6f821f45fad388f44efae47024bfdbf02478ff80ad3fc3a75854a07ac9d06a52

Analysis

max time kernel
135s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240514-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
submitted
22-05-2024 19:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6852766c3495d378f382f97d85eb85fb_JaffaCakes118.apk
Size

15.8MB
MD5

6852766c3495d378f382f97d85eb85fb
SHA1

a88c6bdca457e7cee2b53d2f63bc2743349e3fd6
SHA256

6f821f45fad388f44efae47024bfdbf02478ff80ad3fc3a75854a07ac9d06a52
SHA512

2c9733b34d6ebe1fd89fc482c9654e58582e2b1c3cce2da8c82ea792b26683dc4b3b9e1f3430a4385ec27253f97f4f8358706243717bd4a8d03e3f657df36fed
SSDEEP

393216:N/9jMSwQnWokloPNcSKrqAOI/E4KufBWH4NaUjjIaGZ:VFM5QnkloPNcSKrk4x5GiaUHIaGZ

Score

7^/10

collection discovery evasion impact

Malware Config

Signatures

Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.gobig.app.jiawa

description ioc process

File opened for read /proc/cpuinfo com.gobig.app.jiawa
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

Process Discovery
T1424

Processes:

com.gobig.app.jiawa

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.gobig.app.jiawa
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

System Network Connections Discovery
T1421

Processes:

com.gobig.app.jiawa

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.gobig.app.jiawa
Reads the content of photos stored on the user's device. 1 TTPs 1 IoCs
collection

Data from Local System
T1533

Processes:

com.gobig.app.jiawa

description ioc process

URI accessed for read content://media/external/images/media com.gobig.app.jiawa
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

com.gobig.app.jiawa

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.gobig.app.jiawa
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

com.gobig.app.jiawa

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.gobig.app.jiawa

description	ioc	process
File opened for read	/proc/cpuinfo	com.gobig.app.jiawa

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.gobig.app.jiawa

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.gobig.app.jiawa

description	ioc	process
URI accessed for read	content://media/external/images/media	com.gobig.app.jiawa

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.gobig.app.jiawa

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.gobig.app.jiawa

com.gobig.app.jiawa
1⤵
- Checks CPU information
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Reads the content of photos stored on the user's device.
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4509

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Data from Local System

T1533

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.gobig.app.jiawa/databases/jiatingbao.db
Filesize
473KB

MD5
ad2834ab972d0a4960f2012ebc1e4ff8

SHA1
2acd2050d7312927ed6fcccb87683855f2d41c2f

SHA256
93fc815608b520a354bebcbaf5c7fb66dcc1ae3c4fb30c2c45fb40ec45e1026f

SHA512
5446d0f50bbcfeeeae0a7c84a365a583087d6707f9c78a0cbcb6afd17ca9beca721ab9b566557fb67530103245ecb1776107dd2e8dc253137cb3b02f2e30ee15

Download Submit
/data/user/0/com.gobig.app.jiawa/databases/jiatingbao.db
Filesize
111KB

MD5
7beffd2af8e07e8c24fb75602bf959e4

SHA1
dd5164ea1d0e5327ba53243fd9abdb32afd70fd9

SHA256
187c7193ce793d4dd25a6d78aa4613f5cebc743eac9b97f6106106e7a98a23ab

SHA512
7ff9e25e1cca29996d14df6ebc0a2823b5ea6a710063df1cfe9bb70ef498ed841bc0dfa6f938a405df1529ecf5f1489c5f8b988d99ef14caf5c8d46208faafb2

Download Submit
/data/user/0/com.gobig.app.jiawa/databases/jiatingbao.db
Filesize
1024B

MD5
1fc3c645db2721e4ea292ab28626fa35

SHA1
98a93d36370a4b8b935ac71c2d993b9b04c869ee

SHA256
358c94784c308f8dbac97b28ca52ef32f4788352676bbcb53eebf32578666bad

SHA512
104d180b4a775ddeb0c9ff13286cefa0b98752dff4e6c6866a2b64043d5ea91433903fc6fb07de4f2f62eae8e8abec9c872a91769aa5f6aee661225584a800b8

Download Submit
/data/user/0/com.gobig.app.jiawa/databases/jiatingbao.db-journal
Filesize
5KB

MD5
45a0c4fc50ada890d9ea5f0768b6db4f

SHA1
fe3a298d49d46623201832ff547b80d6fff92fed

SHA256
909997f3d1b98a814668d23c93ce123364e6052219bce8a05f36bcd8dc296bef

SHA512
0f6e4c4a8ad4ad83a9ab187d12b88aeff6affc8ded2785de5248b10851ac9bc03606fde941de3694038bfd554d129c31379b65bd70529dcd3845594b389d5aa4

Download Submit
/data/user/0/com.gobig.app.jiawa/databases/jiatingbao.db-journal
Filesize
1KB

MD5
504ecdd10a2f56fc759725cf8f147ad9

SHA1
f06d4a390a0e293b7fbc38f208129a82c4a4187b

SHA256
84a21065540c88e78f96a695c4468b9d8775bee192e9803efc673c2f9b931133

SHA512
77966aeb6e50614d3c39fa941a7b7e8a6645af193346b0e51fd0c4e9722df917f539ccdee9f7296e4500b1de76d756d7ba818284a3749c3cdb5a63a96b564f61

Download Submit
/data/user/0/com.gobig.app.jiawa/databases/jiatingbao.db-journal
Filesize
2KB

MD5
849f04884aa04bffb8f15a4bea14d428

SHA1
c7c2a9e2e8ae3dd0fd03f5dab1bea346f5930896

SHA256
82e0da61e54a015b6ef30980b5c629121c7d5a062d12c5ab020a1a32dcffe854

SHA512
5dc9ef88c033b9b5e3ccc24cf250ef9491e24b415eabbd7d0a4181d4e0962e95526a066d42243e797637ee8947d67f8c797156840c01c0485d088e56f1ed38c8

Download Submit
/data/user/0/com.gobig.app.jiawa/files/.um/um_cache_1716405358124.env
Filesize
566B

MD5
ea743f2edf7ec320bb8bc478405c8d1e

SHA1
8a62bc35fe79b618eeea8f6d5ab9b850831b9834

SHA256
86d47b1392af243664ffc688ab62ec6fa7a8b1b2be16c1a8ef99a52a88b1da2a

SHA512
3918e78933a9e1ce7339724d56c73200c33e8cb0525ab211349afbb84bb9cdb7c224a3e3540d5722acd49c5bcd975a00398574bc42fcc9b7a8e2569575288e68

Download Submit
/data/user/0/com.gobig.app.jiawa/files/.umeng/exchangeIdentity.json
Filesize
162B

MD5
edb9c1bc5d0ecf9dcfe2f702a4917992

SHA1
4bec9d7ce7108f32128d4df0447290b9b5fc497e

SHA256
4d5117cf82b82f679b5a04150183d2a65de6715102e326bdb91b5fe9d3419c86

SHA512
0f807c83c8c5287ecbc852c71ca15388a8d95e0f8640741a33b3ba9ed7c9ccdce03891e8d6c98334635180d4bb6ce7e10551e063f0f930d14b0e410b8c39664f

Download Submit
/data/user/0/com.gobig.app.jiawa/files/cfg/a/ResPack.rs
Filesize
525KB

MD5
0357e8edde36315c0e0a4f5385de625f

SHA1
2e6c6f15010e88dac5078f34e31a8ddf5e032f2f

SHA256
44764ad74b21113fb17b21899bd0d4c81740544e868eaad680553b3bd0cb016d

SHA512
497385b4e3b512f6a4365486d40bf1ed298422087f23a352ed2cec96331b9b012814ffba9c3ba83af5f777df16b53bbe1bf3ab8313902db49011f01a3024cf93

Download Submit
/data/user/0/com.gobig.app.jiawa/files/cfg/a/mapstyle.sty
Filesize
248KB

MD5
46a9f9a5221dbe4ff71bfcd2ee045c5c

SHA1
915cb3bc2f0096dede38afc1cd7f09c8782360a9

SHA256
ad3067eb308a9420b727b4f24dc5134bc75b36bdda7a7a7c5651090698dd10a9

SHA512
185530752b639d743f99e28369f75626900420dccf598a639065ecb08c562ff98c4a1f6abbec9724d1684ed053774d60402cd2f20e3586a534c8715e7cec2ac2

Download Submit
/data/user/0/com.gobig.app.jiawa/files/cfg/a/satellitestyle.sty
Filesize
166KB

MD5
3f1348cd6165c9a66a9892565c917ca1

SHA1
96f0c939438c494cf3fd89246d458e92c0c7203b

SHA256
5fbe3817e4047e14c40b567be4955d7579c8bf7b7824bf8370f5e194ebf9767a

SHA512
405c3d1d5f4899cf723509f8e293f2ca1d95a79f7892e93401309372335a6a286f2eae9ee9312f69af10c5bcabd091cd90608898a129542b0abe0617c500d023

Download Submit
/data/user/0/com.gobig.app.jiawa/files/cfg/a/trafficstyle.sty
Filesize
4KB

MD5
6a86f30539dfc9332cd235fc48fcb62c

SHA1
5c202003f6346edb85175b8df7c460793f5512c6

SHA256
34bfd1e28c3625f50a23240c4b08ac50a90fd35c5e5f88aed1cf36fa8fe5e18f

SHA512
f63edb8270e6cd35e5c6896e2b9153144af0d29303e367a4fa81941b1b2bb0de57fa484badb7ec7f05ebdfa67d77b00c3651572c5f05e9314389887f5546d235

Download Submit
/data/user/0/com.gobig.app.jiawa/files/cfg/h/DVDirectory.cfg
Filesize
69KB

MD5
4e9eab735928758b860e48b2f9befd7b

SHA1
7223dfdd00f8059d3b83c28c6f7d78d2dcaa0569

SHA256
1a5650bc57e525ff23c7f0cd058d4574142e772c51a89867a13f89e13b93d6b4

SHA512
c7465fab9518be687ee63cbe044f28a4d5c60f1c043fab0ec66a856b2b542c9d99d9ef5812c7eb2033f797805ba37b821572b83eeeebdaac4854a4bf53977599

Download Submit
/data/user/0/com.gobig.app.jiawa/files/cfg/h/DVHotMap.cfg
Filesize
10KB

MD5
c16f5ca1517683c46e02a6b71aab3c00

SHA1
2d09a048d1b8d556d89d4d723947e9e234b5e59b

SHA256
13d4fbc0d1cb7c2761641a3632c440f6f1d919dce731b8c32cb35e652b0b39f9

SHA512
a692b79382747548fd8be8ed94c06198b143c167be1e96f60d8ea7ee9432a0eb1a0cd73d0704523e487d59443bf7ad13eb36e47b67864e227917d33225e3e62b

Download Submit
/data/user/0/com.gobig.app.jiawa/files/cfg/h/DVHotcity.cfg
Filesize
1KB

MD5
883c30365d5d377966125dd0c079debd

SHA1
d296ec1e3f4badb6e3e6166c1473fb55d4265761

SHA256
50112e7ed210b33224fbe1cce568c8e95a14fb47f7d39ec905369e2feb9668aa

SHA512
00b1604e206a5d929071aa1cac99d83320eacdbb064d517973a5a36757a8a9eb8a103452c98f24e7c8d29adb4b2843e804bfdcb32902da7e364a0c30f8609b7f

Download Submit
/data/user/0/com.gobig.app.jiawa/files/cfg/h/DVVersion.cfg
Filesize
86B

MD5
298924848d2517a508f43ff0cc51bd3b

SHA1
b9fcde7b86653ead6deb57280a6049cf87745710

SHA256
0b6eb1f518059d8c472bab90091bb26d9ab877f6c70fac375412ff1582b8ca3b

SHA512
63b88c5b9b971ec52a5f724485d9998bfedb073e84ed63bcf0337e726923510d97a8ddf87371b5620f89ba788af01db58300638fff5031856c77dec8e18b4342

Download Submit
/data/user/0/com.gobig.app.jiawa/files/cfg/l/DVDirectory.cfg
Filesize
69KB

MD5
65685a117c72fe8fbf5a92b07073c99e

SHA1
b115b527f74e4c291edcaab19b316a446aca8f5b

SHA256
19bcea79613a5c3bb71dfe6b311241fcbf3534b538f0b147c7e849b58b24b2b8

SHA512
e5821a5212f0790db33ec7274f018b08f499557ff7f2f118021a7905573e8dd66e716fb02144919d96eeec7da9db921c756a88cf0a050f65a9f8de3894dcc253

Download Submit
/data/user/0/com.gobig.app.jiawa/files/cfg/l/DVHotMap.cfg
Filesize
10KB

MD5
cc3fad9057e0940ad4d4c7ad27922023

SHA1
403cbbcd7b819733b5caf49ed2a58d654441e99d

SHA256
f6d90bd8621889ab994374b4f51a1c3f9b028aab1a2129b8b3b0e1d7c5c37864

SHA512
ebaf2b8c56bc15826ef38b36e72ae41765fc723470c6dcc40bf9f31118f252777072ad39a535a79f53b6aa29811b4b21cebbc9810c47e34ef9400246d789ab21

Download Submit
/data/user/0/com.gobig.app.jiawa/files/cfg/l/DVHotcity.cfg
Filesize
1KB

MD5
1c6abcbbd253448057930ad1cc59ac75

SHA1
a5845d1c4bc87b8b4785b456d76edcb8309eda4e

SHA256
a46b498ba6586aaa2f246bb34e47f4290ac60273cb86ff662475b0def7172136

SHA512
71aba5b2a1020d1925b3844c861cbe595de3b21d665eedb13f1ef0d80477fc091663e0625b09c5f49d4f9d0770970dd0d188b84635e9c75c1bdba9f2a7171631

Download Submit
/data/user/0/com.gobig.app.jiawa/files/cfg/l/DVVersion.cfg
Filesize
127B

MD5
d54b7b380a5ff46c78283013a07d8e0f

SHA1
f697c5f7028ba2679a96d6bc5291c38ff96d7982

SHA256
c7ad837b097687d92e0d944815fc70adcb0e1cdc82db28f728d13e8a48d7532c

SHA512
ade792589c33179c51305f201bfb6db28c05b2ea098d12bfefc1a5cf9bd3014d53830ce2e71f027719ee1b83b2394c7654b5ddf4fdc7f678840869d2a2787ef4

Download Submit
/data/user/0/com.gobig.app.jiawa/files/umeng_it.cache
Filesize
245B

MD5
c264930ab09b2ccc59af803d63a8a1bd

SHA1
ad4f1352cf2d5ce928c98f8872a945ca5e3bb2a8

SHA256
449c89b4dbbc698a9d2199236076e2ac560b96a0f1c6fcd4d29be39ad3c61c11

SHA512
cbe2be2dc51c49a184924d80861fff5bf692b4870fb5f22fd3375caf96e11e3e0c4e18ef4774aa288d088239f7d73328e8b49c52ea9c9a49963c8f16adde13e3

Download Submit
/data/user/0/com.gobig.app.jiawa/files/ver.dat
Filesize
6B

MD5
8e31aa8d6b61e8b044ac3346e87098d6

SHA1
70e4050667039f00eb5231bd731b9f3cb5daf00b

SHA256
d2a616114953901b1bbbb79a9be694acc0aafdabc1df94f46002bcd6b75b3a4b

SHA512
2935b5e37639b7c631aac8d5073a200d56471b1a06858c0e3dac03e03a89758743b023cedd1ad703e8f775114b39ee0ca808165188c74359d6b1e47fa7e171d6

Download Submit