2c7d76619ec8ce38ac307c715b8f39aaa0ac6d30364a02c871fc49473da3b6ea

Analysis

max time kernel
179s
max time network
180s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
23-05-2024 11:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6abe95e889da95bf6ea8fe3b381301b4_JaffaCakes118.apk
Size

6.5MB
MD5

6abe95e889da95bf6ea8fe3b381301b4
SHA1

f35be4b0b3ae9795dcef262f76343ce4a11d8959
SHA256

2c7d76619ec8ce38ac307c715b8f39aaa0ac6d30364a02c871fc49473da3b6ea
SHA512

8cf0c9087c8abe60d1ab7e3c819bfaecca98c36238db3513dd111b8ff7fc80ebe338632f35cd8dd10852abf6cbf44ebd26c91d09a6bd945a0477f008a1b22c1b
SSDEEP

196608:VQeDJTsjwEoeWNGDCG/rx4XDXlnBKsMCrIwktW:9DJ4kEKoeG14jlndMbNtW

Score

8^/10

discovery evasion impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 4 IoCs

evasion

System Information Discovery

T1426

Processes:

com.lanqiulsapp.lslsaiyyh/system/bin/sh -c type sucom.lanqiulsapp.lslsaiyyh:multiprocess/system/bin/sh -c type su

ioc	process
/system/app/Superuser.apk	com.lanqiulsapp.lslsaiyyh
/sbin/su	/system/bin/sh -c type su
/system/app/Superuser.apk	com.lanqiulsapp.lslsaiyyh:multiprocess
/sbin/su	/system/bin/sh -c type su

Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

com.lanqiulsapp.lslsaiyyh

description ioc process

File opened for read /proc/cpuinfo com.lanqiulsapp.lslsaiyyh

description	ioc	process
File opened for read	/proc/cpuinfo	com.lanqiulsapp.lslsaiyyh

Checks memory information 2 TTPs 2 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

Processes:

com.lanqiulsapp.lslsaiyyh:multiprocesscom.lanqiulsapp.lslsaiyyh

description	ioc	process
File opened for read	/proc/meminfo	com.lanqiulsapp.lslsaiyyh:multiprocess
File opened for read	/proc/meminfo	com.lanqiulsapp.lslsaiyyh

Loads dropped Dex/Jar 1 TTPs 5 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

Processes:

com.lanqiulsapp.lslsaiyyh/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.lanqiulsapp.lslsaiyyh/mix.dex --output-vdex-fd=57 --oat-fd=58 --oat-location=/data/data/com.lanqiulsapp.lslsaiyyh/oat/x86/mix.odex --compiler-filter=quicken --class-loader-context=&com.lanqiulsapp.lslsaiyyh:multiprocess

ioc	pid	process
/data/data/com.lanqiulsapp.lslsaiyyh/mix.dex	4280	com.lanqiulsapp.lslsaiyyh
/data/data/com.lanqiulsapp.lslsaiyyh/mix.dex	4380	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.lanqiulsapp.lslsaiyyh/mix.dex --output-vdex-fd=57 --oat-fd=58 --oat-location=/data/data/com.lanqiulsapp.lslsaiyyh/oat/x86/mix.odex --compiler-filter=quicken --class-loader-context=&
/data/data/com.lanqiulsapp.lslsaiyyh/mix.dex	4280	com.lanqiulsapp.lslsaiyyh
/data/data/com.lanqiulsapp.lslsaiyyh/mix.dex	4421	com.lanqiulsapp.lslsaiyyh:multiprocess
/data/data/com.lanqiulsapp.lslsaiyyh/mix.dex	4421	com.lanqiulsapp.lslsaiyyh:multiprocess

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

Processes:

com.lanqiulsapp.lslsaiyyhcom.lanqiulsapp.lslsaiyyh:multiprocess

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.lanqiulsapp.lslsaiyyh
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.lanqiulsapp.lslsaiyyh:multiprocess

Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

System Network Configuration Discovery
T1422

Processes:

com.lanqiulsapp.lslsaiyyh

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.lanqiulsapp.lslsaiyyh

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.lanqiulsapp.lslsaiyyh

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs

persistence

Broadcast Receivers

T1624.001

Processes:

com.lanqiulsapp.lslsaiyyhcom.lanqiulsapp.lslsaiyyh:multiprocess

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.lanqiulsapp.lslsaiyyh
Framework service call	android.app.IActivityManager.registerReceiver	com.lanqiulsapp.lslsaiyyh:multiprocess

Checks if the internet connection is available 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

Processes:

com.lanqiulsapp.lslsaiyyh:multiprocesscom.lanqiulsapp.lslsaiyyh

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.lanqiulsapp.lslsaiyyh:multiprocess
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.lanqiulsapp.lslsaiyyh

Checks the presence of a debugger
evasion
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

com.lanqiulsapp.lslsaiyyh:multiprocess

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.lanqiulsapp.lslsaiyyh:multiprocess

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.lanqiulsapp.lslsaiyyh:multiprocess

com.lanqiulsapp.lslsaiyyh
1⤵
- Checks if the Android device is rooted.
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:4280
- sh -c getprop ro.yunos.version
  2⤵
  PID:4354
- getprop ro.yunos.version
  2⤵
  PID:4354
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.lanqiulsapp.lslsaiyyh/mix.dex --output-vdex-fd=57 --oat-fd=58 --oat-location=/data/data/com.lanqiulsapp.lslsaiyyh/oat/x86/mix.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4380
- logcat -d -v threadtime
  2⤵
  PID:4507
- /system/bin/sh -c getprop ro.build.nubia.rom.name
  2⤵
  PID:5101
- getprop ro.build.nubia.rom.name
  2⤵
  PID:5101
- /system/bin/sh -c getprop ro.meizu.product.model
  2⤵
  PID:5125
- getprop ro.meizu.product.model
  2⤵
  PID:5125
- /system/bin/sh -c getprop ro.build.version.opporom
  2⤵
  PID:5149
- getprop ro.build.version.opporom
  2⤵
  PID:5149
- /system/bin/sh -c getprop ro.vivo.os.build.display.id
  2⤵
  PID:5174
- getprop ro.vivo.os.build.display.id
  2⤵
  PID:5174
- /system/bin/sh -c getprop ro.aa.romver
  2⤵
  PID:5198
- getprop ro.aa.romver
  2⤵
  PID:5198
- /system/bin/sh -c getprop ro.lewa.version
  2⤵
  PID:5223
- getprop ro.lewa.version
  2⤵
  PID:5223
- /system/bin/sh -c getprop ro.gn.gnromvernumber
  2⤵
  PID:5249
- getprop ro.gn.gnromvernumber
  2⤵
  PID:5249
- /system/bin/sh -c getprop ro.build.tyd.kbstyle_version
  2⤵
  PID:5274
- getprop ro.build.tyd.kbstyle_version
  2⤵
  PID:5274
- /system/bin/sh -c getprop ro.build.fingerprint
  2⤵
  PID:5299
- getprop ro.build.fingerprint
  2⤵
  PID:5299
- /system/bin/sh -c getprop ro.build.rom.id
  2⤵
  PID:5323
- getprop ro.build.rom.id
  2⤵
  PID:5323
- /system/bin/sh -c type su
  2⤵
  - Checks if the Android device is rooted.
  PID:5347

com.lanqiulsapp.lslsaiyyh:multiprocess
1⤵
- Checks if the Android device is rooted.
- Checks memory information
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4421
- sh -c getprop ro.yunos.version
  2⤵
  PID:4478
- getprop ro.yunos.version
  2⤵
  PID:4478
- logcat -d -v threadtime
  2⤵
  PID:4705
- /system/bin/sh -c getprop ro.miui.ui.version.name
  2⤵
  PID:4726
- getprop ro.miui.ui.version.name
  2⤵
  PID:4726
- /system/bin/sh -c getprop ro.build.version.emui
  2⤵
  PID:4751
- getprop ro.build.version.emui
  2⤵
  PID:4751
- /system/bin/sh -c getprop ro.lenovo.series
  2⤵
  PID:4776
- getprop ro.lenovo.series
  2⤵
  PID:4776
- /system/bin/sh -c getprop ro.build.nubia.rom.name
  2⤵
  PID:4801
- getprop ro.build.nubia.rom.name
  2⤵
  PID:4801
- /system/bin/sh -c getprop ro.meizu.product.model
  2⤵
  PID:4843
- getprop ro.meizu.product.model
  2⤵
  PID:4843
- /system/bin/sh -c getprop ro.build.version.opporom
  2⤵
  PID:4867
- getprop ro.build.version.opporom
  2⤵
  PID:4867
- /system/bin/sh -c getprop ro.vivo.os.build.display.id
  2⤵
  PID:4894
- getprop ro.vivo.os.build.display.id
  2⤵
  PID:4894
- /system/bin/sh -c getprop ro.aa.romver
  2⤵
  PID:4918
- getprop ro.aa.romver
  2⤵
  PID:4918
- /system/bin/sh -c getprop ro.lewa.version
  2⤵
  PID:4942
- getprop ro.lewa.version
  2⤵
  PID:4942
- /system/bin/sh -c getprop ro.gn.gnromvernumber
  2⤵
  PID:4967
- getprop ro.gn.gnromvernumber
  2⤵
  PID:4967
- /system/bin/sh -c getprop ro.build.tyd.kbstyle_version
  2⤵
  PID:4991
- getprop ro.build.tyd.kbstyle_version
  2⤵
  PID:4991
- /system/bin/sh -c getprop ro.build.fingerprint
  2⤵
  PID:5026
- getprop ro.build.fingerprint
  2⤵
  PID:5026
- /system/bin/sh -c getprop ro.build.rom.id
  2⤵
  PID:5053
- getprop ro.build.rom.id
  2⤵
  PID:5053
- /system/bin/sh -c type su
  2⤵
  - Checks if the Android device is rooted.
  PID:5077

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.lanqiulsapp.lslsaiyyh/databases/bugly_db_legu

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.lanqiulsapp.lslsaiyyh/databases/bugly_db_legu-journal

Filesize
189KB

MD5
8326567fab6bf3985c67d8982c69616c

SHA1
a29dce3e4e0a506f165036e38eaf2cd24a9f21ad

SHA256
ec96eab577a7f7d3180ebbda0a67d2619d1402fcda8b638556d58b10a76f725c

SHA512
d2342d44391ae1e7ddc967762aaf54df0f63f766ccdc00a22b73500ec560219d9e2af518d1cd545f4ae6e39d88844961096a528543751ccf92da96dfc178a651

Download Submit
/data/data/com.lanqiulsapp.lslsaiyyh/databases/bugly_db_legu-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.lanqiulsapp.lslsaiyyh/databases/bugly_db_legu-wal

Filesize
277KB

MD5
8aeafe28b493c47c70562b351d2f7a07

SHA1
19ed077a35a13cf8860b570c305227d43056a36e

SHA256
ebcac0ad862947f5b3797b23beca77474100cd88c590b59fbe72019d1b3b8498

SHA512
72f37b2f376b429763d94519c36e1aaf41c9ddc919f4adb3b6d9d9ee57437561dc28b153241c43505826914194b9d42f663f3763c4c174bb01573bcb8d59947d

Download Submit
/data/data/com.lanqiulsapp.lslsaiyyh/files/jpush_stat_cache.json

Filesize
189B

MD5
5343d97b1cc0878b94ba6ea5ef87afe1

SHA1
4e812e991566ef8e353a9b20e713461bff4ee157

SHA256
2aa07c045922c069c5daa04326a63b91ff5a811c7ea1a2a548a41d3be7f725c4

SHA512
59b07159f99b332d2a53cc05e7e74798d712afb5cbaae9d86823af4f80d3583a293ff659f294c3b430f9e26e787e1671b2e3e7afe45892c8622ed1f02636ed22

Download Submit
/data/data/com.lanqiulsapp.lslsaiyyh/files/jpush_stat_cache_history.json

Filesize
166B

MD5
3faea734e59735596724762a525b6b39

SHA1
57f9d7752733dd99cd6bdef454e99f24fa3b717f

SHA256
7d9374b9ffd0ca88df7bd5ee303c669a5f026ba20ca1b31dc890b98e0450025e

SHA512
391b972fb2bbd993be4693999af056a63cf82aabff407cd3785de59f428e32b8b967d78ed7bfc29c476cfda619a5ac306117c81ce9a28db011983e82d11ba878

Download Submit
/data/data/com.lanqiulsapp.lslsaiyyh/files/jpush_stat_cache_history.json

Filesize
355B

MD5
2be8dfe3171b0686e5068ef2aa3cf8bf

SHA1
eae2f32bfd0dd25bcfa4f2c484bd2dd5fc9155e8

SHA256
9a45341d32b3eb17c2fcddb14c827f059fb0de46764978fa2b6c415ae035ed15

SHA512
29e2db96edb38c2bdbf0413f6a74e2dcde81414f1ba952af770529e2b5ec75f82945f78aee6da1921565b9ff3c69f463ab8c7f60da551aec0f05f07d61907889

Download Submit
/data/data/com.lanqiulsapp.lslsaiyyh/files/jpush_stat_cache_history.json

Filesize
174B

MD5
6347e04c48fde78f46a186ece7d31362

SHA1
74b9172c685ef52ba16d6a8aefae71b9b5808a79

SHA256
aa698b8b67fa84964dd04ad3ab2b46d877e3be8d9d4dd70577b4e13158fbafbf

SHA512
f8e921bac8e6d6cc7bdd68ce9ef3a3153c1281d460783ef228262b1e8578238427eeefbaf1acf5220171b4cafae598ec8c3b10778107fa8fe4fcc222892b2352

Download Submit
/data/data/com.lanqiulsapp.lslsaiyyh/mix.dex

Filesize
292B

MD5
63f77f99bd2c2b772a479923bde11974

SHA1
c7632e7d301e4463fafce85f84e9c3d7da3fdbbe

SHA256
4c76a3af64cdd2f8713ffe2733dea50dbe714d0ca41c17d1847ee5b62a7ca615

SHA512
3aae4a89d1ed51fdd911cb367eb10afe3c2264e4222085891b18a60d5412f85d10bf5c8f3c6642db70abb9aa42732bac5c42c42ee32d587100f53c21b5beb16c

Download Submit
/data/data/com.lanqiulsapp.lslsaiyyh/tinker_server/77125548a3431559_version.info

Filesize
181B

MD5
ac37a1a95a056c6d6bdaefd5cda06755

SHA1
95b77e369f93e346b290a383594a67a1a29d8c66

SHA256
487e35cf316626010d5581ce8d2e39192707cc9954e9001104e1d319096f5dc6

SHA512
e4ec4968e0cc0c0d8e4818ed6b233feca16f67a2327b3e35cfc9350c921bba9826a2c584e5cda8c3b2316dc72c3998986b7f09c19974f62ad707b6d2a5b222bc

Download Submit
/storage/emulated/0/data/.push_deviceid

Filesize
32B

MD5
18517d399f3d6174d8d3229fb62b513f

SHA1
f33d723d2be5978193cfd99b8e3cf1fae86c9bda

SHA256
746eb9fb465be9d3e5e7474bcf58ce44d36e0ae8a08bfc245dee8948c8dae44a

SHA512
118fee2a546c1b959946df21a5c0155a35f5a763dbee948c36f82d129395389c397fd894864691e04c45daddd48ae78345defbfbd9f71d9598e5860147c01d0b

Download Submit