Analysis
-
max time kernel
177s -
max time network
184s -
platform
android_x86 -
resource
android-x86-arm-20240514-en -
resource tags
-
submitted
24-05-2024 17:14
General
-
Target
6f3e20b3fd75c752c9a872481203bf4a_JaffaCakes118.apk
-
Size
23.0MB
-
MD5
6f3e20b3fd75c752c9a872481203bf4a
-
SHA1
427820d1e3af3bbfe00e538eadfb17aa9adc2c8a
-
SHA256
517f40c8b272a3f90a6a692dd35d8d541492579d5a3bf0300e0d73b12b3100f9
-
SHA512
ae04896711a5ce56c1717152e27e21fdb3c1c9cb2e8d04e39e1f0035227e016c6ccd41bdc8679384b5e2a0c8c3a2ffdc32acfceec8b47cc30bdcbec6cbffd19c
-
SSDEEP
393216:z4W34qmm67G8/ui88dUqytF+Ffh4H+8RXX3W8w9w9Peh+K3W8w9w9PDLoYRsezWS:N/m/7GSdUxtF+FfK19XGxw9mh+KGxw9b
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 1 IoCs
-
Requests cell location 2 TTPs 2 IoCs
Uses Android APIs to to get current cell location.
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
-
Checks known Qemu files. 1 TTPs 3 IoCs
Checks for known Qemu files that exist on Android virtual device images.
-
Checks known Qemu pipes. 1 TTPs 2 IoCs
Checks for known pipes used by the Android emulator to communicate with the host.
-
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
-
Checks if the internet connection is available 1 TTPs 1 IoCs
-
Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.zhangkongapp.joke.bamenshenqi1⤵
- Checks if the Android device is rooted.
- Requests cell location
- Checks CPU information
- Checks known Qemu files.
- Checks known Qemu pipes.
- Checks memory information
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Listens for changes in the sensor environment (might be used to detect emulation)
- Uses Crypto APIs (Might try to encrypt user data)
-
getprop2⤵
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Execution Guardrails
1Geofencing
1Hide Artifacts
1User Evasion
1Virtualization/Sandbox Evasion
4System Checks
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
243B
MD5f47fbc660b49047f998606d10312664b
SHA1826621d2e5ac37cc2ea064d10315cb9636b261e7
SHA2566dc93944f74338130f237bd2256513b8660da208bb820a118e6f305ad8b2848e
SHA51210c11e2bcde8a1ef5c73731f7c6bea56439cb8f62f8848e286b3c58ee1695e25e6cf54e8cad08a35acbdee90c561f4ba6255155b1914973bef51f04dc4bfccc5
-
Filesize
58B
MD50d210bfb2a0e1f1b4c082a6a0f79de07
SHA1bb8ed9e364db79d1d9f2fcde3f15091893222faa
SHA256988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
SHA512536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1
-
Filesize
243B
MD5858009ef4f712ec67fe30853d6395e4e
SHA19cf5f7d541be773a30d52b579cb025ab0bbdc716
SHA256fd1bb274a75bef7b206df6f345245296409bfb8c7de3e1763682dc9f2f28f1b0
SHA512a38a5458f7fcacbc9211855300a0ffced261327c60d2f4db29916838ecd17082a3f7dce00bb1321ab1ac8cc0438894ed8fdb2841218fda74497b6cfa9e0c9628
-
Filesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
Filesize
512B
MD53e05f73094fbc174bd0dc48fbc46528a
SHA1b9108e45f1aa20cf9b0c4453fd1fc32255f22455
SHA256fbecf3b179aa34276dc36246812545e9987a485cd8ada5836db3186b7b4f4c5e
SHA512e644f1f36fd2f84f2cbebd3d692c394bc7f6f647a60429ae0bc7e7a3a68ec425df85c70f6a2ec3db787be0b36f7c7a9a813977fe363ec9bbc11621f1c8b8633e
-
Filesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
Filesize
100KB
MD5a0f473a239a3394af2fd1416b1e95ef2
SHA1849669f7d8e077a6c1a54e84fb244fe4d705b99c
SHA256fd0bc07bfff1cb24000a11f26bcd422bcb094e1574d7ae90c454974417d1dcca
SHA5126d6ad00ae6b48453bc913f4ce31b317adccab65d0164632348e41a037d275be6cfbac349fa9ae0e6b7e2cfeab94ba970909ef605cedf81dac78aa12d81822b9b
-
Filesize
512B
MD507c9679084677bb14ee2a419bbcad20f
SHA1b378be4148a7415b34a29eef4d77f6216f9ee0c6
SHA256d438d879cae86f2ce5471ef2cc99f9ca6dd55faa02a6645829346bf9b340702b
SHA5123233bb14baa4342184c2df34e4a2f9297891f4b00bc2054facd0349decca2bff62b9130e4d7ee534cb750c48fa6b49cd3f18ce22306ba053576e2e152f9da9d2
-
Filesize
76KB
MD5840aa1d27ebff2dfa6558bfc67060f4a
SHA1d86193a6daa254149804abfa0ba246cd160bcd8f
SHA256a679cfe6ebf64b5f9bc398f750e2c304e4e2417c8d34f4d89e21cad4e87c42f8
SHA512b49b4f154ccd9c3a19e1359eff89898b07c24331766067533d07c2d89bc480cb5fb6928878bf27a77ea40e87785ee2aa5e2c0896325f830eefd9bf2a977a1fc9
-
Filesize
728B
MD57d911e525a8d8796fa32bb2f772e9519
SHA1c411b9ffde7d06a52c67690e806add98ce0972d3
SHA25632eeade5bbf3b19eb93497b2e42dfee9bfa80d7531c0648b3ae50a5e22cb59e7
SHA51261d4e4242b17d413e73137384b2c6cde030f5723424811dc71f3767519e08db688de8d2515a707e65c15044a77a4d4e33c4918ca71c086c370954a6e57979498
-
Filesize
162B
MD5310a92ecf9166443fa0f5468f823e898
SHA10595f216e897261a4c097e2b1df2174ddbb8d83c
SHA25681a917a5ca82689453e3df1c735d2d0a21a32076f7f70dcc5484ffe587658b12
SHA512d921ee0e30f359ebd5bcb0d4fa0c9540738365c14e364781ed63467b96479097626b60b6f0180d84a9d98b851fb27fd680e3dc30d74c9ef4207e4e4453765beb
-
Filesize
1B
MD555a54008ad1ba589aa210d2629c1df41
SHA1bf8b4530d8d246dd74ac53a13471bba17941dff7
SHA2564bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a
SHA5127b54b66836c1fbdd13d2441d9e1434dc62ca677fb68f5fe66a464baadecdbd00576f8d6b5ac3bcc80844b7d50b1cc6603444bbe7cfcf8fc0aa1ee3c636d9e339
-
Filesize
2KB
MD5d8c9679fb0606a6ae3b6ff8dbcd419d8
SHA18bb048b4c34c2a2684a9153c9031fe95f8731f2f
SHA25686f311af75112bdc32223669b20b689dcfda7cfdb66e2b624208c03c7d17d5be
SHA5120d15fc112a35197f3cb85ec5b9b5fe339ff8d145a07fb1b30968101b2eae98c04fbc54e5a308d114068b7199c027c7370eecc78cfb5397da39b5887d301e667a
-
Filesize
2KB
MD517a4f8fc36dcf4766e2008d947dfe32a
SHA14ee82394af49b213b15eb523f11c1e7a39851069
SHA256a39bc608c0a20cb944e9be69dfdac71653aca29899f6e395f6b6fcb446950a01
SHA512c7697e103be45de5d3f0f1ca2bc14db194acee831f4d9425604dd850f054fefa6806161fd044250ea82dad0f7479a7332cc8656b0ffc9c271c8daf3643b12b30
-
Filesize
2KB
MD5a932294708178d5b4ca7afd6feca4eb5
SHA1fa573f204c3e867170288a16c7cf35db46b72de0
SHA256f12a47a87163c8a2adc3dddeff1ac7cac0c5ff9860b7e6e450cdb4f55385bf67
SHA5129eadce20e38d7f65c51281fa8be95c8df2aa4519367b0209386d33d4645dc6256f00f5a6e3b7385b6f22e813888e9886269ef5dc9b6d6cd7b8ecf2444a0ea0d2
-
Filesize
11KB
MD5a4a9101b821b7e7991699a51aab72a05
SHA1bf55d2b3390ab750e47bd89deeb1d39d615f7196
SHA25676269549e75972c90b1aebfc7cb9e80ff1561585b0268e8fd9fe5ed1d6529808
SHA5124854bb335ec025899a98b6f8ba4720b63ecd2dedf6e772182662c68792abd89f75d12f5914de331444466f3de775dded4ad27bcd655300c998ad4e826d619d4c
-
Filesize
415B
MD5b0cc6ac86aeb2604672fab443113cbcd
SHA1d19f865d2425fbdfd42be8ab8db3bdd54a5f870b
SHA25676765cd043e61249de425bd577db88bdf654d4a4fe0658694675308e27a8ef3c
SHA512c290036ebe4acd467f8128d0a01a815018dab5cfc4bc1852cfcc5da573140685a291552ea0784d67472bda7f245e636a9bde3abaeab216b5091bacfac1ee0ce4
-
Filesize
33B
MD50a2291a4463099a37d77d408f526e4d3
SHA1a699c1dbf0fab656396371f91312ff7c6bb79b0e
SHA256cfff92f7bdb14f5f911a939e9abed5224bc4e7257279c85dc201cf1780cdc0b7
SHA5129c5697a58825e609ef561930bdf4368541514f68105ef968a855ced74b8afa71445fa9acf7ab572c6a4bfc48be07d1611b2b7973be42d60f5795dbe7923b6bc6
-
Filesize
31B
MD58c92de9ce46d41a22f3b20f77404cc1d
SHA18671a6dca00edb72be47363a7071be65cf270373
SHA25668bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
SHA51230f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56
-
Filesize
127B
MD52bbf7192fe2fcbfd738a900ac82a2ae2
SHA1157b07b43342228ed4244008d12679de041c132a
SHA256da197b478cef0c7b727a35890f243f99b3e15caab47594882e696cc646802337
SHA5121c54bce26f2255a9d6bff23e6382cb7af38374ca41d50a4c9e50f507bce0a41c096e623c17c69bacceee746bd6cf87d9ba6451cc7407fc3990a59717ea262d16
-
Filesize
512B
MD5a846a7f2fb824821714a22c467edf8cc
SHA1063b7c2c28747c2deeac99aafa578622431ce284
SHA2565f45af79237afb896e19700611770886b315acbcbb62d3512cd24e3861da3bc1
SHA512c0f1fbde5524ab0b00c43c48fb013796cc6ea6d5c003d942fa2f9875c51591c87e6355173409fed0504fd9335f6f8e34be4d1610044dd76eccf00c1a4c029205
-
Filesize
32KB
MD5b45012b85cd01c4bd51e8f192d5b627d
SHA153a53a1521a93401520fb6bd79e35285d17df2eb
SHA256c741c99dc334680851fe88b1d391668d729d9881a3cd78dcdb6aa2630ae37e92
SHA5129f76dee7b5acddfd13ebd0c3a8587ae68a8fbf5500d6fe3afc45433c33f22556b4299d5698c72d2a42226c6737a5f1c3a6d8a95c33ab4f4ff98ffcbcdb62a527