e818d3ae8e6f0e5f6892dbbe2e03235102df9d5d606d941c23af5926680a2f11

Analysis

max time kernel
63s
max time network
187s
platform
android_x64
resource
android-x64-20240514-en
resource tags

androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
submitted
25/05/2024, 12:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
71f15f195d9dbfc03e9eadf9b6fcca19_JaffaCakes118.apk
Size 12.5MB
Sample240525-plkygsbb38
SHA256 e818d3ae8e6f0e5f6892dbbe2e03235102df9d5d606d941c23af5926680a2f11
MD5 71f15f195d9dbfc03e9eadf9b6fcca19
SHA1 420ca6e786b2f68aa43f5fcb29b383faca125f20
SHA512 0abee7d148267ae90df51a8c7033a13a20e0b1caf1f9577667eb0e509ff5c6b73bd836a9aa729c6f0dd9077ed173203ad802679ef643e0ed2cbc0e362476a42b
SSDEEP 196608:oHu/GB1QRofCpp9qzgCfUi0uUiPNJeoV9RPhTaL5wem2iM9OfZE0SEgp5d3/1f:WkGBSozCi0U/tPhTmm9GcE00LNf
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection credential_access discovery evasion impact persistence

Malware Config

Signatures

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.qisheng.nshengyibao

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.qisheng.nshengyibao

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.qisheng.nshengyibao

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.qisheng.nshengyibao

Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.qisheng.nshengyibao
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.qisheng.nshengyibao:push

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.qisheng.nshengyibao

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.qisheng.nshengyibao

Checks if the internet connection is available 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.qisheng.nshengyibao
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.qisheng.nshengyibao:push

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
18	alog.umeng.com

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Checks the presence of a debugger
evasion

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.qisheng.nshengyibao
Framework API call	javax.crypto.Cipher.doFinal	com.qisheng.nshengyibao:push

com.qisheng.nshengyibao
1⤵
- Checks CPU information
- Checks memory information
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:5128

com.qisheng.nshengyibao:push
1⤵
- Queries information about the current Wi-Fi connection
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:5300

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

UmengLocalNotificationStore.db

Path /data/data/com.qisheng.nshengyibao/databases/UmengLocalNotificationStore.db
Size 28KB
SHA256 ee182f30a5d1b6850fb64809b7ed03dd440aa80084108505c5136ead42a84d99
MD5 217fa82720cc6e32f54459ef8788a4a4
SHA1 6532c22463b66b4834c479697d4117ef1bc65b8b
SHA512 a50cf0b8e49394eb118bbf05e39ac05f2413d9c2cee2eb0d2a4042004955888cd74ab4a7dc00491815ec2cd9ab45b241303e65549b137636dae5c32f1dbc1e12
SSDEEP 24:q/eM8MmRVvy+NtXuvmVVtkwqZxhgeDGSiI:vM8MmRg+NtXPMZXSS
MD5 SHA1 SHA512 SSDEEP

Submit Download

UmengLocalNotificationStore.db-journal

Path /data/data/com.qisheng.nshengyibao/databases/UmengLocalNotificationStore.db-journal
Size 512B
SHA256 e57138a7a565531054a4c32d2f63e96456c4b3f1f37acdde5d85520fcfce87dc
MD5 bd402e9a44b61cffac7234c086694107
SHA1 c23ba928a223adba74bd9ca959d9d83aff44982d
SHA512 5e67974546c52949407739fb015627eb4b31dff5966dce56013354d27bba7faa9994770ec3b5cb1c2e0d43609da272e1ac8f200c562b42725b85d9cd2e2cf75c
MD5 SHA1 SHA512

Submit Download

UmengLocalNotificationStore.db-journal

Path /data/data/com.qisheng.nshengyibao/databases/UmengLocalNotificationStore.db-journal
Size 8KB
SHA256 e863a6c1b80b3ea5be045df7663bfed81a95f76d435ffcc874ddb38031fc0dab
MD5 02badd04770a313a0641bbc4d2c13e2b
SHA1 d4f4ee3e8e66700f2b12971dafa5d7262a4711d7
SHA512 7c49157ea42072b2be63e2d4cf3898e1ad37ccfe1d204de5f0008f873b1e740aa34c7db2c95d00bb067ca17699e1e5aa4170a6fa7d3fa1c649cd03ee6fc4be86
SSDEEP 6:7+/l9qgn1Cng9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKiJu:7+tkqLiuWdwRmBEyPbTg
MD5 SHA1 SHA512 SSDEEP

Submit Download

UmengLocalNotificationStore.db-journal

Path /data/data/com.qisheng.nshengyibao/databases/UmengLocalNotificationStore.db-journal
Size 8KB
SHA256 399721a555157f017e2d178dbdc891170bd89f457cf54455853de758f7e227b9
MD5 b6f4afea8c08002accfc312402049e95
SHA1 c3bb6c69d8e4c5d42a2cc746a62c9b27d366da8b
SHA512 4e0507bb41ab49b935b876890c285e6d88c03ff7cbc9616fce1b53e3aa417440f6f718ab74e69384d82d028ba9830862ab3c9f9bec4400d2c51a6e55ab521ef1
SSDEEP 6:7+/l98SPg9bNFlLdrlOERX4PBX4ogLugMBX4suuKmT7/Y:7+t5qLJdTRmBEyPbXfY
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db

Path /data/data/com.qisheng.nshengyibao/databases/cc/cc.db
Size 36KB
SHA256 abda5dd4cc2e7dbb951637c4b49d6990f9f34411fab4dee1a387dbcc8e7eed40
MD5 67c12933d1e0e63d9801a6aa43092ce7
SHA1 b6936908554e4a1986b8eb08289e2d3545e8ff74
SHA512 db8b818daa3ff4ec7678645f84bf8b45c809bcbb758ea78b28982d071572655bba2d20e6f1ca4f0d057ab34fa655c5bc40457dc65050180351a2fc04a47175dd
SSDEEP 12:TLgRP2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBEyPbP/WQQ:TLt7sL7yot3BVrHotGGSP/WQQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db

Path /data/data/com.qisheng.nshengyibao/databases/cc/cc.db
Size 36KB
SHA256 38f8548795ca7470b449dd1de9598c07a247ba59883c0764c9c96ff0b7d31d7f
MD5 0908e924aa236931dc7166fef6e00862
SHA1 7782648d6d8f6e835bd47058d4852932c096a467
SHA512 3c16fbc5172aed04cd206e776c46d26e911732c6e3631536410a71f1d217449475727ac9b3175e827c5ce645a1da9e05900258ee6ca27c936a9060f241361dee
SSDEEP 12:TL/sP2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBEyPb8FOwGQ:TLd7sL7yot3BVrHotGGSgGQQQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/com.qisheng.nshengyibao/databases/cc/cc.db-journal
Size 8KB
SHA256 18775cbef92b3602b2cd7e5dbd4dd92ec5f4ee16a475680fc30504baa1394f8c
MD5 7846002452b33e13f3d342c52005c922
SHA1 5c3a353278efad246319ca0abc61704e7b075437
SHA512 c68ea2e18c0fa07411775e941d26d905c4d68ffc27a5d260ffd822e5f1cb1cc0156c8f2b4cf5eca09c2c111282a0e300df78facd74ac06c58a8a89ca08716586
SSDEEP 6:7+/l9xPg9bNFlLdrlOERX4PBX4ogLugMBX4suuK+qlC/a:7+tfqLJdTRmBEyPbElSa
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/com.qisheng.nshengyibao/databases/cc/cc.db-journal
Size 8KB
SHA256 083ebee12d87a21ba511ef6f95588d6070655c5382cf49db6fcc5efe788b037c
MD5 f54cdd298e6429fe6fd40dfb4955bf0a
SHA1 161b471f63b81cea23f0eb86d256979034c61916
SHA512 ad6bed726499a9240573121908cda418facc6a39937df47309028a6a207c5df235cc5df1f893c24414f5a0db64a1000b33c8c4db3a583b1f08ef431349d34883
SSDEEP 12:7+t0ZqL/sP2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5RmBEyPbL:7+t0ZqLd7sL7yot3BVrHotGGSL
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/com.qisheng.nshengyibao/databases/cc/cc.db-journal
Size 8KB
SHA256 fb56b1597b5784d1b759a4b7f8aa4def32fb96ebf691a6bfb8f1ce590734da27
MD5 732ffcc4f8e41eb6e531385ee7d73c39
SHA1 adea218cf5a6c5a8ddd34b8a3b34b2f195e36b8b
SHA512 1ba914ecbd20e3f263b658a9bd5065134f262b7f6e87f4c5bf139b328b5a1a0d3558237611d04056733c07a8c4e310fb736753e00541d54a66d6d8d4ddd80ce2
SSDEEP 12:7+tc0W6nqL+/E6P2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5Rm4:7+tMOqLpr7sL7yot3BVrHotGGSM
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/com.qisheng.nshengyibao/databases/cc/cc.db-journal
Size 12KB
SHA256 3674677ae4f33450ec33dd9e20acb71461f33890f27386462024ed5ec80a5839
MD5 627e3c7d91c6400c057f49ee9478c70c
SHA1 f038e2a0441f12377b4e3d01a818852773acb592
SHA512 402cb06a9335eb2724b0bb09b6ca8797de2aa4fe156cdcd7d84119d47177222b1b67d27bcea47ee5362381fc4d86e3edee767c2f5ba90cb0a12bd564eab295b6
SSDEEP 12:7+tVHmOfkWqLWEOVP2yMHdqVcV7p5WUYUW5LfpBKKyBGtbDrNTSFbycKrHBGtb5a:7+tVHvcWqLEe7sL7yot3BVrHotGGSV
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc.db-journal

Path /data/data/com.qisheng.nshengyibao/databases/cc/cc.db-journal
Size 512B
SHA256 e10b08f2d1a4a2df945685cdc0272b49bb5c06857298ee444f9ae6c73883af8e
MD5 c140b129a4c37ea5a3f57f3922c6d2c3
SHA1 eae375883a89aa7b11c7a079a293af01628f1060
SHA512 6857548f4cae28206dee0da98b4476456680c4caa109827ee4be48ea3c224db68d2fb376992f5dca064bbd2cfc7814f48dd1684c1bffe5f0c13b7b78c153a1ef
MD5 SHA1 SHA512

Submit Download

cc.db-journal

Path /data/data/com.qisheng.nshengyibao/databases/cc/cc.db-journal
Size 8KB
SHA256 b6834cf31a46317fd6ddb196fd99f45ded3b601be8c6a23eef6da6053b60b27c
MD5 067d62a4d153f5ee9bbd22fed129b367
SHA1 e9a92ab5f27ba82fc4399f441da6e30751d65e93
SHA512 8aa7ba6a7b1a00cef382aa707eb7aa4500af35e5ac3b6d0d773632be2fa0ce8cefb45e9716b71e8b660f0a0ddacd398e297688fa0d286fd2f05430f7a667d51b
SSDEEP 6:7+/l96Vn1yqfg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKfa:7+t0xfqLiuWdwRmBEyPbh
MD5 SHA1 SHA512 SSDEEP

Submit Download

.imprint

Path /data/data/com.qisheng.nshengyibao/files/.imprint
Size 930B
SHA256 4084c3ad5ac66be2fb76d4d0331f34d3b081f24d49de807d8e553c97b5f4d241
MD5 87e924598425c8528a8664cb37155e4c
SHA1 f9511fa6047c0113573b4f4c685807019b3f0a53
SHA512 3012b273a340f6871c19fe10f92bd9a1f7bcddf22b1eadf388498ea6aa0e4c93676078df24e0eeb3390ae9a9b8e38e51916bb97f7f690349df39f8a75e4ac3fc
MD5 SHA1 SHA512

Submit Download

exchangeIdentity.json

Path /data/data/com.qisheng.nshengyibao/files/.umeng/exchangeIdentity.json
Size 162B
SHA256 8446abc14b4a70e893bc3d0892d02071ea9b904343def91e20111579f0d6b6dc
MD5 8385a7f8b75fa4eac4f292070ed5cdc7
SHA1 e255d2995ac91a4a1ea3bdc1e932cce7adec672e
SHA512 6ee21e80e7db0bfa1b3fe7f1d57a37ae207be10acb720f75f378f72cea72c549ee8be342d226760c435e71f43816fedf9064f75e3bed6c090d3e4492787674e5
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/data/com.qisheng.nshengyibao/files/umeng_it.cache
Size 433B
SHA256 2d9d3be09a3a0515bfbe9e86dc30bc94f56e6ccd5ba2b632c12f79f7ca971549
MD5 63b11e4dd5e5aecba2ffb161ccc4e12e
SHA1 a2adcedb77c1922110739e5c0808919d0945401b
SHA512 e43b4689caac6549dff5d46de97b07cd104bc53db8cb3fd9c9a50fa9e34f0697ac7c9e396ad2a026b1887139eb8e7864fc51c62ac8840549c6ad2978d4a301e7
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/data/com.qisheng.nshengyibao/files/umeng_it.cache
Size 220B
SHA256 4f8695d3e2e1f651d370ea4d9d246a45f5b45e1002fa489db15e37f71b022070
MD5 8520e86c6df58d18677dddee74163fd6
SHA1 b9be3d25837d085abfde020cd789ffd2a32f379c
SHA512 7cb517e179f790729015f6900796f2b9fc44ef4e9a9f14107d87be9a2e4441e8707a6578fbf3a7ac70efd1b0493732832d66de86d3825cf6fc37fe61716e7920
MD5 SHA1 SHA512

Submit Download

ContextData.xml

Path /storage/emulated/0/.DataStorage/ContextData.xml
Size 111B
SHA256 81593422ae9241058c5feb216083e55e076bce962450c5995be8e8f3537931c7
MD5 3cfff159c08d371ab793b2b773e7e509
SHA1 4ede2514f3ffdda2c2d16632402ba79d6582d6e9
SHA512 5ad823d9ae8da411f2ae58f152059243a5052964706774aa44708ca4639e1d488286d313a6d98bdb674f2d619e624742240a40b56a38c2d51a2638ed1ad15b9d
MD5 SHA1 SHA512

Submit Download

Alvin2.xml

Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Size 65B
SHA256 3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793
MD5 9781ca003f10f8d0c9c1945b63fdca7f
SHA1 4156cf5dc8d71dbab734d25e5e1598b37a5456f4
SHA512 25a9877e274e0e9df29811825bd4f680fa0bf0ae6219527e4f1dcd17d0995d28b2926192d961a06ee5bef2eed73b3f38ec4ffdd0a1cda7ff2a10dc5711ffdf03
MD5 SHA1 SHA512

Submit Download

Alvin2.xml

Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Size 111B
SHA256 7c0becf9b2015fc93b8c07b56832b905422ab9be31e6c2af06572aac1bd77550
MD5 ebb294e34078fc69164f8f70726a730e
SHA1 e03afa1ee995137be93de7c2dd7832d880495993
SHA512 b73782ba0a2bd78d4f8aad8748a975f0b5d79b1dcc15a448d4b2492773813290343feb17dcec59c6c76965c01f957614c73c262cdbee5e6535e22de4618fce90
MD5 SHA1 SHA512

Submit Download

global.keystore

Path /storage/emulated/0/TuSDK/global.keystore
Size 222B
SHA256 3fc8933a80e2d4460e2782f1bf1803d9b1693e3bd78c0bad16dc681170a4013e
MD5 4fb36e34461688e450f0e4978ab8c0b9
SHA1 8fcc5acc2ab0d18e4f8bbb5b4a801f4a05dea80e
SHA512 e3eb93ea0d7672e639d0055180a4836932d49b9d6309b21a7feaf10a58bcd628d841fb8088b17b72cb9c123c158b6b3e3a01d7e1046c4328da0c9ae26206af5c
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads