6f821f45fad388f44efae47024bfdbf02478ff80ad3fc3a75854a07ac9d06a52

Analysis

max time kernel
130s
max time network
140s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
22-05-2024 19:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6852766c3495d378f382f97d85eb85fb_JaffaCakes118.apk
Size

15.8MB
MD5

6852766c3495d378f382f97d85eb85fb
SHA1

a88c6bdca457e7cee2b53d2f63bc2743349e3fd6
SHA256

6f821f45fad388f44efae47024bfdbf02478ff80ad3fc3a75854a07ac9d06a52
SHA512

2c9733b34d6ebe1fd89fc482c9654e58582e2b1c3cce2da8c82ea792b26683dc4b3b9e1f3430a4385ec27253f97f4f8358706243717bd4a8d03e3f657df36fed
SSDEEP

393216:N/9jMSwQnWokloPNcSKrqAOI/E4KufBWH4NaUjjIaGZ:VFM5QnkloPNcSKrk4x5GiaUHIaGZ

Score

7^/10

collection discovery evasion impact

Malware Config

Signatures

Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.gobig.app.jiawa

description ioc process

File opened for read /proc/cpuinfo com.gobig.app.jiawa
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

Process Discovery
T1424

Processes:

com.gobig.app.jiawa

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.gobig.app.jiawa
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

System Network Connections Discovery
T1421

Processes:

com.gobig.app.jiawa

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.gobig.app.jiawa
Reads the content of photos stored on the user's device. 1 TTPs 1 IoCs
collection

Data from Local System
T1533

Processes:

com.gobig.app.jiawa

description ioc process

URI accessed for read content://media/external/images/media com.gobig.app.jiawa
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

com.gobig.app.jiawa

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.gobig.app.jiawa
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

com.gobig.app.jiawa

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.gobig.app.jiawa

description	ioc	process
File opened for read	/proc/cpuinfo	com.gobig.app.jiawa

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.gobig.app.jiawa

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.gobig.app.jiawa

description	ioc	process
URI accessed for read	content://media/external/images/media	com.gobig.app.jiawa

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.gobig.app.jiawa

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.gobig.app.jiawa

com.gobig.app.jiawa
1⤵
- Checks CPU information
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Reads the content of photos stored on the user's device.
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4274

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Data from Local System

T1533

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.gobig.app.jiawa/databases/jiatingbao.db

Filesize
473KB

MD5
ad2834ab972d0a4960f2012ebc1e4ff8

SHA1
2acd2050d7312927ed6fcccb87683855f2d41c2f

SHA256
93fc815608b520a354bebcbaf5c7fb66dcc1ae3c4fb30c2c45fb40ec45e1026f

SHA512
5446d0f50bbcfeeeae0a7c84a365a583087d6707f9c78a0cbcb6afd17ca9beca721ab9b566557fb67530103245ecb1776107dd2e8dc253137cb3b02f2e30ee15

Download Submit
/data/data/com.gobig.app.jiawa/databases/jiatingbao.db

Filesize
111KB

MD5
9fbebd9605f7834cb77ae22a26318589

SHA1
bc5c30f8346d11be3db2d4f72399223a6c928aef

SHA256
97dcc4a406b3870a4dc2c7c4ec7463b0c72260528c74e6dcaffa48f98d2004fb

SHA512
907dcc770e03e742251abc1a538783438bd9b261219db7530152c1bf9f2f62a3173fec2421fe85c302be6935344d1d628b30b35f646de5f01fd1f225e3b18105

Download Submit
/data/data/com.gobig.app.jiawa/databases/jiatingbao.db-journal

Filesize
1KB

MD5
4f640683a1bbe58bbb8d8d636ec1848a

SHA1
dce382c00eadece3da9ac90a4408f6030e7d58be

SHA256
78a196b2160e1d6d6376eca9c20e4178b067f74ddcff0eade53aec55017a882d

SHA512
51d2eab257c4f9a246db6d6a81a8310d616dc4ac7df17a1dac2b92daa308aaae46fe534d76cfb2363f8a628143690e3cca678cb2011118ceaa38bd1307f03a62

Download Submit
/data/data/com.gobig.app.jiawa/databases/jiatingbao.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.gobig.app.jiawa/databases/jiatingbao.db-wal

Filesize
1KB

MD5
082c1365b00f745f88d1781417d98d1e

SHA1
2d0cb45d2db98feb729fabb083276d9a0fa69d35

SHA256
c2b0897213e3ea52fc591bcf8ecd9659b056ae9fc82edcaf38807497c1d5ce27

SHA512
4ba4d125a0750c4246d18976a570cfbde352b047a04b443da7a5ef92fb85625b3beeebeb8cb442eb810141b9a8105c0a9faf0fca6c018e3928898a518c2b4369

Download Submit
/data/data/com.gobig.app.jiawa/databases/jiatingbao.db-wal

Filesize
7KB

MD5
d532c94beaa7d8181addabd29df16bff

SHA1
dbf2dc3a4d69d766f7f03e93fd14d19f273e9984

SHA256
7cededdaa036243b8aeca96932b974d6c21b34d6c7e6c95f8f11b5eb28b33bfe

SHA512
8862e8601b9b777493012ba4b0287a4beeb95ddfdc1fddfbb50ed757060e53604877f6a79bd85d90c251d23b4898297f128de7c1b018d410d400ae0a0ef2341c

Download Submit
/data/data/com.gobig.app.jiawa/files/.um/um_cache_1716405359713.env

Filesize
582B

MD5
91e5148b6d729bf1069f2097388f18da

SHA1
e3289591eeed9ca49f09b78000c318d23b588a4e

SHA256
f0fba27600af4443408662202559c8a467de81b48dddc6a909192d3ab70cc7e9

SHA512
6c9661abbff9a91a006f71db107d70b0a7de75c8659dc039c60ba48db867d59bab2305d7aae24887218898a183ba78bae1e70d6c009bfc5309061f430e10f72f

Download Submit
/data/data/com.gobig.app.jiawa/files/.umeng/exchangeIdentity.json

Filesize
162B

MD5
410db65fa12ea41828c84833c5bca459

SHA1
152f5ff7f6e1939e7320c0e9243f87dcc94eb769

SHA256
74f29452a0d066eb04e6e5d9bb1e18e4da4eba956fb7290e19f74c7d7b65ce07

SHA512
8ddb9a290a24e40317b165fa3bee639398ca04fbb65ec93133df1be216dfd2de31ebf637e8564c65b91a795e69e1f0698153d21f62188a40bacba656a825bfea

Download Submit
/data/data/com.gobig.app.jiawa/files/cfg/a/ResPack.rs

Filesize
525KB

MD5
0357e8edde36315c0e0a4f5385de625f

SHA1
2e6c6f15010e88dac5078f34e31a8ddf5e032f2f

SHA256
44764ad74b21113fb17b21899bd0d4c81740544e868eaad680553b3bd0cb016d

SHA512
497385b4e3b512f6a4365486d40bf1ed298422087f23a352ed2cec96331b9b012814ffba9c3ba83af5f777df16b53bbe1bf3ab8313902db49011f01a3024cf93

Download Submit
/data/data/com.gobig.app.jiawa/files/cfg/a/mapstyle.sty

Filesize
248KB

MD5
46a9f9a5221dbe4ff71bfcd2ee045c5c

SHA1
915cb3bc2f0096dede38afc1cd7f09c8782360a9

SHA256
ad3067eb308a9420b727b4f24dc5134bc75b36bdda7a7a7c5651090698dd10a9

SHA512
185530752b639d743f99e28369f75626900420dccf598a639065ecb08c562ff98c4a1f6abbec9724d1684ed053774d60402cd2f20e3586a534c8715e7cec2ac2

Download Submit
/data/data/com.gobig.app.jiawa/files/cfg/a/satellitestyle.sty

Filesize
166KB

MD5
3f1348cd6165c9a66a9892565c917ca1

SHA1
96f0c939438c494cf3fd89246d458e92c0c7203b

SHA256
5fbe3817e4047e14c40b567be4955d7579c8bf7b7824bf8370f5e194ebf9767a

SHA512
405c3d1d5f4899cf723509f8e293f2ca1d95a79f7892e93401309372335a6a286f2eae9ee9312f69af10c5bcabd091cd90608898a129542b0abe0617c500d023

Download Submit
/data/data/com.gobig.app.jiawa/files/cfg/a/trafficstyle.sty

Filesize
4KB

MD5
6a86f30539dfc9332cd235fc48fcb62c

SHA1
5c202003f6346edb85175b8df7c460793f5512c6

SHA256
34bfd1e28c3625f50a23240c4b08ac50a90fd35c5e5f88aed1cf36fa8fe5e18f

SHA512
f63edb8270e6cd35e5c6896e2b9153144af0d29303e367a4fa81941b1b2bb0de57fa484badb7ec7f05ebdfa67d77b00c3651572c5f05e9314389887f5546d235

Download Submit
/data/data/com.gobig.app.jiawa/files/cfg/h/DVDirectory.cfg

Filesize
69KB

MD5
4e9eab735928758b860e48b2f9befd7b

SHA1
7223dfdd00f8059d3b83c28c6f7d78d2dcaa0569

SHA256
1a5650bc57e525ff23c7f0cd058d4574142e772c51a89867a13f89e13b93d6b4

SHA512
c7465fab9518be687ee63cbe044f28a4d5c60f1c043fab0ec66a856b2b542c9d99d9ef5812c7eb2033f797805ba37b821572b83eeeebdaac4854a4bf53977599

Download Submit
/data/data/com.gobig.app.jiawa/files/cfg/h/DVHotMap.cfg

Filesize
10KB

MD5
c16f5ca1517683c46e02a6b71aab3c00

SHA1
2d09a048d1b8d556d89d4d723947e9e234b5e59b

SHA256
13d4fbc0d1cb7c2761641a3632c440f6f1d919dce731b8c32cb35e652b0b39f9

SHA512
a692b79382747548fd8be8ed94c06198b143c167be1e96f60d8ea7ee9432a0eb1a0cd73d0704523e487d59443bf7ad13eb36e47b67864e227917d33225e3e62b

Download Submit
/data/data/com.gobig.app.jiawa/files/cfg/h/DVHotcity.cfg

Filesize
1KB

MD5
883c30365d5d377966125dd0c079debd

SHA1
d296ec1e3f4badb6e3e6166c1473fb55d4265761

SHA256
50112e7ed210b33224fbe1cce568c8e95a14fb47f7d39ec905369e2feb9668aa

SHA512
00b1604e206a5d929071aa1cac99d83320eacdbb064d517973a5a36757a8a9eb8a103452c98f24e7c8d29adb4b2843e804bfdcb32902da7e364a0c30f8609b7f

Download Submit
/data/data/com.gobig.app.jiawa/files/cfg/h/DVVersion.cfg

Filesize
86B

MD5
298924848d2517a508f43ff0cc51bd3b

SHA1
b9fcde7b86653ead6deb57280a6049cf87745710

SHA256
0b6eb1f518059d8c472bab90091bb26d9ab877f6c70fac375412ff1582b8ca3b

SHA512
63b88c5b9b971ec52a5f724485d9998bfedb073e84ed63bcf0337e726923510d97a8ddf87371b5620f89ba788af01db58300638fff5031856c77dec8e18b4342

Download Submit
/data/data/com.gobig.app.jiawa/files/cfg/l/DVDirectory.cfg

Filesize
69KB

MD5
65685a117c72fe8fbf5a92b07073c99e

SHA1
b115b527f74e4c291edcaab19b316a446aca8f5b

SHA256
19bcea79613a5c3bb71dfe6b311241fcbf3534b538f0b147c7e849b58b24b2b8

SHA512
e5821a5212f0790db33ec7274f018b08f499557ff7f2f118021a7905573e8dd66e716fb02144919d96eeec7da9db921c756a88cf0a050f65a9f8de3894dcc253

Download Submit
/data/data/com.gobig.app.jiawa/files/cfg/l/DVHotMap.cfg

Filesize
10KB

MD5
cc3fad9057e0940ad4d4c7ad27922023

SHA1
403cbbcd7b819733b5caf49ed2a58d654441e99d

SHA256
f6d90bd8621889ab994374b4f51a1c3f9b028aab1a2129b8b3b0e1d7c5c37864

SHA512
ebaf2b8c56bc15826ef38b36e72ae41765fc723470c6dcc40bf9f31118f252777072ad39a535a79f53b6aa29811b4b21cebbc9810c47e34ef9400246d789ab21

Download Submit
/data/data/com.gobig.app.jiawa/files/cfg/l/DVHotcity.cfg

Filesize
1KB

MD5
1c6abcbbd253448057930ad1cc59ac75

SHA1
a5845d1c4bc87b8b4785b456d76edcb8309eda4e

SHA256
a46b498ba6586aaa2f246bb34e47f4290ac60273cb86ff662475b0def7172136

SHA512
71aba5b2a1020d1925b3844c861cbe595de3b21d665eedb13f1ef0d80477fc091663e0625b09c5f49d4f9d0770970dd0d188b84635e9c75c1bdba9f2a7171631

Download Submit
/data/data/com.gobig.app.jiawa/files/cfg/l/DVVersion.cfg

Filesize
127B

MD5
d54b7b380a5ff46c78283013a07d8e0f

SHA1
f697c5f7028ba2679a96d6bc5291c38ff96d7982

SHA256
c7ad837b097687d92e0d944815fc70adcb0e1cdc82db28f728d13e8a48d7532c

SHA512
ade792589c33179c51305f201bfb6db28c05b2ea098d12bfefc1a5cf9bd3014d53830ce2e71f027719ee1b83b2394c7654b5ddf4fdc7f678840869d2a2787ef4

Download Submit
/data/data/com.gobig.app.jiawa/files/umeng_it.cache

Filesize
310B

MD5
2e73ce8b1e5f5de999284f44f7acff2f

SHA1
77a35ed6e1078150444a20f8d0fc5525d10f8108

SHA256
90e365a3e188a1b54caa85b2303b3e3950249cef5cb941d333245a1a2551f1d7

SHA512
a4809e8c046b9ebab8866cf04dc045c52bee22522e6c5e295fa6d9ce032ee97e52d359d601f05a8a4dea9ddefc316e8d0ddbae7bd506d9f91c7774fa9558039f

Download Submit
/data/data/com.gobig.app.jiawa/files/ver.dat

Filesize
6B

MD5
8e31aa8d6b61e8b044ac3346e87098d6

SHA1
70e4050667039f00eb5231bd731b9f3cb5daf00b

SHA256
d2a616114953901b1bbbb79a9be694acc0aafdabc1df94f46002bcd6b75b3a4b

SHA512
2935b5e37639b7c631aac8d5073a200d56471b1a06858c0e3dac03e03a89758743b023cedd1ad703e8f775114b39ee0ca808165188c74359d6b1e47fa7e171d6

Download Submit