99a5cf7da597e8622b368a135557799f383c70ec791939875b4ecb4f71f85ebc719922e43d9f44e6ebf122ee5

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads