498a053b192aa54a2439cd958e14a8a377adde461c79a813ca61823c1724ae70

Analysis

max time kernel
179s
max time network
136s
platform
android_x64
resource
android-x64-arm64-20240514-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
submitted
23-05-2024 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

498a053b192aa54a2439cd958e14a8a377adde461c79a813ca61823c1724ae70.apk
Size

4.7MB
MD5

e4bebac88eb12c53d7296152813943d4
SHA1

25f0bf004cfa0ad1c5f9f6a0a236ba34b6e05191
SHA256

498a053b192aa54a2439cd958e14a8a377adde461c79a813ca61823c1724ae70
SHA512

9625287f472d2bc39707e088e676df8ba1829b6f50517a4d830a8b3280213ba1f61a0ac591a4c5aaa42829eb6a0870515d7bb17e2f34a7280b240547a4bd6e71
SSDEEP

98304:PkgH0Z66sxdEy+nBe8M0kPV7X/ZFyniGs3P/RFe8HP2Zr9uY:D0Vsr8nEFN7RsiGs3P7ewY

Score

7^/10

collection credential_access discovery evasion impact

Malware Config

Signatures

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	fish.jar.dope

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	fish.jar.dope

Loads dropped Dex/Jar 1 TTPs 20 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/fish.jar.dope/[email protected]	4498	fish.jar.dope
/data/user/0/fish.jar.dope/[email protected]!classes2.dex	4498	fish.jar.dope
/data/user/0/fish.jar.dope/[email protected]!classes3.dex	4498	fish.jar.dope
/data/user/0/fish.jar.dope/[email protected]!classes4.dex	4498	fish.jar.dope
/data/user/0/fish.jar.dope/[email protected]!classes5.dex	4498	fish.jar.dope
/data/user/0/fish.jar.dope/[email protected]!classes6.dex	4498	fish.jar.dope
/data/user/0/fish.jar.dope/[email protected]!classes7.dex	4498	fish.jar.dope
/data/user/0/fish.jar.dope/[email protected]!classes8.dex	4498	fish.jar.dope
/data/user/0/fish.jar.dope/[email protected]!classes9.dex	4498	fish.jar.dope
/data/user/0/fish.jar.dope/[email protected]!classes10.dex	4498	fish.jar.dope
/data/user/0/fish.jar.dope/[email protected]	4498	fish.jar.dope
/data/user/0/fish.jar.dope/[email protected]	4498	fish.jar.dope
/data/user/0/fish.jar.dope/[email protected]	4498	fish.jar.dope
/data/user/0/fish.jar.dope/[email protected]	4498	fish.jar.dope
/data/user/0/fish.jar.dope/[email protected]	4498	fish.jar.dope
/data/user/0/fish.jar.dope/[email protected]	4498	fish.jar.dope
/data/user/0/fish.jar.dope/[email protected]	4498	fish.jar.dope
/data/user/0/fish.jar.dope/[email protected]	4498	fish.jar.dope
/data/user/0/fish.jar.dope/[email protected]	4498	fish.jar.dope
/data/user/0/fish.jar.dope/[email protected]	4498	fish.jar.dope

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	fish.jar.dope

Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Intent action	android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	fish.jar.dope

fish.jar.dope
1⤵
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Requests disabling of battery optimizations (often used to enable hiding in the background).
PID:4498

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Hide Artifacts

T1628

User Evasion

T1628.002

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/fish.jar.dope/.jiagu/libjiaguv2.so

Filesize
265KB

MD5
23c1696b63c1e3d44e50c6ebb6196e42

SHA1
e204e02cd2354ed225f57d5170114eca827b93f1

SHA256
004d3fba49899402d953819de96a3421c49e0df1efd705386d6a8745ebf3504b

SHA512
d50783c087a01ebfa6db10149aa01289be8f9999094b06eb4db529280bb409c09138f80775e9a1c5677c3a87edcb6561465ec9f603560fabdbcaacf9fcfc1d4f

Download Submit
/data/user/0/fish.jar.dope/[email protected]

Filesize
245KB

MD5
999bcb2b89cd0d8608f852ea6ee2583d

SHA1
9af4f01b6016b24abd70205afdc2647dbbc6f310

SHA256
6325227f0b0406075ca3470451c3d144f1869dcc73badaf69439567ffbf39723

SHA512
9bbc12800d5b216b7d17762533125431efac60639d0c6278e0b1f9e0b9f5defc9db6aa407b6be25828680f296364fa6c670366621c9b38ee85427151b02b6f8f

Download Submit
/data/user/0/fish.jar.dope/[email protected]!classes10.dex

Filesize
243KB

MD5
7615fa4cf4cf5c00f55cd34ea9dda674

SHA1
55c8eff6859ee06e96032a5154e86c2428467e97

SHA256
471b2ff7241d40c631cac34deb5eb096be05bef4259a59ef246e6a383e11ae76

SHA512
424956f7e48a841292c02aec904dec7573bdf6830c370aef4c0416d5d75550d844dfec7f715a688e08689ca68699cbb0c2485e7dd212fb7586cf6c5c647759d1

Download Submit
/data/user/0/fish.jar.dope/[email protected]!classes2.dex

Filesize
257KB

MD5
25bff800b8de5063445ee468fa3e431f

SHA1
ab4c1a65162ecacd8bda9046c6a597dea251b622

SHA256
3f7528aa05cf99c08d684ccf79d6349dbf144182e282260ec408598272e5a903

SHA512
b71e08c32f5a88c262823c36d1418bafce3a0c95bf5a3e674bce9493ea2d92f5c091af033da948dc17beb90625dd651cf2788f9503f1fdf7c2b1c69e0e61dde9

Download Submit
/data/user/0/fish.jar.dope/[email protected]!classes3.dex

Filesize
235KB

MD5
dd3cd0838272e87711920604b8d347ca

SHA1
6547dd3669f5b3a45c90f05fe58bc6dc805234ea

SHA256
98cabb0659abd8de73be4ed29b111b88de09b19dd3e3d927caec1fa9318eefa2

SHA512
b355ca1bad47598e90b639836fba9f804de1c7dc74d4e00d17a0bdff7b3239e2f5aa6a3e56d53882ecba71306a2fb01e691b7ae762f39d7c419f79493ef23f77

Download Submit
/data/user/0/fish.jar.dope/[email protected]!classes4.dex

Filesize
238KB

MD5
9323879247b7eab84bbf8cea00109067

SHA1
aa863f0b792fa01cf5b727bbb0824fb0bd08eaf0

SHA256
000b7c7c4e5d8aa12474fa2d6f993389b6393c29267a8a85d3ccccbbd0042e26

SHA512
7b6a6428d0d4384b1b7a6d08425db23aef6798e6bcd60d8b72fd47375370fa202521fe4205378cc114a01f1cf067a40e25a5619c78a732485c1990879ed8df65

Download Submit
/data/user/0/fish.jar.dope/[email protected]!classes5.dex

Filesize
254KB

MD5
911e5d131c35de135c9b596131315fd2

SHA1
961535c479f33c2403f6d32ef39c4700c963c120

SHA256
66056234d698fb46e70752d369db410b1409d0039e592af523f0b21bb1da08d6

SHA512
6cbd658280e4a5cb9edd0174043fe4510d2df2948af646398cf067b04962fc000743dc146f53690ac158683fc6e4531d02082ea640d1a3dffab42339241da484

Download Submit
/data/user/0/fish.jar.dope/[email protected]!classes6.dex

Filesize
239KB

MD5
0564de8a9a3fb2be0c4be1fbd8a9a0c5

SHA1
bf4c1e3190598a7fdf1ead9c17b4a40daa78ed49

SHA256
e2c5bcad8c68d24dad4d86c6fa0eed681bdcfe3c72a60aa8e3b156b860752d24

SHA512
16c59c0242742cd5e9b5645af2e7e1bf15207234c4aee97592acad4fd13e5a966be54d1536407d480d0d58ef3ae718f6555cd1162c438964405640bc68ed9ba9

Download Submit
/data/user/0/fish.jar.dope/[email protected]!classes7.dex

Filesize
263KB

MD5
6a0632531a3ca0e3c3dee595698b0456

SHA1
08aeb42ee97610b0485e3a26f1441fbf3600332d

SHA256
ac921574bf48a8168cb092cf2c89cce4f3c03cc1cb57c92b5370f4f38d43dfa7

SHA512
8d8416695800050ca5de001daef75bf51ef0809beb3f384bf3388ac1cff4cd6d6084bfc42ebfdacb043a2fb139c40c4644ced430107c0503c3ed09343e6c6d28

Download Submit
/data/user/0/fish.jar.dope/[email protected]!classes8.dex

Filesize
247KB

MD5
9b6c4058069fdcc07772da23c651c50b

SHA1
6e8f8a59820cdf17466f76df61bc69eda8e289d6

SHA256
e3f3553f4c495719a77fea434743066263cba8f408e7eb43c2232fe645d5ab48

SHA512
d3eedcf9ae86c0b223b26301e0f536f69a69fb7b7a57cf437121d0e8f203f23a081cabac8b69b85e0c9c151bb8d1fd89df9dce7e62fc3b94a375297f6eab84dd

Download Submit
/data/user/0/fish.jar.dope/[email protected]!classes9.dex

Filesize
251KB

MD5
9506778317d0d581fd875ab9ed15d84d

SHA1
45ff898d417a531a0d278528177da9ddaa05f3c1

SHA256
3761f48e321208d836f2c651e48bc11dc0f9e667cc00948bd1917682264be2e2

SHA512
024623783efc4ea683cabeb5678edd44bdfea8a6698e3a925df8c7436ec9af197039556f9b7aa4c6f8a45179bf8e4e3292dcc93aa10a661a28a526863edb91b5

Download Submit
/data/user/0/fish.jar.dope/files/mmkv/mmkv.default

Filesize
4KB

MD5
620f0b67a91f7f74151bc5be745b7110

SHA1
1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d

SHA256
ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7

SHA512
2d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d

Download Submit
/data/user/0/fish.jar.dope/oat/x86_64/[email protected]

Filesize
503B

MD5
143a647d966fc09ac854ceffa783e675

SHA1
c20eb2a4b2535e55839d964aa2af58a2da7294ca

SHA256
17d00abacbfe0b9148034c5ebfc86688b7374cc95a8d626bcc06cd46d5322f97

SHA512
b73a6a742339cc2e84a2466bb94da783626718622c029204a304f5c538ad8968ed913d9f9702af1ba34ac0c5789986003be0ceb2f573660af7f6ffbf2879554a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads