b68bcc1fcbefeb6746fd481d5067aa357f7c0e02a665931f077f68ec39a69ade

Analysis

max time kernel
47s
max time network
138s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
27-05-2024 09:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

78c26ba123ccaf8898c4ef349b1e737f_JaffaCakes118.apk
Size

17.5MB
MD5

78c26ba123ccaf8898c4ef349b1e737f
SHA1

dfa21439cf368e59e7ab59e7c6b05b43fe467de4
SHA256

b68bcc1fcbefeb6746fd481d5067aa357f7c0e02a665931f077f68ec39a69ade
SHA512

63562039abde9b279524f53f47dfdac83e3eef2bc0b5a98459b8191b1705fc1a67f7e02a9775337a6fc22198f41d34259c386bfddd9007ef13421bd470073723
SSDEEP

393216:sM7oSzkJoxymwHozR0F+PHaydkJXaFrgzd1n5YSJb9:sC/ISxdwIOU/ayHgzrntJZ

Score

8^/10

discovery evasion persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.kekeclient_
/sbin/su	/system/bin/sh -c type su

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.kekeclient_

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.kekeclient_

com.kekeclient_
1⤵
- Checks if the Android device is rooted.
- Checks memory information
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4259
- logcat -d -v threadtime
  2⤵
  PID:4324
- logcat -d -v threadtime
  2⤵
  PID:4339
- /system/bin/sh -c getprop ro.miui.ui.version.name
  2⤵
  PID:4366
- getprop ro.miui.ui.version.name
  2⤵
  PID:4366
- /system/bin/sh -c getprop ro.build.version.emui
  2⤵
  PID:4392
- getprop ro.build.version.emui
  2⤵
  PID:4392
- /system/bin/sh -c getprop ro.lenovo.series
  2⤵
  PID:4417
- getprop ro.lenovo.series
  2⤵
  PID:4417
- /system/bin/sh -c getprop ro.build.nubia.rom.name
  2⤵
  PID:4441
- getprop ro.build.nubia.rom.name
  2⤵
  PID:4441
- /system/bin/sh -c getprop ro.meizu.product.model
  2⤵
  PID:4466
- getprop ro.meizu.product.model
  2⤵
  PID:4466
- /system/bin/sh -c getprop ro.build.version.opporom
  2⤵
  PID:4493
- getprop ro.build.version.opporom
  2⤵
  PID:4493
- /system/bin/sh -c getprop ro.vivo.os.build.display.id
  2⤵
  PID:4520
- getprop ro.vivo.os.build.display.id
  2⤵
  PID:4520
- /system/bin/sh -c getprop ro.aa.romver
  2⤵
  PID:4545
- getprop ro.aa.romver
  2⤵
  PID:4545
- /system/bin/sh -c getprop ro.lewa.version
  2⤵
  PID:4569
- getprop ro.lewa.version
  2⤵
  PID:4569
- /system/bin/sh -c getprop ro.gn.gnromvernumber
  2⤵
  PID:4593
- getprop ro.gn.gnromvernumber
  2⤵
  PID:4593
- /system/bin/sh -c getprop ro.build.tyd.kbstyle_version
  2⤵
  PID:4617
- getprop ro.build.tyd.kbstyle_version
  2⤵
  PID:4617
- /system/bin/sh -c getprop ro.build.fingerprint
  2⤵
  PID:4641
- getprop ro.build.fingerprint
  2⤵
  PID:4641
- /system/bin/sh -c getprop ro.build.rom.id
  2⤵
  PID:4665
- getprop ro.build.rom.id
  2⤵
  PID:4665
- /system/bin/sh -c type su
  2⤵
  - Checks if the Android device is rooted.
  PID:4689

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.kekeclient_/databases/bugly_db_legu

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.kekeclient_/databases/bugly_db_legu-journal

Filesize
512B

MD5
a03aebcab24bfe903a4efaea31789bf7

SHA1
eb314068ad67a2f297efc5cc28d46bc70799b38c

SHA256
f76ee8d73e768f19592532de7970bf8f23c9b8fb6f96af7fa165ab5ec64ae02a

SHA512
4623de80f98d3abdd6c12143204465113bd8d979e5a5a1c4e23cc05ea0751d1cd57a48cca4d12cd0da7abd4cbdf188bc77714337e11ff2a2c40234de38789efc

Download Submit
/data/data/com.kekeclient_/databases/bugly_db_legu-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.kekeclient_/databases/bugly_db_legu-wal

Filesize
229KB

MD5
740b478a6a314e518f58233abaa88508

SHA1
2e7f5463299a3bc4e4a97015a6acc257b6da25b1

SHA256
9c72d5f19913998b6fdb5508661701243dc941f6faad7ec703967b13f37a08d9

SHA512
dc8832bd84b39978d8f1e1c798174685a0f477a05d6db02e7cd46685323e7278734bd3f054a72ba3600ef605de50384a05711a5eba32e0f67bd7815da0206f64

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads