Analysis

  • max time kernel
    146s
  • max time network
    183s
  • platform
    android_x86
  • resource
    android-x86-arm-20240514-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
  • submitted
    29-05-2024 01:59

General

  • Target

    7f289811a2a0a59560f2a7b59259236e_JaffaCakes118.apk

  • Size

    8.8MB

  • MD5

    7f289811a2a0a59560f2a7b59259236e

  • SHA1

    0ce446fb5313d085b4f8271ad62676b540c51e89

  • SHA256

    6fd2f17b303c1c0b43836072b66b95eb8f6821251912d84198b1aaec42095159

  • SHA512

    69d7fc3277a41b12deebedecfeaf3662e300d9bbf43df0ba3de591a1e24fa77a8a5f3f3fb7f700b0cd8006149ffbc75916e9a37c0e491801294e43276c4a803f

  • SSDEEP

    196608:gkkAcVT9/IqBNVKRtQv69+vIHaDZlKDj4GAe8OWqzEd67:TkA6akzKvQy4GaVlK3SQJwd67

Malware Config

Signatures

  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Checks if the internet connection is available 1 TTPs 1 IoCs
  • Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.coomix.app.bus
    1⤵
    • Checks CPU information
    • Queries information about running processes on the device
    • Queries information about the current Wi-Fi connection
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4294

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.coomix.app.bus/databases/rep.db

    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

  • /data/data/com.coomix.app.bus/databases/rep.db-journal

    Filesize

    512B

    MD5

    01d96593ba6e9816520e30ea8655a597

    SHA1

    899e614d9e646597614c27270669f5830b97fe7d

    SHA256

    ed29e9325b114c20e38347bd18f943254aa957e86611bc7c05b0be37f0c2bdfd

    SHA512

    6c07264d9f539b61e7794a176f3804bd72346514ec4475c4b3dfeefa173bf6a2eb985077f705db1bc516700c9eaba04adfabb04d0aca3f6468e7ac33b43087f4

  • /data/data/com.coomix.app.bus/databases/rep.db-shm

    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/com.coomix.app.bus/databases/rep.db-wal

    Filesize

    36KB

    MD5

    0a51fd2b7194fa42517e25e7afbcd1a9

    SHA1

    271d8e577c64a8d638c60eea4f9fdaf7026bc494

    SHA256

    2cf1afc21066e72ad0fb7765ed667567cb10bfd4c589c347a69145af982496c2

    SHA512

    d45e4c3d259623f2857bc9a0d9ff7dd5ac03b05eb1a111da2914578ea3cac3d1597ac41b8d8dbab3547c67cd70777eb573faa753f5ce92081459d95e2169e283

  • /data/data/com.coomix.app.bus/files/CMRequire.dat

    Filesize

    1KB

    MD5

    25e57636aee83606d202f04f26c2913b

    SHA1

    1ef0ade456ba38aa31584d0fbce647d0ba74b399

    SHA256

    89c56da41f0046c9e733fed330d2636d623510c217f72c2d025df3343dc66783

    SHA512

    3a8d294b8be98abe4d18116cbf7c16d44a541d1d20dd4dfbbbf3bbd8cb7997abcbaf51790bbc1978135d888c4e89868a9a2575d9cfed65a331969de77ba07326

  • /data/data/com.coomix.app.bus/files/VerDatset.dat

    Filesize

    172B

    MD5

    caaa975d7bf4952bd5dd695ade33f1da

    SHA1

    119373fbb2db036712df72ec9b26c0c2840dfbb1

    SHA256

    d0f94264a6b5c355dbf5c0516202c732bcae471a2401542b2ca43307727a0d02

    SHA512

    db2acdecd236eab67cb67151032f53e51c9c04e754f3c21d74e05cacb1ea5edecbbccbd66ee760624b9cac97b8dd77f568324e8abc2b9c16aa73131db81c8b06

  • /data/data/com.coomix.app.bus/files/cfg/a/ResPack.rs

    Filesize

    684KB

    MD5

    37c7d7a469620c696b8812831a527d62

    SHA1

    2e54375cde7ad35666184f5c7aeb65d5887f746c

    SHA256

    f3f542caf19e546f5cc1d265d5e6e35fa5ff32bb24e9282a60ef21d4c8588d9e

    SHA512

    8726878886379a8174b1ea11bb0c21dc6ef9bfe0ff2eafdfc4260a8c8666be82e3fd95309915aa0b40ad1a34b2f8f62f7c33860247562e84cac7e156dbf995bb

  • /data/data/com.coomix.app.bus/files/cfg/a/mapstyle.sty

    Filesize

    131KB

    MD5

    db362e36518c847ae80caca571e3c8c8

    SHA1

    610911bf7869016fb7c9a2026b3024eacf0b4593

    SHA256

    95549560fbb3d96dc791c2d16fdd5f098784eee75ac293556fe9688fb2f0ec9d

    SHA512

    41fa2b9b61c131b0926d0f47f86eea56859ca0d4e44ac23647a73ff4b98214183cb0a523336dcae4e2ddb4be932e994e1950365fd3590eb2f7c3b96bd4bb8a41

  • /data/data/com.coomix.app.bus/files/cfg/a/satellitestyle.sty

    Filesize

    119KB

    MD5

    6034f2a3f8bc9639ae820bd977bde4a0

    SHA1

    599f7994853b61bc5ee09a75b6383a13a5a685f7

    SHA256

    753705cb1ab2a676a9ef48881cfb036f212c4a7e7a5d34d9f8708075078e5818

    SHA512

    acaf0d146e4e3739eeaa40d46f7002776ebc4074bb89d12a5c25b12f53190a0e367ef0bd3225835e7e4b39a70b06e9f7328b1e342a9c5829af7610c14d41898f

  • /data/data/com.coomix.app.bus/files/cfg/a/trafficstyle.sty

    Filesize

    3KB

    MD5

    1e4b535871c4feb2010b614713def5c7

    SHA1

    4c5dc67838d12b795b6882c6dbbcc6767e42184f

    SHA256

    efa3ec85127a21a8c8a74640acc5fe1d992952964d4f257682f832f63c2ad3fc

    SHA512

    0c5443dbfdafab2e6cb7740587f48ca9a2c971b93afafcebccd17691edaa7c7fb75dfd1b6c939dd591a5aa65977f55e64b6c3690ab0a660432269fc43bf3133c

  • /data/data/com.coomix.app.bus/files/cfg/h/DVDirectory.cfg

    Filesize

    69KB

    MD5

    4baa4ede52eacda76bd26d5838cc2de3

    SHA1

    38b65c75440581f43ddb32ef17480e5c87f0153f

    SHA256

    c0f2b002adafe50265789ca04bc8dab8c176e6a7eaae164fdb98ebcb9ff98eb2

    SHA512

    58fef595b1db5f8fa7dbfcaa3b6b676bdbec8931ffa833858e2452c2f35a1b192746d2315acd27551594377ac121ec80574deee632d4bfa94b6315b8a0d33feb

  • /data/data/com.coomix.app.bus/files/cfg/h/DVHotcity.cfg

    Filesize

    1KB

    MD5

    6c495e47c754a9b25437ff9a88c7a51e

    SHA1

    8c4e36fda1e1f80918a3a8f1812c4e68b2326a4f

    SHA256

    e68e66e643d690d203a5153156e9cd6383ae1b3c481afa4b19e903d4a82289a3

    SHA512

    f3c030504cf50fdbd284acbdd893c948fb7ddb7544ce01d11c94fb00fb554f878949b1867fd5ab6c25e76c4be717aa819a917d4f25c8eba904df1a2819becf1c

  • /data/data/com.coomix.app.bus/files/cfg/l/DVDirectory.cfg

    Filesize

    69KB

    MD5

    65685a117c72fe8fbf5a92b07073c99e

    SHA1

    b115b527f74e4c291edcaab19b316a446aca8f5b

    SHA256

    19bcea79613a5c3bb71dfe6b311241fcbf3534b538f0b147c7e849b58b24b2b8

    SHA512

    e5821a5212f0790db33ec7274f018b08f499557ff7f2f118021a7905573e8dd66e716fb02144919d96eeec7da9db921c756a88cf0a050f65a9f8de3894dcc253

  • /data/data/com.coomix.app.bus/files/cfg/l/DVHotcity.cfg

    Filesize

    1KB

    MD5

    1c6abcbbd253448057930ad1cc59ac75

    SHA1

    a5845d1c4bc87b8b4785b456d76edcb8309eda4e

    SHA256

    a46b498ba6586aaa2f246bb34e47f4290ac60273cb86ff662475b0def7172136

    SHA512

    71aba5b2a1020d1925b3844c861cbe595de3b21d665eedb13f1ef0d80477fc091663e0625b09c5f49d4f9d0770970dd0d188b84635e9c75c1bdba9f2a7171631

  • /data/data/com.coomix.app.bus/files/cfg/l/DVVersion.cfg

    Filesize

    127B

    MD5

    e962c995c0664b5cd8d067db1561cad7

    SHA1

    263524863998525598f663ba7134ecec2ab592b2

    SHA256

    b83792f572112503fa2c542595047271d632318a775061ae3a964948738639f8

    SHA512

    7337967c5759f8a078eed90adc45054e5642b1e319800549c80395dcdc1956baa8d9741348e1dc0be931f24cdb899b95d4beec35e52995703dad8d0feb04ab26

  • /data/data/com.coomix.app.bus/files/imei.dat

    Filesize

    15B

    MD5

    748d9beeaa1899252a7365b780b95fb0

    SHA1

    2158cbe9044f2b138df0094615afe6616e526c9d

    SHA256

    59290d2d5a77605f8140feb82e44e8438115fb2f93dc56ed4c225b88c21baaa8

    SHA512

    cdeb0c4cebf1cc96ebda6940763a940df76120ee991bc7f003480caf055a970f16e4a19ef2ba2c56fa056d539b981e16542ec7239a7b91dd3828585bc2d1e440

  • /data/data/com.coomix.app.bus/files/imei.dat

    Filesize

    11B

    MD5

    ad42a5277af39d26a65511a7b022acad

    SHA1

    f013db7c245ab2cc384d2b71ef4afceb54bf9af0

    SHA256

    3e7d526ed10eb2470b2ac1ac4666e14251307c88adc614c5d703c3cd11902048

    SHA512

    765823d9e596dec43ecd1d635760e029323b840c9a1b710a279686c61a8242acb6d2b84cab858a70f739a7b90cd0ff38ab83d770edde039641200f797a86a09d

  • /data/data/com.coomix.app.bus/files/mobclick_agent_cached_com.coomix.app.bus

    Filesize

    122B

    MD5

    00e73af3618bbf620df499a70d1e1a1d

    SHA1

    0e6adff88887ed26e969b4f62f2b9a72ae0e5715

    SHA256

    71f66e3a0d1583e89b9e38c0c7b3f7c232813682c00859ae6bf5551d9a786984

    SHA512

    ef0c7b019cad6f2d52ed6d8e1f0cfbbb2c1a64d72fe2e8a8eb9499a30158557c631eda7d49c94b34bef7299e468024bc75eead205d263208b909ac76ba33b732

  • /data/data/com.coomix.app.bus/files/ver.dat

    Filesize

    6B

    MD5

    5f7335045aed321b93c6ebb7a4d7417a

    SHA1

    35fbd4bee538b385d7abfc56df4e701615f73784

    SHA256

    f9d1a10b6885f6c28d841e07df992a2f620dd69e65d0a318523c232982158ed9

    SHA512

    ae94d011816076c988605e82e75c18ca6cb1708a20f079ac6dadc4c874c16b653a9ade7ec1015deec39bf98b840be69eb6e0d3705321e0bc59c8460c4de6ec4f

  • /storage/emulated/0/baidu/.cuid

    Filesize

    89B

    MD5

    b34d4d3144d87cf5d15938d140769ffc

    SHA1

    471bced85b411c3eae5be26ff03c113b76f9011f

    SHA256

    1f0fa6e68d66e6d412598ac60907374d17e1362ef0d9c6aa4c6f302c0c60eb3a

    SHA512

    c1066eafac500cd0bbc43e2d23cc21fe003b80f700720dd1f0bb860d92bf7841df11ffaa48bb7c07a9aa83650fac8f0479fce01307913d9ccb6e5eb4615ec6fc