afb0412986738d4ae226d4297d29ff0457996809231fabcafe18f409323673f4

Analysis

max time kernel
47s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
27/05/2024, 17:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
79da75fb40dd05ef468532ef6f444f25_JaffaCakes118.apk
Size 8.0MB
Sample240527-vm41msbb2s
SHA256 afb0412986738d4ae226d4297d29ff0457996809231fabcafe18f409323673f4
MD5 79da75fb40dd05ef468532ef6f444f25
SHA1 5e15166d6c4449606b3102ae28b2ae9b8d59b6c4
SHA512 4129719a63b4ae7c7cb903f7fb126849c4ac12c807cd848073e0dd407ed501dd99e9feeb5336ac5c829ec5a5df6aacda2501d5e03d602c6c2c814fe98ddafeb2
SSDEEP 196608:OlgF5iBraRA7inG4FAS5Oa9ovAtVnogksqNSil7VqR1rqwOw:OGwa7G4xOkoInogkjVl7Vqjqe
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery evasion persistence

Malware Config

Signatures

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.zz.yyb.ssc

Loads dropped Dex/Jar 1 TTPs 3 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/data/com.zz.yyb.ssc/mix.dex	4279	com.zz.yyb.ssc
/data/data/com.zz.yyb.ssc/mix.dex	4378	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.zz.yyb.ssc/mix.dex --output-vdex-fd=57 --oat-fd=58 --oat-location=/data/data/com.zz.yyb.ssc/oat/x86/mix.odex --compiler-filter=quicken --class-loader-context=&
/data/data/com.zz.yyb.ssc/mix.dex	4279	com.zz.yyb.ssc

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.zz.yyb.ssc

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.zz.yyb.ssc

com.zz.yyb.ssc
1⤵
- Checks memory information
- Loads dropped Dex/Jar
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
PID:4279
- sh -c getprop ro.yunos.version
  2⤵
  PID:4353
- getprop ro.yunos.version
  2⤵
  PID:4353
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.zz.yyb.ssc/mix.dex --output-vdex-fd=57 --oat-fd=58 --oat-location=/data/data/com.zz.yyb.ssc/oat/x86/mix.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4378
- logcat -d -v threadtime
  2⤵
  PID:4431
- /system/bin/sh -c getprop ro.miui.ui.version.name
  2⤵
  PID:4452
- getprop ro.miui.ui.version.name
  2⤵
  PID:4452
- /system/bin/sh -c getprop ro.build.version.emui
  2⤵
  PID:4494
- getprop ro.build.version.emui
  2⤵
  PID:4494

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

751bd2fd9001873c4c19f3493899b17e439ca7bea8ff77724b22ec9de0ea02a7.0.tmp

Path /data/data/com.zz.yyb.ssc/cache/image_manager_disk_cache/751bd2fd9001873c4c19f3493899b17e439ca7bea8ff77724b22ec9de0ea02a7.0.tmp
Size 5KB
SHA256 73cac48c71b8807c4e396f73d711dfc105476cc49c41feb19ba88508197b228d
MD5 e35c9e3018df83a4491af6259a1b9755
SHA1 84ed7f9cec34621d1ddbca56c3b53cf07aa6608e
SHA512 01c25d87261b1588ec8bdff9664c641a46601d1dd69b7f4c2c3e381516f24aed0e7df0ec176547453262e098fd5504f39f31fb103ef2b19015d53038ffabb04d
SSDEEP 96:w1Wim44dwYKXpehx6JYzbNjKQblOdjCEM003zmPZqV7o89ey4cspTW9z:OhSK5ehoiHNeQJOdjG3qkWNyKuz
MD5 SHA1 SHA512 SSDEEP

Submit Download

journal

Path /data/data/com.zz.yyb.ssc/cache/image_manager_disk_cache/journal
Size 178B
SHA256 66912010f346c30220cb755be5fd530be37c22fd732d51134c8fe69af6fec19d
MD5 4cb7ff8c804011170141dbc0a659ebcd
SHA1 231435521de5774113370aaecdc78c911e014095
SHA512 01f4252f04f0b57e0d1a555664ac8edcd5ff9120a4844468fc935e814f073bcfdcf78bd2d1706c7a2da0eef6b5c5f461b14409145949f81de20f10a2b71a50ed
MD5 SHA1 SHA512

Submit Download

journal.tmp

Path /data/data/com.zz.yyb.ssc/cache/image_manager_disk_cache/journal.tmp
Size 31B
SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
MD5 8c92de9ce46d41a22f3b20f77404cc1d
SHA1 8671a6dca00edb72be47363a7071be65cf270373
SHA512 30f45fe9954215d6adafcc8f0a060a7ff41963a64f9b849a37f0d18fe045038d429ec13bf15226769c4ba78dad3c52f3d9e0dbbb4fcdea4828a1efe956e48f56
MD5 SHA1 SHA512

Submit Download

_nohttp_cookies_db.db

Path /data/data/com.zz.yyb.ssc/databases/_nohttp_cookies_db.db
Size 24KB
SHA256 4895bff14c71a617ca75f6ce7933b28332ee06a1b2aa431ee3e108db693cdf0a
MD5 692957a8f6be4a25986a068c449b83ab
SHA1 04223c8cbcf0032443488e3f5f9bee9f91eb5f7d
SHA512 0617a88df6a60252050fc5403f6d01936bbcba961d707474d62bf97cf1e2034999befd13fac5e58d430ce43dd45dce8e2e6c8b6b125ea53dada382aebcfa3742
SSDEEP 12:T6MQILGj3AjKRqTSFbyEQkANaKl9PJXrtkYkRmBEyPbD3OwG:T65Iyj3CKRqNlPldGSzG
MD5 SHA1 SHA512 SSDEEP

Submit Download

_nohttp_cookies_db.db-journal

Path /data/data/com.zz.yyb.ssc/databases/_nohttp_cookies_db.db-journal
Size 512B
SHA256 b0145fbbb8f1fdf50cfe01534efe61b80471960084e72b41ee38bf455fdfd488
MD5 7d8251366f37251043bd24704457e1ac
SHA1 3b28fecfcbe84911084612298e0cb89040cfe232
SHA512 4d52653dc20dfb1408bb7bcd2aaf6a8ff8fe61db9484e419f4bad94e3478e5e6f95c3b12a6b066a02e6ecd0e4503452b9dbfbda1e7683fc02d6e15380d50d900
MD5 SHA1 SHA512

Submit Download

_nohttp_cookies_db.db-wal

Path /data/data/com.zz.yyb.ssc/databases/_nohttp_cookies_db.db-wal
Size 36KB
SHA256 819143a6bb178c9103b8640bb6647afde8c201e098ae27ff7f626ec0911c5025
MD5 1e42ff08659ee6394ab4c54a0b6338f3
SHA1 79b6f7eb25b152d69c589ba9c1e51d85fe6c32ea
SHA512 5afc51bb10f46f639265fcf9ffbd4a3e2ac096c9dc55a50733d88e56aa4fa07a495f6dafbc061811f0f461105efd335a78e626076fb69df844db8ad041f0f8cf
SSDEEP 24:Kr8yzyGSP/BEv0Xq65Iyj3CKRqNlPldGSP/aB:y8yzNSP/OsqbKcjqSP/aB
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu

Path /data/data/com.zz.yyb.ssc/databases/bugly_db_legu
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

bugly_db_legu-journal

Path /data/data/com.zz.yyb.ssc/databases/bugly_db_legu-journal
Size 512B
SHA256 bf72fdf1a4a6ee5e251eb3a4837cb394cfbba9d85b0e010209147d274c8469cf
MD5 fc609d642ecbddb04d284daf35ba8afc
SHA1 fc9feace1063bca3ce49efe14cc11cae413f9549
SHA512 5d961c15f342896b39b4fae527fcd162765e0f43eb8af4855c6eedf6ce94cf5aab7f4ed64d366ae6ada6b184085b799f71045a5a2ff9bb3cf3c859880c833404
MD5 SHA1 SHA512

Submit Download

bugly_db_legu-shm

Path /data/data/com.zz.yyb.ssc/databases/bugly_db_legu-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-wal

Path /data/data/com.zz.yyb.ssc/databases/bugly_db_legu-wal
Size 92KB
SHA256 33dccd8acd33aff07490dd3533b39ea56dcbe813b55b05fe9ac737a046ca63b3
MD5 56a8a89b2924901ebd56b5a854f99bc4
SHA1 dbe6615cbd5d078b2862c5475b2040fc66ddea76
SHA512 1df368c007648362ed206e1909d848e7bb23b9b17207292a968c215849f3815bcc2cd017a392f464ae2da49ec36ea65a00a241f8d95c46f5d6c69cdae16cd551
SSDEEP 48:zvzNSP/lopfrQiw6uMg6/YBg72meposSP/zO2CJerKXEMTI58D:z70P9i4m7Pb2JKKXEMTIyD
MD5 SHA1 SHA512 SSDEEP

Submit Download

mix.dex

Path /data/data/com.zz.yyb.ssc/mix.dex
Size 292B
SHA256 4c76a3af64cdd2f8713ffe2733dea50dbe714d0ca41c17d1847ee5b62a7ca615
MD5 63f77f99bd2c2b772a479923bde11974
SHA1 c7632e7d301e4463fafce85f84e9c3d7da3fdbbe
SHA512 3aae4a89d1ed51fdd911cb367eb10afe3c2264e4222085891b18a60d5412f85d10bf5c8f3c6642db70abb9aa42732bac5c42c42ee32d587100f53c21b5beb16c
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads