1e4d4c511c5a04b41a5e7c50e92041037a7a03f883b60ff426e210525bcdc3b4

Analysis

max time kernel
18s
max time network
130s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
22-05-2024 20:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

689b9b3a2f3266ab6f7b340c1a19c736_JaffaCakes118.apk
Size

15.1MB
MD5

689b9b3a2f3266ab6f7b340c1a19c736
SHA1

b8abdbb17736bd7051320a8328e747a02be2b8bb
SHA256

1e4d4c511c5a04b41a5e7c50e92041037a7a03f883b60ff426e210525bcdc3b4
SHA512

fd0739dcfdf65630da9b4fb62d8e20015d083b1269303752df8e09348fe9886bf9718a9fbc68e276c23cb9f0e346e1b45db6e1239835aaaed30b52d7132d0eb3
SSDEEP

393216:HijiAnaIIUHbowx660CmlLcwVOpM3RQbtL9VsFZrgjzuN9YUUrh:W/naIlHMPHChJR9QrgjzuN9YUg

Score

8^/10

discovery evasion persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs
evasion

System Information Discovery
T1426

Processes:

com.unblockcn.app/system/bin/sh -c type su

ioc process

/system/app/Superuser.apk com.unblockcn.app
/sbin/su /system/bin/sh -c type su
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.unblockcn.app

description ioc process

File opened for read /proc/meminfo com.unblockcn.app
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

com.unblockcn.app

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.unblockcn.app
Checks the presence of a debugger
evasion

ioc	process
/system/app/Superuser.apk	com.unblockcn.app
/sbin/su	/system/bin/sh -c type su

description	ioc	process
File opened for read	/proc/meminfo	com.unblockcn.app

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.unblockcn.app

com.unblockcn.app
1⤵
- Checks if the Android device is rooted.
- Checks memory information
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4317
- logcat -d -v threadtime
  2⤵
  PID:4472
- /system/bin/sh -c getprop ro.miui.ui.version.name
  2⤵
  PID:4495
- getprop ro.miui.ui.version.name
  2⤵
  PID:4495
- /system/bin/sh -c getprop ro.build.version.emui
  2⤵
  PID:4520
- getprop ro.build.version.emui
  2⤵
  PID:4520
- /system/bin/sh -c getprop ro.lenovo.series
  2⤵
  PID:4546
- getprop ro.lenovo.series
  2⤵
  PID:4546
- /system/bin/sh -c getprop ro.build.nubia.rom.name
  2⤵
  PID:4571
- getprop ro.build.nubia.rom.name
  2⤵
  PID:4571
- /system/bin/sh -c getprop ro.meizu.product.model
  2⤵
  PID:4596
- getprop ro.meizu.product.model
  2⤵
  PID:4596
- /system/bin/sh -c getprop ro.build.version.opporom
  2⤵
  PID:4622
- getprop ro.build.version.opporom
  2⤵
  PID:4622
- /system/bin/sh -c getprop ro.vivo.os.build.display.id
  2⤵
  PID:4646
- getprop ro.vivo.os.build.display.id
  2⤵
  PID:4646
- /system/bin/sh -c getprop ro.aa.romver
  2⤵
  PID:4686
- getprop ro.aa.romver
  2⤵
  PID:4686
- /system/bin/sh -c getprop ro.lewa.version
  2⤵
  PID:4715
- getprop ro.lewa.version
  2⤵
  PID:4715
- /system/bin/sh -c getprop ro.gn.gnromvernumber
  2⤵
  PID:4741
- getprop ro.gn.gnromvernumber
  2⤵
  PID:4741
- /system/bin/sh -c getprop ro.build.tyd.kbstyle_version
  2⤵
  PID:4766
- getprop ro.build.tyd.kbstyle_version
  2⤵
  PID:4766
- /system/bin/sh -c getprop ro.build.fingerprint
  2⤵
  PID:4796
- getprop ro.build.fingerprint
  2⤵
  PID:4796
- /system/bin/sh -c getprop ro.build.rom.id
  2⤵
  PID:4821
- getprop ro.build.rom.id
  2⤵
  PID:4821
- /system/bin/sh -c type su
  2⤵
  - Checks if the Android device is rooted.
  PID:4846

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.unblockcn.app/databases/bugly_db_legu

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.unblockcn.app/databases/bugly_db_legu-journal

Filesize
512B

MD5
7f562a55a845edc87a155ae86c8dd619

SHA1
df28a5b29828d1a2ec582c10cf5632fc87644b3c

SHA256
2fc4dd9df9a6d8aeae1cb707a6498285525397a960cacea501460fb7a83e7b51

SHA512
dc8254f465357f797e6e2960301711806b6c74d1554108fe5bfac96bfd6ee2c30864e571b538590d2a09c3cc45cb085c63e0fe8958712e4a8303f9fc7b3a1717

Download Submit
/data/data/com.unblockcn.app/databases/bugly_db_legu-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.unblockcn.app/databases/bugly_db_legu-wal

Filesize
152KB

MD5
964060f0eed1ab1aaf119d6e93b4476d

SHA1
264044966be23351ec2c49277bb25a24889de8f0

SHA256
82edebfc8e5ee93636e1a46c7dc328e57d06b1ffef007514c948b15a713984e6

SHA512
def03abe41337ff7e3dc91042b049269ef1a1ea41c92270ec36b6fd7f7800694f34483c255435306786e0477d532eb7f0c5674a78f64b79a6d87fe434a6c689c

Download Submit