c277751c7a61c14160d659bc8966a08e7548e0c9d9d4d05c083229c647633c73

Analysis

max time kernel
18s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
23-05-2024 03:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6987d30569de8a77816f6f739e1bdf71_JaffaCakes118.apk
Size

30.6MB
MD5

6987d30569de8a77816f6f739e1bdf71
SHA1

c9662628870d9a6d25a86bd810340e3df62cf718
SHA256

c277751c7a61c14160d659bc8966a08e7548e0c9d9d4d05c083229c647633c73
SHA512

60b275f9329920d78cae1a50f159a456f5abf7ff3f231269186ff321178393a3540ad192e3f2a5dc617709dfe9ee218d5d9e77161507cce29118fb21faa17401
SSDEEP

786432:fPVHuS6Eanhhk+BEKyAz3HKU/Q/ZfQ3Oo/iwVu5:3JqfkQEKyAz3HK4QmOo8

Score

8^/10

discovery evasion impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs
evasion

T1426

Processes:

com.itangyuan/system/bin/sh -c type su

ioc process

/system/app/Superuser.apk com.itangyuan
/sbin/su /system/bin/sh -c type su
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
evasion discovery

T1633.001

T1426

Processes:

com.itangyuan

description ioc process

File opened for read /proc/meminfo com.itangyuan
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

T1421

Processes:

com.itangyuan

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.itangyuan
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

T1624.001

Processes:

com.itangyuan

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.itangyuan
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

T1421

Processes:

com.itangyuan

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.itangyuan
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

T1471

Processes:

com.itangyuan

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.itangyuan

ioc	process
/system/app/Superuser.apk	com.itangyuan
/sbin/su	/system/bin/sh -c type su

description	ioc	process
File opened for read	/proc/meminfo	com.itangyuan

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.itangyuan

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.itangyuan

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.itangyuan

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.itangyuan

com.itangyuan
1⤵
- Checks if the Android device is rooted.
- Checks memory information
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4276

/system/bin/sh -c getprop ro.board.platform
2⤵
PID:4342

getprop ro.board.platform
2⤵
PID:4342

/system/bin/sh -c type su
2⤵
- Checks if the Android device is rooted.
PID:4370

logcat -d -v threadtime
2⤵
PID:4400

logcat -d -v threadtime
2⤵
PID:4417

/system/bin/sh -c getprop ro.miui.ui.version.name
2⤵
PID:4454

getprop ro.miui.ui.version.name
2⤵
PID:4454

/system/bin/sh -c getprop ro.build.version.emui
2⤵
PID:4485

getprop ro.build.version.emui
2⤵
PID:4485

/system/bin/sh -c getprop ro.lenovo.series
2⤵
PID:4509

getprop ro.lenovo.series
2⤵
PID:4509

/system/bin/sh -c getprop ro.build.nubia.rom.name
2⤵
PID:4533

getprop ro.build.nubia.rom.name
2⤵
PID:4533

/system/bin/sh -c getprop ro.meizu.product.model
2⤵
PID:4558

getprop ro.meizu.product.model
2⤵
PID:4558

/system/bin/sh -c getprop ro.build.version.opporom
2⤵
PID:4585

getprop ro.build.version.opporom
2⤵
PID:4585

/system/bin/sh -c getprop ro.vivo.os.build.display.id
2⤵
PID:4610

getprop ro.vivo.os.build.display.id
2⤵
PID:4610

/system/bin/sh -c getprop ro.aa.romver
2⤵
PID:4634

getprop ro.aa.romver
2⤵
PID:4634

/system/bin/sh -c getprop ro.lewa.version
2⤵
PID:4663

getprop ro.lewa.version
2⤵
PID:4663

/system/bin/sh -c getprop ro.gn.gnromvernumber
2⤵
PID:4688

getprop ro.gn.gnromvernumber
2⤵
PID:4688

/system/bin/sh -c getprop ro.build.tyd.kbstyle_version
2⤵
PID:4713

getprop ro.build.tyd.kbstyle_version
2⤵
PID:4713

/system/bin/sh -c getprop ro.build.fingerprint
2⤵
PID:4737

getprop ro.build.fingerprint
2⤵
PID:4737

/system/bin/sh -c getprop ro.build.rom.id
2⤵
PID:4761

getprop ro.build.rom.id
2⤵
PID:4761

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.itangyuan/databases/bugly_db_legu
Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.itangyuan/databases/bugly_db_legu-journal
Filesize
512B

MD5
6bd6629b7b65ea2635d76bf95645284c

SHA1
f79fbe14161fa7ce47d312e94b80efe6dfd30200

SHA256
38c3585e6c4b377200140ce91d07ae18eda2900dd281b8eb7d81631da01bc3f1

SHA512
1f8adcc89bcc47e09c7b448f8aad93c249c41b9af346027c7b116e4e20a2b229deb1240eb763b3a0ea13d51fcdeb793f5a7f7f2684a79c8b721fc168a1e2c49b

Download Submit
/data/data/com.itangyuan/databases/bugly_db_legu-shm
Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.itangyuan/databases/bugly_db_legu-wal
Filesize
237KB

MD5
26c644206f7d6e6b72c5b1c193550ace

SHA1
97b5859b9b1c35e6c9dee6b383fff21a0ec43362

SHA256
b6a87ce93071e61aa080e61f963edcc14d08c7333e0b1b8dc60f98d5589fec99

SHA512
0dd788d1d672429a904934f8d9bdd8be4912072f6aa657720d4025752fa942fab7fc49c7732ea4d17e1da36f3a987e872c13468368a42483b4d4114e5c1c384d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads