92d82ebbe6a35ea9706bb6e3ee50411f8357a48c9f688a7a9a87359ad7c8c1f1

Analysis

max time kernel
164s
max time network
182s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
24-05-2024 12:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6e7e535b1178eb91d904eefdab925e02_JaffaCakes118.apk
Size

6.0MB
MD5

6e7e535b1178eb91d904eefdab925e02
SHA1

73105ee2329c6ae9968d7a2949d59a9b0821451e
SHA256

92d82ebbe6a35ea9706bb6e3ee50411f8357a48c9f688a7a9a87359ad7c8c1f1
SHA512

230f01cf23cfe5fd1a7e88c96fa23a076d573a643d3b8172f7987c0e1c29a19c75853a31b579d98795663b8415aaf26035f789dea8a4b7a1efd96b0709088836
SSDEEP

196608:INGP+HpIBccQgu0MbM+4hmEm39V98oEm39V99ayjQQwRQ:QGPJBq7vTvXVd

Score

8^/10

banker discovery evasion impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs
evasion

System Information Discovery
T1426

Processes:

io.dcloud.H59AF9586/system/bin/sh -c type su

ioc process

/system/app/Superuser.apk io.dcloud.H59AF9586
/sbin/su /system/bin/sh -c type su
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

io.dcloud.H59AF9586

description ioc process

File opened for read /proc/cpuinfo io.dcloud.H59AF9586
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
evasion discovery

System Checks
T1633.001

System Information Discovery
T1426

Processes:

io.dcloud.H59AF9586

description ioc process

File opened for read /proc/meminfo io.dcloud.H59AF9586

ioc	process
/system/app/Superuser.apk	io.dcloud.H59AF9586
/sbin/su	/system/bin/sh -c type su

description	ioc	process
File opened for read	/proc/cpuinfo	io.dcloud.H59AF9586

description	ioc	process
File opened for read	/proc/meminfo	io.dcloud.H59AF9586

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

Processes:

io.dcloud.H59AF9586/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/io.dcloud.H59AF9586/mix.dex --output-vdex-fd=49 --oat-fd=52 --oat-location=/data/data/io.dcloud.H59AF9586/oat/x86/mix.odex --compiler-filter=quicken --class-loader-context=&

ioc	pid	process
/data/data/io.dcloud.H59AF9586/mix.dex	4304	io.dcloud.H59AF9586
/data/data/io.dcloud.H59AF9586/mix.dex	4435	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/io.dcloud.H59AF9586/mix.dex --output-vdex-fd=49 --oat-fd=52 --oat-location=/data/data/io.dcloud.H59AF9586/oat/x86/mix.odex --compiler-filter=quicken --class-loader-context=&
/data/data/io.dcloud.H59AF9586/mix.dex	4304	io.dcloud.H59AF9586

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
discovery

System Network Connections Discovery
T1421

Processes:

io.dcloud.H59AF9586

description ioc process

Framework service call android.net.wifi.IWifiManager.getConnectionInfo io.dcloud.H59AF9586
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

System Network Configuration Discovery
T1422

Processes:

io.dcloud.H59AF9586

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone io.dcloud.H59AF9586
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

io.dcloud.H59AF9586

description ioc process

Framework service call android.app.IActivityManager.registerReceiver io.dcloud.H59AF9586
Checks if the internet connection is available 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

io.dcloud.H59AF9586

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo io.dcloud.H59AF9586
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Checks the presence of a debugger
evasion
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
impact

Data Encrypted for Impact
T1471

Processes:

io.dcloud.H59AF9586

description ioc process

Framework API call javax.crypto.Cipher.doFinal io.dcloud.H59AF9586

description	ioc	process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	io.dcloud.H59AF9586

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	io.dcloud.H59AF9586

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	io.dcloud.H59AF9586

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	io.dcloud.H59AF9586

description	ioc	process
Framework API call	javax.crypto.Cipher.doFinal	io.dcloud.H59AF9586

io.dcloud.H59AF9586
1⤵
- Checks if the Android device is rooted.
- Checks CPU information
- Checks memory information
- Loads dropped Dex/Jar
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4304

/system/bin/sh -c type su
2⤵
- Checks if the Android device is rooted.
PID:4416

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/io.dcloud.H59AF9586/mix.dex --output-vdex-fd=49 --oat-fd=52 --oat-location=/data/data/io.dcloud.H59AF9586/oat/x86/mix.odex --compiler-filter=quicken --class-loader-context=&
2⤵
- Loads dropped Dex/Jar
PID:4435

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/io.dcloud.H59AF9586/databases/bugly_db_legu
Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/io.dcloud.H59AF9586/databases/bugly_db_legu-journal
Filesize
512B

MD5
4bd17e0a4cfd43a1773ae010e56b67a2

SHA1
a02d07a3693198e9841b87eac6f744447063535c

SHA256
343d97f3455a005078a352e45c932d15e4cc7d08017cda06c83f11735e79309e

SHA512
339c762cd5dd86b28ff5f6eb212aaa636d8ef65d888a8fa3d87dd5240d430f4202820ca4a7f4872c0cf259a53863c638953126804de1990e92d391ee4c43eef9

Download Submit
/data/data/io.dcloud.H59AF9586/databases/bugly_db_legu-shm
Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/io.dcloud.H59AF9586/databases/bugly_db_legu-wal
Filesize
92KB

MD5
0117ebe5d649dcf50ddf8b814d69fc58

SHA1
387f30b265c862d326f2cd0cdf89baeb5e64b34c

SHA256
56a21e7c6245e0b6ba361d255d9dea75cd3251b12160e356b05037a0cadaa352

SHA512
a4c286a9b2732d3a5bcc6ec6420416609c83406e85217838176fb60d715ce071482b25bad95644288467a81a061e6ee9151fd9796912a74126f7dcaa6656ab62

Download Submit
/data/data/io.dcloud.H59AF9586/files/cnc3ejE6/eje3cnc
Filesize
335B

MD5
585839d66722cfd02e40cb740cccb633

SHA1
374c19200fee201b26d0153487a281a934615884

SHA256
86a9bb4985cca6c9636c4fd071bef4b70ba7b3a5eb51af869a1299dc2b1574a8

SHA512
09bbe1bf1455861fd4732f2d1945c84bac34090906ac2fab75d144c22ffcf6bc585c8209e94a2b1919c8402df53966081a1af2993e12261ae4c4ac5568667d88

Download Submit
/data/data/io.dcloud.H59AF9586/mix.dex
Filesize
292B

MD5
63f77f99bd2c2b772a479923bde11974

SHA1
c7632e7d301e4463fafce85f84e9c3d7da3fdbbe

SHA256
4c76a3af64cdd2f8713ffe2733dea50dbe714d0ca41c17d1847ee5b62a7ca615

SHA512
3aae4a89d1ed51fdd911cb367eb10afe3c2264e4222085891b18a60d5412f85d10bf5c8f3c6642db70abb9aa42732bac5c42c42ee32d587100f53c21b5beb16c

Download Submit
/data/data/io.dcloud.H59AF9586/shared_prefs_ext/test_app
Filesize
24B

MD5
188561e0a568da773c824e186182085a

SHA1
559e48e951bf80318d02fec5e3c68e50722a8102

SHA256
98deab50bc273b2880da4b27e8d56ba4f81da7064787e349b3a3ceb85ec2d989

SHA512
daf7503545092dd47e8085a949da26da66a93562f2fe0fa2e46289498a83f6b85b9931978c321cf4a12bbff3e645dfce102e8a0760eff4ab093e2252a01bd268

Download Submit
/storage/emulated/0/.imei.txt
Filesize
32B

MD5
86c9f80aea19f0338699cb81d09bedcb

SHA1
282d4de2f7518bbdb6df7ed65834f22f614fe4dc

SHA256
4de270cef672e992e483fd482b6295f5da67dc12267861f750c3d8a6c42bd0ed

SHA512
9192fb6c3dc2aa2f7d56ecfd7d63937a24e7d46a23c691f618fbceed35468f3f21aae7de5708a008eb41cf9f058cf24c7ac27405a2225020aa243c17c2f75d23

Download Submit