5c2f954a7c1f7d4c9c0dc67e743b174d8c60e0843e56c898afc29eb46c04fbab

Analysis

max time kernel
126s
max time network
183s
platform
android_x64
resource
android-x64-arm64-20240514-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
submitted
26/05/2024, 03:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
743d0797838bffd1d8d6ddc2ab738fb6_JaffaCakes118.apk
Size 19.8MB
Sample240526-eckk9adg5v
SHA256 5c2f954a7c1f7d4c9c0dc67e743b174d8c60e0843e56c898afc29eb46c04fbab
MD5 743d0797838bffd1d8d6ddc2ab738fb6
SHA1 ca607839174d831fce1d7b07eb63bb01e8f26b55
SHA512 daf5cfeab98cdd0e260d7a36324f874777f7a4e6f03ad6b43f6acec0d444b76088aed63726bb18e4f3e01f4e0d242a12f05102e703149d4e8f73d381c21c4b39
SSDEEP 393216:3qRO+ixPOIUg/2BUoXTNR4pvZisa1SiDded0vQ5Z1wBon:3SUOIUg/2BUoXIixSicd0vQ5Z
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion impact

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 6 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/data/local/xbin/su	com.qiiiqjk.kkanzh
/data/local/bin/su	com.qiiiqjk.kkanzh
/data/local/su	com.qiiiqjk.kkanzh
/system/xbin/su	com.qiiiqjk.kkanzh
/system/app/Superuser.apk	com.qiiiqjk.kkanzh
/sbin/su	com.qiiiqjk.kkanzh

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.qiiiqjk.kkanzh

Checks known Qemu files. 1 TTPs 3 IoCs

Checks for known Qemu files that exist on Android virtual device images.

evasion

System Checks

T1633.001

ioc	Process
/system/lib/libc_malloc_debug_qemu.so	com.qiiiqjk.kkanzh
/sys/qemu_trace	com.qiiiqjk.kkanzh
/system/bin/qemu-props	com.qiiiqjk.kkanzh

Checks known Qemu pipes. 1 TTPs 2 IoCs

Checks for known pipes used by the Android emulator to communicate with the host.

evasion

System Checks

T1633.001

ioc	Process
/dev/qemu_pipe	com.qiiiqjk.kkanzh
/dev/socket/qemud	com.qiiiqjk.kkanzh

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.qiiiqjk.kkanzh

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.qiiiqjk.kkanzh

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.qiiiqjk.kkanzh

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.qiiiqjk.kkanzh

Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

evasion

User Evasion

T1628.002

description	ioc	Process
Framework API call	android.hardware.SensorManager.registerListener	com.qiiiqjk.kkanzh

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.qiiiqjk.kkanzh

com.qiiiqjk.kkanzh
1⤵
- Checks if the Android device is rooted.
- Checks CPU information
- Checks known Qemu files.
- Checks known Qemu pipes.
- Checks memory information
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Checks if the internet connection is available
- Listens for changes in the sensor environment (might be used to detect emulation)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4619

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1628

User Evasion

T1628.002

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

1002

Path /data/user/0/com.qiiiqjk.kkanzh/app_crashrecord/1002
Size 228B
SHA256 030e85e32791a1f7318b75ec100c0480bdc50ed1b84c5bd954021c830b17ed0e
MD5 a53b4a940a0fd8fa85acda1d96a6cfff
SHA1 71cab56e9faaba31311c18e0c2cb17f78e3f23b2
SHA512 b4e2891be08264ccc46fa4318a7f3381850328993a6f476770edbca50f4e2f6c86aaa4cb58191d857d557322074c48f3b18e355770899bd762bc80711925304f
MD5 SHA1 SHA512

Submit Download

1004

Path /data/user/0/com.qiiiqjk.kkanzh/app_crashrecord/1004
Size 228B
SHA256 f96492e701a8c4b375e11172cf8642348c045b661f0c336be3f46f834c3b581b
MD5 335e23a9bc88c0d65b4d44c1c5cf0500
SHA1 920e6a2176a323aaae0a097974a620d1a0b6624d
SHA512 5a3814750fcfb9f5b52db626613981f2285ea9670f15c13c598257ef51444abb9199466373ed0ef03a45ed92b88957ca24ad243bae766332a9ef42112d1448a6
MD5 SHA1 SHA512

Submit Download

1004

Path /data/user/0/com.qiiiqjk.kkanzh/app_crashrecord/1004
Size 58B
SHA256 988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
MD5 0d210bfb2a0e1f1b4c082a6a0f79de07
SHA1 bb8ed9e364db79d1d9f2fcde3f15091893222faa
SHA512 536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1
MD5 SHA1 SHA512

Submit Download

bugly_db_

Path /data/user/0/com.qiiiqjk.kkanzh/databases/bugly_db_
Size 52KB
SHA256 09fe4ec4cade7aff70f7f9ff4b1044a3f38d331c5d1d7618894305ea9a1beb80
MD5 b186b21346543ca4360e809cee53cdee
SHA1 6fecbeecfcf1cbcd67af43c99168d15997bc282c
SHA512 21331d4d9c3d9eb3cd1b3cea95adbff8cb51a8a9a8baf4e96f65d9cea49b04b8544da8412ae066566c361c32bb5efcf007068b10e992285efe409e3cc856cad8
SSDEEP 48:TZX85WuAriStwwuMN5meposS8yjvyps5CiZK:y53AzwdLyps53ZK
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_-journal

Path /data/user/0/com.qiiiqjk.kkanzh/databases/bugly_db_-journal
Size 8KB
SHA256 2df5468518afb29c379f2237ea65aea8c8110746231f24f2ed815aceba3f2318
MD5 bac9100200e1c7ad7ec15eed4c30d0b6
SHA1 a2b2022eb9a98b3726479ed84df6359f63da0801
SHA512 f493eb11ece37d229b9597d6260a4cc829e6f01ef62e338120b2f59dfbb83d134658cd2a1c8ce60206eca332b1e300848b723e59a85310effc8f62ed6b1e5bb4
SSDEEP 6:7+/l9QTPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKaU/oo:7+tgqLJdeWRmBEyPbv0oo
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_-journal

Path /data/user/0/com.qiiiqjk.kkanzh/databases/bugly_db_-journal
Size 8KB
SHA256 6a22950f011be26f94444ff3657f4d4a80cb2b4f25f40fe842d6b5962c44d94f
MD5 e8dd1d4c5b6d0d5f4279e1472d01f522
SHA1 b8b3a6b9b4fd579fa8919e2e3c29e99d896a1ced
SHA512 e538b25107d665028d4fb08b0ee4a4a11b05e06d986a894d1ba8f567b5fc8022ce907bba5e88138bf82907fef2a8742a524713e30be806f2846279bcd0dbdf1b
SSDEEP 24:7+tQWqLLRXBq5JQfs6y2nriS3dVi6fXX+McEnKwm/mpLwBpGSC:7MQWqJX85WuAriStwwuMN5meposSC
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_-journal

Path /data/user/0/com.qiiiqjk.kkanzh/databases/bugly_db_-journal
Size 8KB
SHA256 4ca3b828cb86a28adec88af079a08d8bbca6e65a75420816483e407faeffd1e3
MD5 2f0e4d7c72086d1394ebec7a487288be
SHA1 712de0395109975b64b9f74fae00fceaff0b869c
SHA512 4e8f14b7eee790f4aae252bf93c1a4d5ed74419923bfd9bb83e713ff63f1347fb9ba362566f1d567a4c71f5ac416b4438e75788ed1538d6c530ecb98ca4a3e0c
SSDEEP 48:7M/s5CiZKHWq5X85WuAriStwwuMN5meposSp:7Qs53ZKHWH53Azwp
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_-journal

Path /data/user/0/com.qiiiqjk.kkanzh/databases/bugly_db_-journal
Size 8KB
SHA256 d0694c85a5eb559931e526293cc9ba6a67eaa99fe4901cdb46e19d08561c1cf8
MD5 b9440a7a0b6a1f4d7e68b4b9d245f575
SHA1 4b25b33a0cd3d885510f157673923e7a59d78a6f
SHA512 c2547fb260ebc42cfe4f7cdd593b9c1eafe56715fe574d4c549413fe13f78b739c4b9b76ad8dc765763ba3a8fd0163c923a906e9f9db7752dacd6c24df5613f8
SSDEEP 24:7+toqL9sSXBq5JQfs6y2nriS3dVi6fXX+McEnKwm/mpLwBpGSeh:7MoqmSX85WuAriStwwuMN5meposS+
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_-journal

Path /data/user/0/com.qiiiqjk.kkanzh/databases/bugly_db_-journal
Size 512B
SHA256 a7acbf338e034ed7dcacbed64e1a187b99327b9d747c54fd96556f9bc2cbfd50
MD5 09724b29e5bf578e8079976b136af496
SHA1 93648457589ebca1536e4ee3cd13125c98a66407
SHA512 3e14e295b4b617ba97058c42ccff730038cb725f245ff009f9d17aacc2778d7747ee517eb847c47d9b71bef5a96fba4d17d67f6370affa9a90d682239a599bb6
MD5 SHA1 SHA512

Submit Download

bugly_db_-journal

Path /data/user/0/com.qiiiqjk.kkanzh/databases/bugly_db_-journal
Size 8KB
SHA256 ec1eba74e9e09a752a38fdf772fa588011d8c6e469a31939e77c629781b00b29
MD5 38b97cdcc45c6c217146b191a26f4c8d
SHA1 525fe19b99bcd20d69d6a113043e5095757576d3
SHA512 492aa6d44dc478c822c65be7a3b1c183ab3d9226276fa272f0b64a690948b626f6a1ad18d3a9162488630452aab51085990b2f6370d2ca474f902f21ea0b3724
SSDEEP 6:7+/l9H+Gn1mJvg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK3:7+tl+PpqLiuWdYRmBEyPbw
MD5 SHA1 SHA512 SSDEEP

Submit Download

dW1weF9pbnRlcm5hbF8xNzE2Njk1Mjg5MzA5

Path /data/user/0/com.qiiiqjk.kkanzh/files/stateless/dW1weF9pbnRlcm5hbA== /dW1weF9pbnRlcm5hbF8xNzE2Njk1Mjg5MzA5
Size 1KB
SHA256 b344b15c3cc024b198c33a65017eea826656f7625f0b953e2146103dd3d66ab7
MD5 383666e65e7241719134fc77343a5f1f
SHA1 6e03bfad7e001545509d5bed263ae78ced6efbcf
SHA512 d4303810a1d82ee1e7392c83d2f34548e169264c932b8a31398f945fccd6724f870aff4f659826825775391bf9b6f66e560e9398e3573e846f51a75664305900
MD5 SHA1 SHA512

Submit Download

dW1weF9pbnRlcm5hbF8xNzE2Njk1MzE5NTA0

Path /data/user/0/com.qiiiqjk.kkanzh/files/stateless/dW1weF9pbnRlcm5hbA== /dW1weF9pbnRlcm5hbF8xNzE2Njk1MzE5NTA0
Size 1KB
SHA256 db4c8447a6b1fe24d30c413ac85493f123b24295bc011065e2340d86bf3593b5
MD5 5285d38a891ca0b1ba125b5f1ead1f67
SHA1 a89a8b64f0cd4d4d8c8199c973350c7550bacbb8
SHA512 5f2fa1f8c28cdd0f4748bc3ad2eb1e62bad32cece19d7ee50432f401c0978b972cfd739d5679ff43ba5d7da6ec58a4edea6df6c226f5533836cb59e475f189fd
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/user/0/com.qiiiqjk.kkanzh/files/umeng_it.cache
Size 350B
SHA256 1650ba514b809e4314d4696a1ad93f02361b112d5c39278ff04f7c76f918828e
MD5 0546f43822f20987cbc2132813d35e84
SHA1 dc79e88be367374382bac54d538a28fa21bd2108
SHA512 4f85ae6883b9fca8d19aca4ac3e9b9fdf8392056c01b250d60ade559ff2d28b04704c51dde5239bbe92cf7cd1ff37fddbb6c3995498b5bd4d4bc67b845610c3d
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads