Analysis
-
max time kernel
129s -
max time network
151s -
platform
android_x64 -
resource
android-x64-20240514-en -
resource tags
-
submitted
23-05-2024 22:05
General
-
Target
6c6868812c3476dab272f10b18663313_JaffaCakes118.apk
-
Size
3.7MB
-
MD5
6c6868812c3476dab272f10b18663313
-
SHA1
1de4223fa1a65235f69ae30834c362f108d0abbf
-
SHA256
65f1d1574f859e0a13151ffd8d78e4a68a4279baa31c96d6faf194cabffeca29
-
SHA512
c887a9135f4bcd47f961f6a8e2a105ba3518a550f64a2ba4fbc9f20e76a1b78d8e48c2279e60a523a8782b2d9820df44a0cf79fe5014fe45d33a243b8595a1cc
-
SSDEEP
98304:DFKV8eTeOC6tcBEA5o5S8L4E5fsbDQ/aAiCmNLg:RM8eTeOMBh85qbDBSF
Malware Config
Signatures
-
Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
-
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
-
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks if the internet connection is available 1 TTPs 1 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.baoyi.weixinlingsheng1⤵
- Requests cell location
- Checks memory information
- Obtains sensitive information copied to the device clipboard
- Queries information about the current Wi-Fi connection
- Queries information about the current nearby Wi-Fi networks
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.baoyi.weixinlingsheng/files/__local_last_session.jsonFilesize
116B
MD50d16a5e6f5cb67e222fc016560df1331
SHA1aa6c7fcf86b1b3b5259f23853e8298b8bdf420d6
SHA256a7bd2541800060c1c65e1bcde2a3ec2266ce3f1cdc23715359b37aa46d4cb55c
SHA5129cc82171aa5211ca1c8adf5e36eefc65658643081515be1306876bccb05543939910a8649ee270d34a5395b510d12e8699f27f17e867f91af35408b920bb0ca6
-
/data/data/com.baoyi.weixinlingsheng/files/__local_stat_cache.jsonFilesize
25B
MD52d805b13f2f28dc3ca9bbcc000f49bb5
SHA19eac165b4d81258fd3967cde5cc53b53b1dabcb1
SHA256c8a6624f390568f0ddcb9841336aec6a564460fdaf6624e562b32935b8956f19
SHA5125db8c57bab36bcf9db698c1dce70318cbffc156dd1d1c1e09e5b7ba60aff07b598ebbf26c4bd8a2b03bd6e59ef2dde2d944a22a8d8a19ecc8378e83afb7c83b0