Analysis
-
max time kernel
17s -
max time network
139s -
platform
android_x86 -
resource
android-x86-arm-20240514-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system -
submitted
23-05-2024 08:00
Static task
static1
Behavioral task
behavioral1
Sample
6a45c5ed1aad37ca45b47dfea646550d_JaffaCakes118.apk
Resource
android-x86-arm-20240514-en
General
-
Target
6a45c5ed1aad37ca45b47dfea646550d_JaffaCakes118.apk
-
Size
10.0MB
-
MD5
6a45c5ed1aad37ca45b47dfea646550d
-
SHA1
8a4ba55faddfc1b017da4af98490a0348957d3df
-
SHA256
9dc48fa9f7d85d9c5d8bb7b443f1c13c5f9ee115229ac2199d73998659d239ae
-
SHA512
8833b531613f52c4f4e2c9e082d400e6206dd938b2c44d30555477464aa4942a1fad3e2a9929ca84c343b2c1eb7ba9e28210942617a2df9a267bf7fca664251d
-
SSDEEP
196608:l11fHT2tTsQScwzCKrhPbbWbvXYIsY3LwuISn/SlAh1IqRXwSD0pL+YjeaUz:71fojwuK1PAs2zn6lS1ZRASgkWpU
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 2 IoCs
Processes:
com.kuaijiexiyi.mvt/system/bin/sh -c type suioc process /system/app/Superuser.apk com.kuaijiexiyi.mvt /sbin/su /system/bin/sh -c type su -
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
Processes:
com.kuaijiexiyi.mvtdescription ioc process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.kuaijiexiyi.mvt -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
com.kuaijiexiyi.mvtdescription ioc process Framework service call android.app.IActivityManager.registerReceiver com.kuaijiexiyi.mvt -
Checks if the internet connection is available 1 TTPs 1 IoCs
Processes:
com.kuaijiexiyi.mvtdescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.kuaijiexiyi.mvt -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes:
com.kuaijiexiyi.mvtdescription ioc process Framework API call javax.crypto.Cipher.doFinal com.kuaijiexiyi.mvt
Processes
-
com.kuaijiexiyi.mvt1⤵
- Checks if the Android device is rooted.
- Checks memory information
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
-
/system/bin/sh -c getprop ro.board.platform2⤵
-
getprop ro.board.platform2⤵
-
/system/bin/sh -c type su2⤵
- Checks if the Android device is rooted.
-
logcat -d -v threadtime2⤵
-
logcat -d -v threadtime2⤵
-
/system/bin/sh -c getprop ro.miui.ui.version.name2⤵
-
getprop ro.miui.ui.version.name2⤵
-
/system/bin/sh -c getprop ro.build.version.emui2⤵
-
getprop ro.build.version.emui2⤵
-
/system/bin/sh -c getprop ro.lenovo.series2⤵
-
getprop ro.lenovo.series2⤵
-
/system/bin/sh -c getprop ro.build.nubia.rom.name2⤵
-
getprop ro.build.nubia.rom.name2⤵
-
/system/bin/sh -c getprop ro.meizu.product.model2⤵
-
getprop ro.meizu.product.model2⤵
-
/system/bin/sh -c getprop ro.build.version.opporom2⤵
-
getprop ro.build.version.opporom2⤵
-
/system/bin/sh -c getprop ro.vivo.os.build.display.id2⤵
-
getprop ro.vivo.os.build.display.id2⤵
-
/system/bin/sh -c getprop ro.aa.romver2⤵
-
getprop ro.aa.romver2⤵
-
/system/bin/sh -c getprop ro.lewa.version2⤵
-
getprop ro.lewa.version2⤵
-
/system/bin/sh -c getprop ro.gn.gnromvernumber2⤵
-
getprop ro.gn.gnromvernumber2⤵
-
/system/bin/sh -c getprop ro.build.tyd.kbstyle_version2⤵
-
getprop ro.build.tyd.kbstyle_version2⤵
-
/system/bin/sh -c getprop ro.build.fingerprint2⤵
-
getprop ro.build.fingerprint2⤵
-
/system/bin/sh -c getprop ro.build.rom.id2⤵
-
getprop ro.build.rom.id2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.kuaijiexiyi.mvt/databases/bugly_db_leguFilesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
/data/data/com.kuaijiexiyi.mvt/databases/bugly_db_legu-journalFilesize
512B
MD52ef3f5c672aa6ca2a67130baee9e843b
SHA1849ee008f55db11f401e074379abdc2447d35cd0
SHA256e7797cb515b21984adc4b1c5199c55964f73e23680e914932a742f4c34df1883
SHA512a8501dbd2c7fb5c7c7370a8c9bf8bb9a16f4263b20e946f419fbe6a5c71b7761ed80c107ef77c4a0629dd023f20a13b4857d96202eb1549f19ae702ca74a3bd7
-
/data/data/com.kuaijiexiyi.mvt/databases/bugly_db_legu-shmFilesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
/data/data/com.kuaijiexiyi.mvt/databases/bugly_db_legu-walFilesize
197KB
MD55e216812f31d627efe42da68f897231b
SHA1c8afa49287e406758c082fd004444929da86dc57
SHA256cf59cefb73e2a5bcb5e87dcf1016b3d015cb6454b8d23817b5c06806366e9578
SHA5124828e02b6d09d1855e9ccf9ad92779dedcd8f117da60acbb4391df4a5a10ea1e94e652b8993346b8bbae3319a8748eb3c8375f14a25b45cd9731c51c8fe90799