Analysis
-
max time kernel
155s -
max time network
132s -
platform
android_x86 -
resource
android-x86-arm-20240514-en -
resource tags
-
submitted
24-05-2024 07:03
General
-
Target
6dafdcd16ed9b1de12d941c953bbcc5d_JaffaCakes118.apk
-
Size
859KB
-
MD5
6dafdcd16ed9b1de12d941c953bbcc5d
-
SHA1
384706a68ce01681195c93df8218ff5fb8f0b4ff
-
SHA256
c0ad8207d3bdeacf36dc9ba2fa24f12c843a683dbfe7a23480477e2063d9d123
-
SHA512
217c9944a065fbaccb7063d43266dc54c41344f66641439bacafd589174b066409c33877d8e5af330d83d9bc69632c7ce4488db76b0e0b03f41259d93078d7cf
-
SSDEEP
12288:z25RdddddIG5ojiW5HpdaTrxi1gmPLiqOU5ZUWWcZgk6vacVpLJNtcVJWQxDAFja:iDAiGHfav8zTrWtdCJ/DAFjQGPfUTgg
Malware Config
Signatures
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
-
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
-
Loads dropped Dex/Jar 1 TTPs 4 IoCs
Runs executable file dropped to the device during analysis.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks if the internet connection is available 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.xingfuxiaoqu.erlingsiba1⤵
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.xingfuxiaoqu.erlingsiba/app_push_lib/plugin-deploy.jar --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.xingfuxiaoqu.erlingsiba/app_push_lib/oat/x86/plugin-deploy.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.xingfuxiaoqu.erlingsiba/files/__pasys_remote_banner.jar --output-vdex-fd=47 --oat-fd=48 --oat-location=/data/user/0/com.xingfuxiaoqu.erlingsiba/files/oat/x86/__pasys_remote_banner.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
442B
MD568cf2d052f291b771ef70ff249249a2a
SHA13f494a67f215762ef0863dd500e109482c4cb6f6
SHA256e8627d3a69dbb281a3eff9a3daa0dd66261d14a72ff3025fd6b91d98fe4e84bc
SHA5121327e14d4e61735cfcf6690ff40e89e1406e41797fe7606ff1d03f7862f5f81133b05b28aaaf20871e567fe849c02faf4673ee434b89ce10af29069eb3983725
-
Filesize
410KB
MD51ed16b1d3282f62f77248719224a465c
SHA19c2fa945dd3e94cab3670e833a09d07d3107ec71
SHA256ef9892398b431dceb1977e3f47459f47f9981472fbc3be44995164e4e4473b3f
SHA512bb08f2b9cd7deb3650f495c60650d7a916d60b1b8a7ee8c995e7cd62afd2eb80dbd3769e61ce63b89d5c358343dae63e1937d715621dfde19840884fab85d764
-
Filesize
174B
MD5598042b568a687f07cb8e2f1e675bb2c
SHA1c4f36c31cdd916e541d4d5f8590e496ae7c65cbd
SHA2569d89e4f4ff2b98cf5079e6d74bee91047eb4b8678f02955a77f7abc14c41628a
SHA51259dc37c0b3a769bf2415ed7329f2e5fd9923939df7333bedee86beb55589cc76669ef515512de0d1fd71df43e200a658eb000606b41a90a3bac78e428cb4f503
-
Filesize
295KB
MD5289aa52188b4a1eb9a3a5904b0638ada
SHA13efe010f8832bc5ee7df88152e01ef1f446663c4
SHA256947be2e29c43127ccaa6ab05b2600405cebd5aef985204a4cf2e17ecf7cfaa91
SHA51234078ccf3fc42c63f338bb9f62eb139d953ad9e0e5fd813465d9f4d37f708fc20d7309897919cdf6be37acbda2669fd6d32ff4a233279e2cd6e2a0ba62cdc47d
-
Filesize
321B
MD5696072ebf349fc5e86bf701827c1b399
SHA1f5788c83649ad5932b353840e7ac260b32ad30c0
SHA256e8ad41cf5b3b8ea90e86956699575c0f0271073b4192cbbd63a334115d039a6e
SHA5120014a3376fea1c2d70733e601298ab7cdb1c18d163154e0db0d469da508a2a110610002386b65ac9eb1d736e2f65f06f2ee79d712cd996f06d0847798ebb9332
-
Filesize
849KB
MD58897b06ce1f035de39dd401719dbe3f0
SHA13c7a8910657e44c86919abe204d3989767e8ea6e
SHA256ed673cea6ac71fc27e7b4d13b03291e5124a0dce25ca96a78b704784b8ecbd6b
SHA512c5cce4a3c7928133aedff847be946f436c1f9c36de820ff782b730c4a5f011bab1f471a3ec8d82eee958df9052bf2b7514bae1be4e6e4df6e693dd45e8650230
-
Filesize
849KB
MD5e7c3daf2ded513bd70508f9783d1a1a4
SHA1eeec356bd82f09fe3c2accc7b9e262fc1033f733
SHA256d02a9a3cfb3e223513fc075a21f8adcdfa6931ee5720d04b8e502db64b5fc2ad
SHA5125117091f31d6f4d12a67d0572c47c63112ef4d84d227abeca1a037e00f0b60baff8b2449221b9482d2eb4f6b38f4bd45a4b6760cbce690854c5e3d5c41be1e88
-
Filesize
417KB
MD5981c6cf9b7df281081e05c808cf0afd5
SHA148aabea85a9693f461f87e1bdb9f8e76a8b45c1b
SHA256639cf990e6246c0418adf545481ca1549a3ac1b443bb3ad3f5a3552400e41f0e
SHA512b6e668c33021b64adaa304a4e085a2c5c88c16c99e811a4c768534fd67cd6cc380e125e960de511c3abc33c7b842be1441a7dd48aff83c2928d62ebaf65f6adc
-
Filesize
417KB
MD596d208e818748da0a0510994de5be961
SHA18f093544c3ce04ef1dc323730d2937f889c911c6
SHA2569fab83f42fe2573d80524e4b91caffaee37f2ca37f56f6a97a2c626fb7927215
SHA51255a2b0c3a86ed751f31f96774aadebcf9068a4c3b828f0e1f4e30f0a5acd7a66ef14df7361ad2d9cccfe8f560db8e8cb2c67d9a459a75d24fbf762528f32bbf8
-
Filesize
60KB
MD5d603f05b4586468e312e2291ac2d0959
SHA13ba65b01141ee44afe68629e3d0ebad3c24b945b
SHA25635ae004d35fc19be636946b7cb6769986767057f6a8effeca8bafcb4ede80c16
SHA5128aaf9c481fefd0b63cbbd7e2a94f242091ee7d4fc76fc1029bbcc2f47fc4697580acf9ef6f53a7d3961e0afbd0eb2d4a41d444d36ac3498c77114d67e622e442
-
Filesize
512B
MD51d04e4c2680edf62cd0dc0509c526eba
SHA135a1ef5255d0024a54d09cbddbce4d4e1a1f81cd
SHA25645c5b3c8b523d59fcbb3dde4817735b088d07dffefd6b70a981f45881c4491b1
SHA5126acb5215beddba5cfca7c1438dd997fe9bd059c3710a7fb98c155f488c1ee084883360969c31222781ae5f568d500faf8c85bfdbe996962aa75eca927fe95b87
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
76KB
MD5b40043f3233643406d73171554fd5a94
SHA15953f0fcecd918166f686cb7641c1c3e84f2b31a
SHA2565a4210ba5afc122047b950594bfdaad3fd9dba8abbca2439475788da3700430b
SHA512a1928589e59fb851a32acf00a93e808f3a6e1af7b6b0a50041871aa508d1928f4960b504d28876f6084ed04cc94db8e82bc2f4c2f0dda19e900f9f7b5287c6f1