35449212e9cf8445b19852c1daf9c38e669d9103891bb96e37bb3130c3d0317d

Analysis

max time kernel
8s
max time network
132s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
29-05-2024 01:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f0ac935f09bcc1039702d4903af59f5_JaffaCakes118.apk
Size

6.1MB
MD5

7f0ac935f09bcc1039702d4903af59f5
SHA1

40bc8e4bb2bffc33f4e835759bcb30a20ca3d998
SHA256

35449212e9cf8445b19852c1daf9c38e669d9103891bb96e37bb3130c3d0317d
SHA512

447d0785efda673b574ea15def2439ab4648b93ec05023df26b61f90ce932ba6b41c7fa160cc5b3b01260d844af9539020a00edc5e9c801ba28ce4493ab5e433
SSDEEP

196608:UqpxI4/ndkuOp0NJTY66qhiU2YLueqCXlSSrp:tIUnGudTY6Fh12YS/Olp

Score

7^/10

discovery impact persistence

Malware Config

Signatures

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	cn.willtour.guide

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	cn.willtour.guide

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	cn.willtour.guide

cn.willtour.guide
1⤵
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
PID:4295

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1424

Lateral Movement

Collection

Command and Control

Exfiltration

Impact