f30020c7fd67f24050962c8b714b60d6fa03251cb6dc71ea27a165e81f622841

Analysis

max time kernel
165s
max time network
185s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
25/05/2024, 06:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

711f5937fe6f9b8f2e23f8b5b90e6168_JaffaCakes118.apk
Size

21.8MB
MD5

711f5937fe6f9b8f2e23f8b5b90e6168
SHA1

d3d5d7c052a952c3bf475952f9e58dfa54646bc4
SHA256

f30020c7fd67f24050962c8b714b60d6fa03251cb6dc71ea27a165e81f622841
SHA512

872e03fe1defc8ab6b059cdfa843ee0916689b265c5e5917934f9e84e1f80fb6ae2c985708fa341392dbfe049e7c2ffd52a2464063ed30d48d5b70b7ff1eeb23
SSDEEP

393216:7OkhH7Vf7GYZmOmaZyIvGM5Raf3WYGzPGJF5inK/VnRdg2xxfnK/V1HbQXXtzXLr:7OkhH7FGimaZoMKWbzPkF5IK/V/gyVKI

Score

8^/10

collection discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.yunding.dut

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.yunding.dut

Checks CPU information 2 TTPs 2 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.yunding.dut
File opened for read	/proc/cpuinfo	com.yunding.dut:channel

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.yunding.dut
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.yunding.dut:channel

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.yunding.dut

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.yunding.dut

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.yunding.dut
Framework service call	android.app.IActivityManager.registerReceiver	com.yunding.dut:channel

Checks if the internet connection is available 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.yunding.dut
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.yunding.dut:channel

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	com.yunding.dut:channel

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.yunding.dut

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.yunding.dut
Framework API call	javax.crypto.Cipher.doFinal	com.yunding.dut:channel

com.yunding.dut
1⤵
- Checks if the Android device is rooted.
- Requests cell location
- Checks CPU information
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries information about the current nearby Wi-Fi networks
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Listens for changes in the sensor environment (might be used to detect emulation)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4332
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
  2⤵
  PID:4540
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
  2⤵
  PID:4559

com.yunding.dut:channel
1⤵
- Checks CPU information
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Schedules tasks to execute at a specified time
- Uses Crypto APIs (Might try to encrypt user data)
PID:4625

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Hide Artifacts

T1628

User Evasion

T1628.002

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.yunding.dut/app_license/idl-license.face-android

Filesize
36KB

MD5
486e2bac2b3e9e1cb411d2838a4854bd

SHA1
81dd0a7537f4af319b830ae834908986be85da8b

SHA256
5644a250fa6cef16c2c802b98275656a5fc39dcf89bcc22193742d85c7313f57

SHA512
c146789563dae163e373489b3df53f22efebd32b69643992969241eb5ad5eec668de67e7cd2aaf5c3a8af57b0842115d00183825734f57643d3fdb09835fe681

Download Submit
/data/data/com.yunding.dut/databases/MessageStore.db

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.yunding.dut/databases/MessageStore.db-journal

Filesize
1KB

MD5
e04606174fb90723d0dba009eac9e481

SHA1
c604e8631d3316e1a82ed1a46a1d0a80f6f0f6f8

SHA256
abf0948931b9020c6a58255b8747576a0086dba62c691139cfd350ffd4e0d9b8

SHA512
dc8abbab0b2a88d399b61191102d229a3b2bcb1afba5823fa48f3cfb47b35546de38fa21a3d943709f7ac6f8853581f80e67ae4a69759ed48949a2ac1c1e54d3

Download Submit
/data/data/com.yunding.dut/databases/MessageStore.db-shm

Filesize
32KB

MD5
fc377199ed3a9227d47046342165a27d

SHA1
d1ac75bc0d6617e90bb5980c66ed3387f9011287

SHA256
d2bc3d6ff0ac3418b23985cafdac575bc064d23783c216c3cd788ee1bfc8408f

SHA512
945ee5b64cc111d2d20f388801a108fa59c54c517ff8f4737f0f478e6534c4d44cab1db54567787472eed573dfbf0ec474533844b4e8c57718d446efb0930363

Download Submit
/data/data/com.yunding.dut/databases/MessageStore.db-wal

Filesize
72KB

MD5
3c04653b90aa5d0a69d02c32adcbe16d

SHA1
67480bc13c69e5701c9dd7c173d641a5c8ff2ad9

SHA256
d0e89536e9b53711b97258c2a93e88b09436c5821d78873ac63c5998a6f3401e

SHA512
7882faf997910adb91d7b3f95310de2b89719dfed53524caea6a1a26909a1e798acef72cc304e26922dd989bc0962d962f5f261acf368af46e810307bebd4c4b

Download Submit
/data/data/com.yunding.dut/databases/MsgLogStore.db-journal

Filesize
512B

MD5
f40e2422bb6bbbe875ec37fd22d55dc3

SHA1
f3f0dfe904f2088279e750545e6480b058abcf38

SHA256
15bcf35c56573a51d40bc428887b97777ac3eb3991e5ab6575872b92db9ff828

SHA512
335f6c2c1714244a6af359879d8b2ce8db031f4ef09ae160a98dfbfe229c0fcfb91bb07fdd11d5cee580f0bf49f3887fb1d99590f0c28371fe83427b6945cb42

Download Submit
/data/data/com.yunding.dut/databases/MsgLogStore.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.yunding.dut/databases/MsgLogStore.db-wal

Filesize
68KB

MD5
58fa0500703e9ffdfa5eadb0771f4527

SHA1
7ad45df7eac8f9a3e6db2dd544c15d4715d2d487

SHA256
1c8ab1f75d5f3cd60d5fc0b2783e0c425fbdaad9bcb29eba25881c324c30ff65

SHA512
f779fcf38b08aebf7f9f95f92f6c5c6f7a89f1a57cccc712b8343c2fab8f3f914050b68c02b3679a34f23ae644f73f30bd584cc84839933a1d979a2f3811a445

Download Submit
/data/data/com.yunding.dut/databases/accs.db-journal

Filesize
512B

MD5
e2b1809eeabe7fc964d1ded1662cf142

SHA1
e3e4cdff968c85e38b5b5e704fd472c468dea369

SHA256
8d58ff9d3de62a5f548b4511cc457c514939be6234f6d6980f41a2a9d0e6502b

SHA512
3427cec1d3352fc89a251b5756541b3f2519bcea6ccde53881bced3bbe4b6f1350cf7a56f618923c7afda125381daa1ab71882d7976eb92692d95ac0100015c3

Download Submit
/data/data/com.yunding.dut/databases/accs.db-wal

Filesize
32KB

MD5
ce5a15b840c1d706ad8656de7c7c6fde

SHA1
603cdccc3bfa18822c9c2bc50fbea16a1d97a158

SHA256
01fa04f81998613c9f0e037f4cf2d3ae5a4fa814506ae751dc58bab603c98cb7

SHA512
5db64b97d4c587b009c970823029014f1de357c0f5f1a480af64772161a9952793bd8aaff7412c6fac27d705092728978ecaa7b4a7fd1ffa080b2d7d8b1bbdd2

Download Submit
/data/data/com.yunding.dut/files/.envelope/i==1.2.0&&1.6.8_1716618618479_envelope.log

Filesize
2KB

MD5
cdffb06e65630e9c27bd2353efc6a091

SHA1
a7c4aa4e4a6da472d23a2fa98b44501d4da2986d

SHA256
071c1b2c288527f7e6044a792e7e93c65f818a407710fec2409628ec7e06295f

SHA512
e904603f9eb46ad7931a01c8ce3337d93c93315b2302443ae22ffe77287b4008b2f0fc4fd4750370e6e036ed2fe7ed87635e95f60fd9ccc82cebfa0ac941b60a

Download Submit
/data/data/com.yunding.dut/files/.imprint

Filesize
559B

MD5
99a27f4b61e4330c756ac9fcf10c3822

SHA1
f491635efc2e8f1ce71d2e5b9db1c3fc239d7166

SHA256
13fd1b98e243df71a85a3d85f6591dc296d375325b953c9fe6b26ec22e637f14

SHA512
c7bf07041635ded5d433c33e3794541a8197ccc02b79cd64626ccdb26bb8c576836645c2866dd8a51f455518f5b7ba89cfdaafce4e7c74fe47d1f8b950d7d088

Download Submit
/data/data/com.yunding.dut/files/.umeng/exchangeIdentity.json

Filesize
162B

MD5
8c834a1e3045e1a82aa54bc4efe1ddcb

SHA1
112b72958e6022462836f485af13e8fcefe276d2

SHA256
00103f7ef6507d4d6ab3653873b00dde20f35773ffbc131d6bd07a379b578d67

SHA512
b1ad7c659c74be8968890e086d8339f7cabd1b5d6ad65556d19f8e2e3741b9a1722504f1f3db83e56fa1c8496c17af2c1354b13438b57fb052ec2517d99a1e8d

Download Submit
/data/data/com.yunding.dut/files/agoo.pid

Filesize
4B

MD5
1e5186bca8f75fca53960e8cb4a3b973

SHA1
d50a9e7d544bf289acdb5db2620170e3b702ce40

SHA256
d65112fe4b7673c7e4677845ab91b4a6686e4543ea7b1c2420f89481f7d1b965

SHA512
91b6671eab1e1614f0225d919b87dca35492b5583496fc9f2c423a51a113e96d5b1dd61b10edc4bc315e7b4cd01c370b2fe8d8a51a5a39e4c2a1d647f4bbf7db

Download Submit
/data/data/com.yunding.dut/files/exid.dat

Filesize
55B

MD5
e09166ad19fd1541ff870635fa9d28f1

SHA1
2550b3b61c8a863c96900015d87257368cfea40c

SHA256
6c986abc4ad361b74b9151dbaaedf6f6fa7860116174531b24431bbffa355089

SHA512
7137440950b3bed7ea107e11f6560b2be070b008f920b4d8168d3c4ba5eea9f5ab4177b4ab977daacb3e0d00a81cd5a4cf99d97f0d47a714f5e32b14f77cc012

Download Submit
/data/data/com.yunding.dut/files/stateless/dW1weF9pbnRlcm5hbA== /dW1weF9pbnRlcm5hbF8xNzE2NjE4NjE3MTI0

Filesize
1KB

MD5
09dfad380ec8e2a521a6ab48eedb3052

SHA1
d01b6331cf3fb0fce9dd72dc542c4638ec980c33

SHA256
23615bde7f1d50aeffdd28911fc38effa8a4166fcacc0aeeb9878db732997125

SHA512
0056a7a07a87c5e1e582e2ab7034711ed0d79d50afd5d1f75e9892a9cd97b46aa33718e0fa9b24de573da4d86a7f0f4c721ba73301e7591152c8a2c856db3951

Download Submit
/data/data/com.yunding.dut/files/stateless/dW1weF9pbnRlcm5hbA== /dW1weF9pbnRlcm5hbF8xNzE2NjE4NjQ3NjMz

Filesize
1KB

MD5
1e6f1a0112d5a6a105505ecf47fa88a1

SHA1
ba06921274fb2254ef6ccfee8c001e389d2244d6

SHA256
05659a3fb62fa11c3df43350ea691a357bf86f49d62a18a16a4f60f7736b5df4

SHA512
b93effc6ba100c2f51a21f99696cfe882d8dbd8efbb0bc2989c05faaa473bed13cd28fb2c56d3be90a169125010892e8f39c1e7819b0d8b57d4d4ffa72d6f217

Download Submit
/data/data/com.yunding.dut/files/umeng_it.cache

Filesize
498B

MD5
307eba800c980793dd566832615da518

SHA1
a74b3ea03603e424ef65f787c53dbf917094a3c3

SHA256
17f94bea1182df80a8b43c71be5ea5749ee4f08e51c81f6295fe5aadbfebc4e6

SHA512
86e4b07be88129aa16de56cb372be8e02e8c8e0a23fc58051ca8311d2cb828199f939cd7056c9648528bd8d01393564b51752d3943760d1746338252a52d2dae

Download Submit
/data/data/com.yunding.dut/files/umeng_it.cache

Filesize
253B

MD5
10cfcb8dddb365bdb8f8cc036effda25

SHA1
943bc1f29bd740292a167be099f734fc177e661b

SHA256
72335d56841369a5edee3790ce67096aa0e50c064f4a5f72e8b24441412b9c64

SHA512
71dadc06819ca17629756e90bd84e2589e49a2be8c5c421b75657c515971655a047e1257aec0a8d23f1dfca36fb811ed1c420a17a4fd413fc1dbe57a9712384a

Download Submit
/storage/emulated/0/.DataStorage/ContextData.xml

Filesize
32KB

MD5
b15b00bf90b7c93b3665eda88fbc4808

SHA1
5d90cbaee0798753afcad7e6555a92d2567dd02a

SHA256
92882182a7ffae56437ee1b2b3a68ddc0594b28c1e3a4254920023015cb4b429

SHA512
cbea5c61e2043c01bbf5b0ba79e45106bf011e29447317a4bc66560afb52177f2268f5fd95d84868152b25b1aa4368256392d24eed3f4fb9a56cb2eaa1b27059

Download Submit
/storage/emulated/0/.DataStorage/ContextData.xml

Filesize
111B

MD5
fe6a3f7326e62106b9c3ee7ec28a9766

SHA1
e44d8798567eb8466831deca69fe9fdcf44133d3

SHA256
4abc739799a47e20c65e1f049e244ad026aa542079de9fb294ab8dc78e7b5cff

SHA512
97b13038490a2e6d8b2b517aad9203a1ca8336a589e1413e5fc4213312085df8b26e8e030ac6ea5deca33d3a1b2c4f75e6e8b53df0d96c62d2bcc86a1259ffba

Download Submit
/storage/emulated/0/.DataStorage/ContextData.xml

Filesize
213B

MD5
494aca6ee18f95390f43597b096c42c7

SHA1
05b5e9a20c33455a97a9ebe53657b43565f17048

SHA256
e045dcdce22e713db778057862f88ae24d4b857538767aeb2b1a41da2425a9af

SHA512
3f3c459895e02e2094d6e8324da0a032c90911a8e5427166820c317e94b4571ebb135efb9584bed2a8e46306255c22cb25bed88bb702a4e21b0dac8ac361effd

Download Submit
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

Filesize
512B

MD5
254d15f63396a3f52303484f61c1d951

SHA1
a82b9150f23d8b7eed99adb413ef412d1b791cfa

SHA256
c310962c46cfea55c0a9e5fc77dd3139a7a141f21158e21bb30c7f90b6246831

SHA512
d1d382954796f70db09d8097b06bd37f6d69d5e9f1116b72716da76df6c388be1959aaa32afc6affd976e51c45f24a8a7e8d9665f7f24821a3771ed5efdb59fa

Download Submit
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

Filesize
48KB

MD5
6b14e75de45e7ce008d242c32644b948

SHA1
df7071002119f73e929d4d88184857ad8661ba0d

SHA256
7a3b3a34f0be857f16d4d4b07770fbff8da6e6b8af321b83c53c6836f65c1ede

SHA512
b15e2e4ccf5d0f5beb763a79be88637c4acacfca3c0894c2776daea5b0b4ef7c04feeec02bff28f4a8351e2306884b03c4fbf245dbc9942aa53aa616e905a9b9

Download Submit
/storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml

Filesize
167B

MD5
a2e97ed630e31039b1f0003bb4a5d208

SHA1
1cc8c30e7c19b4b89a877fd857033d83952c4f7e

SHA256
d043969871dae1fb7ba4a581f0f4fa8c03741820b4a0f644b4bd9066fcc7e0fd

SHA512
9bad564c56700f31bb5ceff55f41c2b0a3e1fcffab76b6942b3059325ce041fef63fdc3b973b39af3b482154a0cbe24aaf29319166b9c0b324dd7bcc0b8fed4e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads