65f1d1574f859e0a13151ffd8d78e4a68a4279baa31c96d6faf194cabffeca29

Analysis

max time kernel
88s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240514-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
submitted
23-05-2024 22:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6c6868812c3476dab272f10b18663313_JaffaCakes118.apk
Size

3.7MB
MD5

6c6868812c3476dab272f10b18663313
SHA1

1de4223fa1a65235f69ae30834c362f108d0abbf
SHA256

65f1d1574f859e0a13151ffd8d78e4a68a4279baa31c96d6faf194cabffeca29
SHA512

c887a9135f4bcd47f961f6a8e2a105ba3518a550f64a2ba4fbc9f20e76a1b78d8e48c2279e60a523a8782b2d9820df44a0cf79fe5014fe45d33a243b8595a1cc
SSDEEP

98304:DFKV8eTeOC6tcBEA5o5S8L4E5fsbDQ/aAiCmNLg:RM8eTeOMBh85qbDBSF

Score

8^/10

collection credential_access discovery evasion impact

Malware Config

Signatures

Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
collection discovery evasion

Location Tracking
T1430

Geofencing
T1627.001

Processes:

com.baoyi.weixinlingsheng

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getCellLocation com.baoyi.weixinlingsheng
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.baoyi.weixinlingsheng

description ioc process

File opened for read /proc/meminfo com.baoyi.weixinlingsheng
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
collection credential_access impact

Clipboard Data
T1414

Transmitted Data Manipulation
T1641.001

Processes:

com.baoyi.weixinlingsheng

description ioc process

Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.baoyi.weixinlingsheng
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

System Network Connections Discovery
T1421

Processes:

com.baoyi.weixinlingsheng

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.baoyi.weixinlingsheng
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

com.baoyi.weixinlingsheng

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.baoyi.weixinlingsheng
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

com.baoyi.weixinlingsheng

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.baoyi.weixinlingsheng

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.baoyi.weixinlingsheng

description	ioc	process
File opened for read	/proc/meminfo	com.baoyi.weixinlingsheng

description	ioc	process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.baoyi.weixinlingsheng

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.baoyi.weixinlingsheng

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.baoyi.weixinlingsheng

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.baoyi.weixinlingsheng

com.baoyi.weixinlingsheng
1⤵
- Requests cell location
- Checks memory information
- Obtains sensitive information copied to the device clipboard
- Queries information about the current Wi-Fi connection
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4600

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Location Tracking

T1430

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.baoyi.weixinlingsheng/files/__local_last_session.json
Filesize
116B

MD5
2f0f62df66e0902640054d900ddd5fa5

SHA1
fc79d45972a14eb157bdeb44a4d45790bb546a4b

SHA256
ee06f3f1fe63e5b53b443f677a017ba8333651929cdcf77559bc70e15edbe7ba

SHA512
7db1f3d521e6f229cbf41f8a4d8957f6699749816f95a03009c63d493e878938d07a859f046e168c8cd7f5c07b3313749e12240275e7e60037603b7656c2e1bb

Download Submit
/data/user/0/com.baoyi.weixinlingsheng/files/__local_stat_cache.json
Filesize
25B

MD5
2d805b13f2f28dc3ca9bbcc000f49bb5

SHA1
9eac165b4d81258fd3967cde5cc53b53b1dabcb1

SHA256
c8a6624f390568f0ddcb9841336aec6a564460fdaf6624e562b32935b8956f19

SHA512
5db8c57bab36bcf9db698c1dce70318cbffc156dd1d1c1e09e5b7ba60aff07b598ebbf26c4bd8a2b03bd6e59ef2dde2d944a22a8d8a19ecc8378e83afb7c83b0

Download Submit