6d7cedee5706fd878680bd6d3b912e8fe991952f9dd13c8caa5c169ad5001e77

Analysis

max time kernel
19s
max time network
146s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
27/05/2024, 00:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7756878fca235f00d16d4eb337392d05_JaffaCakes118.apk
Size

5.3MB
MD5

7756878fca235f00d16d4eb337392d05
SHA1

60aa974c8e4c03731a2cecbb82749710781bc4d6
SHA256

6d7cedee5706fd878680bd6d3b912e8fe991952f9dd13c8caa5c169ad5001e77
SHA512

4deab3c996e179f3811f0b7eb74aae35f42b09897d8563c00193c3e7947a5f6dc223568b0783eb4961fab7509fa381e36774c1a14bcb2884d32cd3d91b590482
SSDEEP

98304:ozq1vWv1elmfAJncogsroZdSmz8r7WUmMqDODZ0Tn6VlEavvqby0ioQw:oGMv1nYcogQrqUrq6DHl5vZHoQw

Score

7^/10

discovery evasion persistence

Malware Config

Signatures

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.yxxinglin.xzid119018

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.yxxinglin.xzid119018

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.yxxinglin.xzid119018

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.yxxinglin.xzid119018

com.yxxinglin.xzid119018
1⤵
- Checks memory information
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:4240

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.yxxinglin.xzid119018/databases/query.db

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.yxxinglin.xzid119018/databases/query.db-journal

Filesize
512B

MD5
12e315c0ec5442cc529de95fe5b3fab9

SHA1
3ae8fb74d6408444b8b8075657dfdd888d5c5af9

SHA256
b33f5c83fdbf90b53f66feee906b48ad7d95a97b640b457c4f6481e7408475d0

SHA512
ec6c7305c78d093fd54dd63cb47464b73e6da8295c57f1438fea2e8b37844cd3a47fec5cfc4c177bb210d4405e95553657a63f384eff127b05f382f4aac81956

Download Submit
/data/data/com.yxxinglin.xzid119018/databases/query.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.yxxinglin.xzid119018/databases/query.db-wal

Filesize
28KB

MD5
2945c88b2c18c3ed58d70c8770ad2650

SHA1
c0dc6f1b49e08236437947a40734d5a3c1d4e06b

SHA256
b8c9ec2c21056d7367d014fcd02148cb0e25cb6ae90015e370492ff44c9beb64

SHA512
1d31310e470847a45b03ab083ec2dfc5d95678e52d604bb9239e9225ed3b99597c37125956ebce9d7c7ab2ab3182119f882d072893713d82bc836aedaceac822

Download Submit
/storage/emulated/0/zzyy/cache/journal.tmp

Filesize
36B

MD5
37e8e716e0e2f4a0b05cd9571d95b84d

SHA1
f8d068f6931707bddb8cd69f706f2224ad1fea3c

SHA256
7080cb592d5149c858b206d3fd0d5e3e7d601f120af00b2616bee928ee1291ca

SHA512
e62b850901835fdb73fa6224618422f721dd765861d42f6bc2dd013413e96bd910ac5313afd9b4f63da74beb12a15fac81b5157456c9caa3031862dab84423f6

Download Submit