76bc03a9c2c03fd86eef6e7e562eaa18fb184daff791b59d29c69c66604a812c

Analysis

max time kernel
65s
max time network
180s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
23-05-2024 10:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6ab48143125de5598a5c4d8d80092954_JaffaCakes118.apk
Size

2.0MB
MD5

6ab48143125de5598a5c4d8d80092954
SHA1

53c62c6a12ffb7a54b4a27a108587656b5901c06
SHA256

76bc03a9c2c03fd86eef6e7e562eaa18fb184daff791b59d29c69c66604a812c
SHA512

8ad50bff70891def71c212208f05cf1da2d2e1438a957a14f72f56998707fc1ebe57c91cc6f48ebde1cbbc60401c2c633d06befa2fbc4fccb68e6a69832b0897
SSDEEP

49152:D0D77lEdgMINw6QaCza7kW9u0kzH81E954Ut:o7l5Nw6Qaya7kSnkDOE954Ut

Score

8^/10

collection credential_access discovery evasion impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs
evasion

T1426

Processes:

com.losg.xiaozhulaihua

ioc process

/system/app/Superuser.apk com.losg.xiaozhulaihua
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
evasion discovery

T1633.001

T1426

Processes:

com.losg.xiaozhulaihua

description ioc process

File opened for read /proc/cpuinfo com.losg.xiaozhulaihua
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
evasion discovery

T1633.001

T1426

Processes:

com.losg.xiaozhulaihua

description ioc process

File opened for read /proc/meminfo com.losg.xiaozhulaihua
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
collection credential_access impact

T1414

T1641.001

Processes:

com.losg.xiaozhulaihua

description ioc process

Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.losg.xiaozhulaihua
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
discovery

T1424

Processes:

com.losg.xiaozhulaihua

description ioc process

Framework service call android.app.IActivityManager.getRunningAppProcesses com.losg.xiaozhulaihua
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

T1421

Processes:

com.losg.xiaozhulaihua

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.losg.xiaozhulaihua
Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
discovery

T1421

Processes:

com.losg.xiaozhulaihua

description ioc process

Framework service call android.net.wifi.IWifiManager.getScanResults com.losg.xiaozhulaihua
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

T1422

Processes:

com.losg.xiaozhulaihua

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.losg.xiaozhulaihua
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

T1624.001

Processes:

com.losg.xiaozhulaihua

description ioc process

Framework service call android.app.IActivityManager.registerReceiver com.losg.xiaozhulaihua
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

T1421

Processes:

com.losg.xiaozhulaihua

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.losg.xiaozhulaihua
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
evasion

T1628.002

Processes:

com.losg.xiaozhulaihua

description ioc process

Framework API call android.hardware.SensorManager.registerListener com.losg.xiaozhulaihua
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

T1471

Processes:

com.losg.xiaozhulaihua

description ioc process

Framework API call javax.crypto.Cipher.doFinal com.losg.xiaozhulaihua

ioc	process
/system/app/Superuser.apk	com.losg.xiaozhulaihua

description	ioc	process
File opened for read	/proc/cpuinfo	com.losg.xiaozhulaihua

description	ioc	process
File opened for read	/proc/meminfo	com.losg.xiaozhulaihua

description	ioc	process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.losg.xiaozhulaihua

description	ioc	process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.losg.xiaozhulaihua

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.losg.xiaozhulaihua

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.losg.xiaozhulaihua

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.losg.xiaozhulaihua

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	com.losg.xiaozhulaihua

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.losg.xiaozhulaihua

description	ioc	process
Framework API call	android.hardware.SensorManager.registerListener	com.losg.xiaozhulaihua

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	com.losg.xiaozhulaihua

com.losg.xiaozhulaihua
1⤵
- Checks if the Android device is rooted.
- Checks CPU information
- Checks memory information
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries information about the current nearby Wi-Fi networks
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Listens for changes in the sensor environment (might be used to detect emulation)
- Uses Crypto APIs (Might try to encrypt user data)
PID:5151

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.losg.xiaozhulaihua/databases/ua.db
Filesize
24KB

MD5
f5801123bb1d825cfadc2e611e07c6e8

SHA1
4a44908c629723aad3e914cd69be1e1657da95cf

SHA256
4581a232296f5aaa6f43d6ee625d677d897d5d7096053716d57e4f586a0087e4

SHA512
0c7dd822d12f49b7d35ffc0cd283bff9079364cca42d984b510402a2f8ddc9f9526476a983722dc4903056e3c341c4b419d267ca78e43c64b9d2d7a59d7346f9

Download Submit
/data/data/com.losg.xiaozhulaihua/databases/ua.db
Filesize
36KB

MD5
b7036131b84bdf2b66c67fde18d62308

SHA1
18b1e5a358d68c846495cab5cfef7c6679659093

SHA256
c2c0bc8842203ccf1665dbb5b3333b22ae5a6ae3ef8eafe83e7f43adf32d0295

SHA512
256bc83e1a516a58f5d1d024d27dad3c26723df0f96e0deca6baac86d84518000212570b06996a14bcbeadff05fed05125862aba2d4aa08c15a6999563dac067

Download Submit
/data/data/com.losg.xiaozhulaihua/databases/ua.db-journal
Filesize
8KB

MD5
65c3e0fb088f92cb33c632e5d88bee66

SHA1
b56922ae1b5aa4d131d6c85be372fb364b849f37

SHA256
f67065e5bb045c9170ae47ab191633e7a4423c28d7cc4bb097c8224810b4331d

SHA512
2693d36e53b02c3a098e336398726927985d65d99a55336ef0fea6c3d8003aecf0952c45d207c37bbad49626c03aae2b69fed864009acb7c26d34866aeb19f9d

Download Submit
/data/data/com.losg.xiaozhulaihua/databases/ua.db-journal
Filesize
16KB

MD5
8460463a506527bfc094e82bcbe2d2bb

SHA1
37cc68ea0ac66eec20e73f0f26a3d14bc74ce87e

SHA256
dabedcba150a9f097ad887044db8fa2139e9c8f49110dac2de607050e24edd23

SHA512
537d1e93ce31b0781ed2000059f1a93201472b70c92743a8d2f740d91e97a099ada57b47e7ae3c0a2e7335133b720b9f54574fe67efb368ee1f440fbfd3a785a

Download Submit
/data/data/com.losg.xiaozhulaihua/databases/ua.db-journal
Filesize
512B

MD5
eec6e4a15f4661f13f84b53487e5817b

SHA1
6f19e01dacc0da0007ec1da2ab40093c167b0b86

SHA256
ba4a5f75b2f7fb44758d5c229510dd0481ecd0cda1d6cb552386bba962d01845

SHA512
bc784cd07470aef04b8f9dc19d694cf51bc3396201ee02c9495848820ef5cd0ed2b918d46b3d61e6628a49fb43d7fe4c552c5d5fd16daa6aa4a56661a0fdcba2

Download Submit
/data/data/com.losg.xiaozhulaihua/databases/ua.db-journal
Filesize
8KB

MD5
0d13c5f0a5ca97514f580b5d849b80bb

SHA1
8a35f8af6003d993d50fc0b3ea6f425bc349807d

SHA256
32238a19a27d99cb4aaeb39cc9d77e3b72fe2e43c9e9e0e8daac97e6e0546c95

SHA512
b25eec214ea57362a968db250bc035bc705d7c5025eb820077324759a13c5bd6c9c4effcab0c32f3bbb16b32d66effd35577cbb601b1e9f73548a54f98cf40a1

Download Submit
/data/data/com.losg.xiaozhulaihua/files/.envelope/a==7.5.0&&1.0.0_1716461676628_envelope.log
Filesize
1KB

MD5
df1aa8f10bef4eca33af1a9a83f1fa37

SHA1
0d5ae11699deab0447a7e9fca6166045549569f7

SHA256
0bb1a3a4e65e1cb69368b99287ef132d78e4b48f18ec52bef9dc02ed24292d7e

SHA512
cc04638246fa5cee7f5a700498b99787784d0a18dee53c2f23b7e498b9412e930800bf4f968fef1c228ffc31e09a86020a1c91dbf7d5cec84ff042b6a07aedb9

Download Submit
/data/data/com.losg.xiaozhulaihua/files/.envelope/i==1.2.0&&1.0.0_1716461672158_envelope.log
Filesize
2KB

MD5
9887e993d7d1892cc2c9d823a79f2625

SHA1
30482dc11cf75d1b89ab3afc0fdad0ce7aa980d9

SHA256
9f78adee64abab4643ebd85d565127f8d9f83a3b5d5a06ff01fdc9601e9fed8b

SHA512
a5774ed0b69d838e90da922e2b36dd3ea35d3af7f6a712a0c408eba915b581aeceab57e2c8ac5dd9a06065d18a1233260cba60839ef6beb68c4a4297db1f26a8

Download Submit
/data/data/com.losg.xiaozhulaihua/files/.umeng/exchangeIdentity.json
Filesize
162B

MD5
99d23e197147caed43ac61f36d2a906d

SHA1
40941c7f6d535868a95e0957af567771b28ee6ff

SHA256
1011d5b7a0ed0233cca373756b824cd021195abdadd0c1cac7a18bed0d67703c

SHA512
58107269e2fb73b1f7ff46ab8fa016ee6cafc67fa3d1de4798977d3a5327c6da6142c80171294188df9b32889b9b6ebd3154bda3e5edadfe21c85bdd9aa8d039

Download Submit
/data/data/com.losg.xiaozhulaihua/files/exid.dat
Filesize
62B

MD5
86370ea746350813acda0728a8388e14

SHA1
938f3f164cd8f71250a31930b56e982c1657a03c

SHA256
80db6e63818b1f223b22fc9254d70638cc5dc085efe26e541e38b1b4cab058ea

SHA512
170c7a3cf66d547b2f1af57f9c044625cafccdc1ad3f6d6f34d9de85a5bc67da033493153dfe07c7b46627cc67d69e5443593b181be854b6cef1a1ff25b2e50b

Download Submit
/data/data/com.losg.xiaozhulaihua/files/stateless/dW1weF9pbnRlcm5hbA== /dW1weF9pbnRlcm5hbF8xNzE2NDYxNjcxMzM5
Filesize
1KB

MD5
c78a2d4925d13dbd42e557bc92f8e1a6

SHA1
e08df2d8353ec876896d82fa44990ed7037788ec

SHA256
86abeeda8d054e462bc351e432cdc349046465854115bb12bfed407f5b335823

SHA512
5f718babd017b084c7f8a75b688db3dd4bd60a109aeadcd98d6cfd84630a2753513a7f9f75757546a4db66923eac7beeeaf13e24a540a5c85d56942688543490

Download Submit
/data/data/com.losg.xiaozhulaihua/files/stateless/dW1weF9pbnRlcm5hbA== /dW1weF9pbnRlcm5hbF8xNzE2NDYxNzAxNTQ4
Filesize
1KB

MD5
2fed72f7ce4e2597508b885cd2c4f4a2

SHA1
30df7dae846565550eb77c263649d8a94d4e43e7

SHA256
582749d410e94dde2ea7e6cf8f2e92475afe6e29dfcd6985d488f54b9d1f1b9f

SHA512
48fa2d0a0d549067269b08c4ff19784d85025160e6e5c192aade5a480df8caeefad9167911e9e995cf83997a59fbf3d1e797a7154142cc415d0fa9cd41bca44f

Download Submit
/data/data/com.losg.xiaozhulaihua/files/umeng_it.cache
Filesize
350B

MD5
e491e75995b2aac596443a73bfe1dad6

SHA1
a894e323a292f9840e5247f8b5b69f537fee58af

SHA256
6b516464c803571bfd944ab64ee6f2c1c97b19f8f228ef5e56e5b794ed9cb33a

SHA512
51834bb9b48e578a6d2028774c2b21f9878c50f39ef61156a0598498389f072de6057cb1d76272a0d755d6f26060b335151845061515d618c3fe938d015fd72d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads