Analysis

  • max time kernel
    171s
  • max time network
    188s
  • platform
    android_x86
  • resource
    android-x86-arm-20240514-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
  • submitted
    24-05-2024 08:53

General

  • Target

    6df3810ea9deffad9a44bd182b10aa3d_JaffaCakes118.apk

  • Size

    25.6MB

  • MD5

    6df3810ea9deffad9a44bd182b10aa3d

  • SHA1

    d3fffcf9f67832337ed45f5995063d3e7554803b

  • SHA256

    7d50ec7aa69d2e85ac7c963c14adeca97fb8be548788f9f8ddd6a0175780f5bc

  • SHA512

    100fb05851fd903f108384965a92b41bb848c66e3962e1ecd41b563478ab2d3a687e9d72edcea8d07b037ee8b5e0149138637a63ccb0bae1963c211f6b3f4b38

  • SSDEEP

    393216:ZXeo4CYT7IwG81UpSimXEVD/yWKJypOd5Jk4SCFX/KwkMROxYyOkvpjCX+FVAENg:ZXzo7pGT/mUVFaPWMPKxMI3A62EN4x

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 3 IoCs
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Requests cell location 2 TTPs 2 IoCs

    Uses Android APIs to to get current cell location.

  • Checks Android system properties for emulator presence. 1 TTPs 2 IoCs
  • Checks CPU information 2 TTPs 2 IoCs

    Checks CPU information which indicate if the system is an emulator.

  • Checks memory information 2 TTPs 2 IoCs

    Checks memory information which indicate if the system is an emulator.

  • Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

  • Queries the mobile country code (MCC) 1 TTPs 2 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
  • Acquires the wake lock 2 IoCs
  • Checks if the internet connection is available 1 TTPs 2 IoCs
  • Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

Processes

  • com.pplive.androidphone
    1⤵
    • Checks if the Android device is rooted.
    • Requests cell location
    • Checks Android system properties for emulator presence.
    • Checks CPU information
    • Checks memory information
    • Queries information about the current Wi-Fi connection
    • Queries information about the current nearby Wi-Fi networks
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Acquires the wake lock
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4309
    • cat /sys/class/net/wlan0/address
      2⤵
        PID:4515
    • com.pplive.androidphone:remote
      1⤵
      • Checks Android system properties for emulator presence.
      • Checks CPU information
      • Checks memory information
      • Queries information about the current Wi-Fi connection
      • Queries the mobile country code (MCC)
      • Registers a broadcast receiver at runtime (usually for listening for system events)
      • Acquires the wake lock
      • Checks if the internet connection is available
      • Uses Crypto APIs (Might try to encrypt user data)
      PID:4753

    Network

    MITRE ATT&CK Mobile v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • /data/data/com.pplive.androidphone/cache/applog.log
      Filesize

      6KB

      MD5

      f7bdfe2278bc9ff37288d6fe9451d4c7

      SHA1

      3f171bd786db4ae7d298979b827f84bae889e00d

      SHA256

      46858d287a8db0ff2113dc3647e8b24cf184a9926958923a71a58307fd4260fe

      SHA512

      4fcf882a87d6e87e3bdcc54885133fed4041c842271fa386b879a6cdddb874f31f7e4c74ff7a41247fa263971759ebc5d00e61d5c3ec9318ba1ad902cecdf516

    • /data/data/com.pplive.androidphone/cache/applog.log
      Filesize

      3KB

      MD5

      89642a7546ae84dfa082dc7b6ba039d4

      SHA1

      c7d4caf2849132a819127c85614dd21326543fde

      SHA256

      209b9ab09f3467075b2b82d5ef0a95bfe19af4c49cf95206cc299d14e5d03f64

      SHA512

      585d198ac55563e58818b7ef3edda50f8f556a3045f6e923ce4291783fb6d1203bccb5a4273ac46cb1f5df8af4d251d7aad873369da1ce342c51314a599cd004

    • /data/data/com.pplive.androidphone/cache/applog.log
      Filesize

      443B

      MD5

      b51e93309b233c5417395f3b181f14a6

      SHA1

      4a51391186e0d662f32a79bf3856c4d6eb91e935

      SHA256

      ed13e4d87ef6b87b92b356a979232c240614b6a7e375393d30f13e9cd0f3a74b

      SHA512

      1fe89a61e0f05d4c7875fa26390bbe07a41e2a3aae8194d5f9679711fa6f4aee0ecf46623a461780762d73363e27138a9acad617e723e2b1664813efb2c6490e

    • /data/data/com.pplive.androidphone/cache/applog.log
      Filesize

      4KB

      MD5

      86b0935ec9a078a1c953527fc6caad9c

      SHA1

      9015509e7d2135216ce70febe3f59ad04a3399d7

      SHA256

      5b66dc53fa92249a564059f69b20d9e1e9e1f46c2045bedc338e8f248e8d1b1c

      SHA512

      fb66a7e0e90859f993029e3cbc0a687004a5cf0923951a4d0ac2db2084175a5a7e0ca22251fb189f89a61051b339168b34e1d9c337589e3f25ecd68c7f36dbae

    • /data/data/com.pplive.androidphone/cache/applog.log
      Filesize

      185B

      MD5

      8063fd77fa14610fc4db725bab9f3f06

      SHA1

      e0a3f9e9a95262383b6c76462b670663711b9a11

      SHA256

      0f2a3c531486537b5ac0a69151640276c64bc57ad370063296237aa896fa8fbb

      SHA512

      1a469c238a872f5d6244395ba0ad6fb4f98f99ceec0aacc97ac0b847c893b66caea3a88ef64e3018ffc67b8258061344c7bd6e28dc6f57ad4278112b65361c59

    • /data/data/com.pplive.androidphone/cache/applog.log
      Filesize

      6KB

      MD5

      393680eca6e0d678b8e14daae438e61e

      SHA1

      6d97a7317ef56604c627b230fd2aa920be35ed32

      SHA256

      7773bec038bd13264ee6836065556095eb75dfd2f51f0dc71d3e70e317599f29

      SHA512

      21a8ca69e80a7a0b52f471d98bd52b2b11b274fb60848cacf1e1fe09dac6914c26e020363ce25567303ac14e2895475d48f36a5c1fde00b8e95e3e815146b4da

    • /data/data/com.pplive.androidphone/databases/hmdb
      Filesize

      12KB

      MD5

      3fe30614d7e0d11db870b4624f6c50e0

      SHA1

      053ff0fc621ab40f2afeddb3e7b4a73ee41ec533

      SHA256

      67c532f0324228dd33b445cd399c1426e3a0e0cdc7b9358c66b402c5d40a838d

      SHA512

      c7c09e97a408e88aacaf8099ad4d1fa604d58113393500a384eb3c2eb7c3c105af41314934b86eca2f088045cbab5a20d768bbb295448dc1ae6cb6c3f59821ae

    • /data/data/com.pplive.androidphone/databases/hmdb-journal
      Filesize

      512B

      MD5

      ba6ec61127c8a669f7fec237cd76686f

      SHA1

      1e0130ca75f7736cdaafbdff802b31144b11fb6d

      SHA256

      8d32aafd0e7c732e199ded30e511e7dd7d912b53a1974aeeaefd3456262777cc

      SHA512

      849f98e70d40a3eefdfc6a3329b84ba8f69950a923c66089c8787a7c5c2d344e842e166adcfa835d87b640680c0471c7cafe5e5e127a67eefdb72129827bf059

    • /data/data/com.pplive.androidphone/databases/hmdb-wal
      Filesize

      16KB

      MD5

      1fd08fd84942b3592dad96ea6cfee6ac

      SHA1

      b9e7f5904c118ff9bdc5577e6fae6c5498317fc1

      SHA256

      0bdcac16afbe90ebe616ed7578690a6c4d1f651990b0c069bba6933eae89f7fc

      SHA512

      d9d8ca3c26a510b5b94915da26af6b136db64f709bcc6d6c939ee3f91128d781d3375eb7e491e5ae12baef7c0a47afa1c78916043b3e75a86e556cff127b67d2

    • /data/data/com.pplive.androidphone/databases/logdb.db
      Filesize

      36KB

      MD5

      a7b5debf648af8527d38065f285c6754

      SHA1

      ad8513c878ca1483a2472c7f8dfc8a416418517e

      SHA256

      0d8f1987d41b042ee7aa1ae97d1950a40884ff4ed620fd02371017160e50eaf5

      SHA512

      c879b912d723e9c382e547f605dea4d77830d9300c3cdb1a14c2758cf4e895000c7ba2afe37584ed2fb94a9893e8ff47bdfda4dfbf2dc47aca75efc5d28984e4

    • /data/data/com.pplive.androidphone/databases/logdb.db
      Filesize

      20KB

      MD5

      ddd941b86921617e632ffded3c551f52

      SHA1

      e9f3fde85f279a8f6ea0ca02192d1e433cfaec4d

      SHA256

      5643b763de05df0615b433546a3c4d2da206d7589d7bd895f69a06df0e73b7ce

      SHA512

      79fbda1287d1fc7271feed958700dc7ce43a660e5ed6a0dc710e5c108807cc20c9ccd52690b7a6682aa4dcda36a5bf7fcbe6e04572cc12bc13639167f70f4709

    • /data/data/com.pplive.androidphone/databases/logdb.db
      Filesize

      36KB

      MD5

      60e918a66670488ae5e111bdcbcfa95d

      SHA1

      ee81e2f5ad9a7301adfce5999095370e532a43d9

      SHA256

      0126f776c2c01bb621001c4d80787b706902fa8fdd89fd1f062d063ec74d5313

      SHA512

      1abb9311fce204649d299a19efab820981c427a8f3778a9848fdfe99aac19fbb3d62bdc4f5fc93bad66c090d198e9db33c23066041207272f2942272167796d2

    • /data/data/com.pplive.androidphone/databases/logdb.db-journal
      Filesize

      512B

      MD5

      7dda7647b5f291851bcbeedc59d0902e

      SHA1

      c62a40b29d1461463031eb5bc4e949582f69bf15

      SHA256

      17b5485a4f22fa69633175c6aa0122df8731fc5afad307c7a02baee8b8020e6b

      SHA512

      7304de029e325fcb4c257d6de1d2022eaba10f0b3443044187df2d18f275bb9386b76e36df32d91417b7b720ef7d71ed30666f200c41189dfad00f5f9038e10a

    • /data/data/com.pplive.androidphone/databases/logdb.db-wal
      Filesize

      48KB

      MD5

      54d5e18587f9d74810aaf95851776c5d

      SHA1

      4bf0a813317b45bc0ece96da63f36136d663f530

      SHA256

      bd210bee01523b5ee5ca9dfbe18aaafc11aeb4c76f2e9fd38acfbae305aba22c

      SHA512

      fd3b23cf81ff4fa1a17e9cae93f4b2ada789bd9ce069b36e611fe3eb4507e02b31998ba779439ea48da188357f0703b19bb0f85da36c8e34722d3ffec0ce16ce

    • /data/data/com.pplive.androidphone/databases/logdb.db-wal
      Filesize

      8KB

      MD5

      7767bb37b6d7ef13868ed6c34c4b4e07

      SHA1

      6d38b7a74c06f54bfbce4de245e8f8deab08c847

      SHA256

      d012b8ca339699286c89b033eee3a9a8d57a50bdfb1eeef8038dfeeb192e8b45

      SHA512

      211393a3ddd7fae24d84beae3fb4a57ae5e67198fc8425f4376513a588b6c2bcb5200b93fbdb38b8f5f47de908f45f21c00b0ad8da975ee267a6a7d3a175ac72

    • /data/data/com.pplive.androidphone/databases/logdb.db-wal
      Filesize

      8KB

      MD5

      2d19227802b2baea74f87c95336c16d0

      SHA1

      950798ba0aa25f88429ceb3217cb137be58f8b11

      SHA256

      06a0a155ad1700811e9ba760da19dfe8b88aac401f796f1c12d047f7f73e8bec

      SHA512

      78c06ba7bea06a9d11b9af2874c8e7e3f06a36f52eae1ac0dd2af5e6dd5eb331568361de552ef7bb5b378e8a92aa078caefe44fb9ab1a6385dc1824ad51c2169

    • /data/data/com.pplive.androidphone/databases/pptv.db
      Filesize

      4KB

      MD5

      f2b4b0190b9f384ca885f0c8c9b14700

      SHA1

      934ff2646757b5b6e7f20f6a0aa76c7f995d9361

      SHA256

      0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

      SHA512

      ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

    • /data/data/com.pplive.androidphone/databases/pptv.db-journal
      Filesize

      512B

      MD5

      351557198483c1e131bccf882730709c

      SHA1

      70b0651f0ac35483eea30dc52a395fc73f39a3ec

      SHA256

      b76b7b1d33ed4e95bc4c1476acbad7b39569f0839329781d57ad1f384533845b

      SHA512

      e114f3522ef081a5f1ea2a162a1d002378c6f3414047c257f64228cbefa225f93db6421c98233db898bf98b5bd87340a9194f4d171b1013fba47ebcc340aa982

    • /data/data/com.pplive.androidphone/databases/pptv.db-shm
      Filesize

      32KB

      MD5

      bb7df04e1b0a2570657527a7e108ae23

      SHA1

      5188431849b4613152fd7bdba6a3ff0a4fd6424b

      SHA256

      c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

      SHA512

      768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

    • /data/data/com.pplive.androidphone/databases/pptv.db-wal
      Filesize

      261KB

      MD5

      98895421cc598ca850b02b0ee2af46a4

      SHA1

      12184a14760fc61f8e5838aab95059eda19313b0

      SHA256

      3a8758bc7367e5a19bfac6e333e885d52b0d737785e10cd1222a2d29802913df

      SHA512

      83b3e7f5bf679205bf9465f52f59f1cbcf76ffd95f0f251eadd835cc6829db625f82fe7eccb44e73b987a35277e6a140d1ebddc04618d4b909e7359dbc9a4087

    • /data/data/com.pplive.androidphone/databases/xUtils_http_cookie.db-journal
      Filesize

      512B

      MD5

      283b723f0846aa6f20fed64e7697677d

      SHA1

      a6e5aa7ce346c0f2eaf3d840fc3857c17d30fae8

      SHA256

      8000407df2ee114fd8469a0b677fb4c36f7e5ec552ac8dc4e4a3c1be3e07d775

      SHA512

      5a080b434dbe4a765c78bdd87d54b8ff872dff7fa4b6977da290baa855d3ceda30328dfdfb886f8de5ec548a55021d325d71fec1f612666b5cf70497ea6df0c0

    • /data/data/com.pplive.androidphone/databases/xUtils_http_cookie.db-wal
      Filesize

      80KB

      MD5

      b7cad6b7d52e8f82b6d707653261a5ee

      SHA1

      3e61f84312bd83b10986102b6b81fc13fc78c063

      SHA256

      7bfca97d10f9f6f1d174f96ca75fc1d981581c963066212a837fef2c0f7d91f2

      SHA512

      78872de5c56582303bb578650b62c9648005153480364ce00ff5bbfd52bc323b5d8507fcf55df1d3a4ed693384fc704ac90407ced0014d6d80eee349947f0159

    • /data/data/com.pplive.androidphone/files/exitadinfo
      Filesize

      2KB

      MD5

      19175ed4326df869f1886cf524e171fa

      SHA1

      951048cce3237619ff126c8cfcf87ab405b7ed0f

      SHA256

      dbd655cf06d7da7918d233975c67f6cad9f102dbb912ea290642241ad64e8f2f

      SHA512

      f2a8076df5f411d079b366753d6ea1344ddbd4bc9e331ce6aa0671e6d172a3f3b5fd015be188207440ed05b843291608b0d09240dce370c67e83e834cf622540

    • /data/data/com.pplive.androidphone/files/mobclick_agent_sealed_com.pplive.androidphone
      Filesize

      697B

      MD5

      76be8bf70ec747a665b77f1a9d44cdc2

      SHA1

      1f9d5831eb404b566baad1d0ba86bc37320e334f

      SHA256

      ad4a1e46efe82d6ff1e497aa3ec33bbcb0d9786928099f2617969164be28e96e

      SHA512

      e7b2b6e066302adb0e430eda4efcfa875af1d9e723407c3c2577ae3c818ebc46fddd62effac77633a692e1fd8807b0ca4bbc2c710e1d65bac15b00c52c6c3a40

    • /data/data/com.pplive.androidphone/files/umeng_it.cache
      Filesize

      211B

      MD5

      f381468e25cbf1eec1cb33c5c41064ad

      SHA1

      195921d776e775c538e158bad7a82cfb2fdc9fdf

      SHA256

      7648390299c61782c41015dea100e2768d0c9e4610f63724af5917ddb0bd2fa5

      SHA512

      269d4e21e1ce93099d11da335c2911de678eb34c6b239748c67b5fc6718bfd46d59f31a2ebbefdb3b1636c4d484a5f1db8b063c91a2b1bb188af1f3f62b99cab

    • /storage/emulated/0/amap/openamaplocationsdk/alsn.db
      Filesize

      24KB

      MD5

      6999293712000d597b4cf4f0d42316fa

      SHA1

      ce64c005f5f516ec4c491eabd907423b0fbe2a1f

      SHA256

      3cd4e50816e59adfdddc5d5ea2bff7068bf6fe711302b4820f6a79f132f0fedb

      SHA512

      8638503a6e9c40c8025722ce266ca4314804c7d74546938464253a136f230921ecc990343541f481d317c6823ae519a5a33d279b363a1457bb105a6de49656e2

    • /storage/emulated/0/amap/openamaplocationsdk/alsn.db
      Filesize

      24KB

      MD5

      a22d9b53bda0f7778f3d24257fcf4441

      SHA1

      71a3202820a5d72b61c6a9185a225ad483faf94a

      SHA256

      888492242c42413ad12546ef19324233a05469b6c6883c49dde8415d06ef5982

      SHA512

      5e3cef7d79e1a41c55cb92b79cfd5273207df202feb742653462e98a600c0b2c6df0e63be1fc84201a08de83301c2b1a999973e37c3ab25fb0e8f32f94e15d08

    • /storage/emulated/0/amap/openamaplocationsdk/alsn.db-journal
      Filesize

      512B

      MD5

      24e2c09646d8bfc2a8a0ff24bf1e0552

      SHA1

      0ad8b880fed80fe9e610f19aa50396fdcdd60829

      SHA256

      e118c3b2120f3090265a65d726869b49f13552fed6e16ef13103f886e175f365

      SHA512

      083f990442e5838d8e665833516e1278da85e66e3af006862179c187d79a964e4b94bd6b9d535cad63fbfe0beb41679a13fc196288d9d1cf81501fc7783a5417

    • /storage/emulated/0/amap/openamaplocationsdk/alsn.db-wal
      Filesize

      36KB

      MD5

      27972f75b2fa64a5efa248cb0a2334da

      SHA1

      5fa92499a82f9bc9841bab2c4836e8c511a74dc7

      SHA256

      3c5bbb806c845ffb3a735c84fbf9402377be61a498351c1d039a86b83e1e4fcb

      SHA512

      10d91ad6585db9aa7f096e076c34a3481aa831dbad188cbc7b01546ecfdf765edfe6210a2e50b6b658020b9b702a8153aa1bc8057cf2ad7f7955ac98abad940e

    • /storage/emulated/0/amap/openamaplocationsdk/alsn.db-wal
      Filesize

      8KB

      MD5

      e00d1c5543baa230e2aed87e5fd6ea5d

      SHA1

      90d1c2731720a9094244183238455170dd334edb

      SHA256

      9a344fdb166ea37405310e42011ac1b2499088c747af2304b290afd3e07f3422

      SHA512

      b776749d2f3b04633fcce6226a1c2ca26a0d1cf9ebab83cdff5234cb9c694c81f2495293f326727e97329b1896416b386abe6f649e4b8294f79c5860c5aef754