Overview

overview

8

Static

static

6

7fb3a2b4ce...18.apk

android-9-x86

8

7fb3a2b4ce...18.apk

android-11-x64

8

Analysis

  • max time kernel
    168s
  • max time network
    186s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240514-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
  • submitted
    29/05/2024, 05:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    7fb3a2b4ce7297fb6e63f3fe0cf99e23_JaffaCakes118.apk
  • Size 9.2MB
  • Sample240529-gkljmacd91
  • SHA256 679ae56be7a7f3673198b7b448bb90baf3c43bceabfa268ad1a3b86ec07bc972
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
collectioncredential_accessdiscoveryevasionexecutionimpactpersistence

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 1 IoCs
    evasion
  • Requests cell location 2 TTPs 1 IoCs

    Uses Android APIs to to get current cell location.

    collectiondiscoveryevasion
  • Checks CPU information 2 TTPs 4 IoCs

    Checks CPU information which indicate if the system is an emulator.

    evasiondiscovery
  • Checks memory information 2 TTPs 4 IoCs

    Checks memory information which indicate if the system is an emulator.

    evasiondiscovery
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact
  • Queries account information for other applications stored on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect account information stored on the device.

    collection
  • Queries information about running processes on the device 1 TTPs 4 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

    discovery
  • Checks if the internet connection is available 1 TTPs 4 IoCs
    discovery
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
    discovery
  • Reads information about phone network operator. 1 TTPs
    discovery
  • Schedules tasks to execute at a specified time 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

    executionpersistence
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
    evasion
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 4 IoCs
    impact

Processes

  • com.stkj.android.dianchuan.tl
    1⤵
    • Checks if the Android device is rooted.
    • Requests cell location
    • Checks CPU information
    • Checks memory information
    • Obtains sensitive information copied to the device clipboard
    • Queries account information for other applications stored on the device
    • Queries information about running processes on the device
    • Queries information about the current Wi-Fi connection
    • Queries information about the current nearby Wi-Fi networks
    • Checks if the internet connection is available
    • Schedules tasks to execute at a specified time
    • Listens for changes in the sensor environment (might be used to detect emulation)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4623
  • com.stkj.android.dianchuan.tl:daemon
    1⤵
    • Checks CPU information
    • Checks memory information
    • Makes use of the framework's foreground persistence service
    • Queries information about running processes on the device
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4901
  • com.stkj.android.dianchuan.tl:ex
    1⤵
    • Checks CPU information
    • Checks memory information
    • Queries information about running processes on the device
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5088
  • com.stkj.android.dianchuan.tl:channel
    1⤵
    • Checks CPU information
    • Checks memory information
    • Queries information about running processes on the device
    • Checks if the internet connection is available
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5171

Network

        MITRE ATT&CK Mobile v15

        Initial Access

        Execution

        Scheduled Task/Job

        1
        T1603

        Persistence

        Foreground Persistence

        1
        T1541

        Scheduled Task/Job

        1
        T1603

        Privilege Escalation

        Defense Evasion

        Execution Guardrails

        1
        T1627

        Geofencing

        1
        T1627.001

        Foreground Persistence

        1
        T1541

        Hide Artifacts

        1
        T1628

        User Evasion

        1
        T1628.002

        Virtualization/Sandbox Evasion

        2
        T1633

        System Checks

        2
        T1633.001

        Credential Access

        Clipboard Data

        1
        T1414

        Discovery

        Location Tracking

        1
        T1430

        Process Discovery

        1
        T1424

        System Information Discovery

        3
        T1426

        System Network Configuration Discovery

        2
        T1422

        System Network Connections Discovery

        3
        T1421

        Lateral Movement

        Collection

        Clipboard Data

        1
        T1414

        Location Tracking

        1
        T1430

        Stored Application Data

        1
        T1409

        Command and Control

        Exfiltration

        Impact

        Data Encrypted for Impact

        1
        T1471

        Data Manipulation

        1
        T1641

        Transmitted Data Manipulation

        1
        T1641.001

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        journal.tmp
        • Path /data/user/0/com.stkj.android.dianchuan.tl/cache/journal.tmp
        • Size 31B
        • SHA256 68bb33ddeed9200be85a71f70b377985f9ee68e91578afbde8321463396f1274
        • MD5 SHA1 SHA512
        Submit Download

        MessageStore.db
        • Path /data/user/0/com.stkj.android.dianchuan.tl/databases/MessageStore.db
        • Size 36KB
        • SHA256 90389d243a8b89631bd58e052a534159a1ce1ab5cd88eab4d65798c635b883df
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MessageStore.db-journal
        • Path /data/user/0/com.stkj.android.dianchuan.tl/databases/MessageStore.db-journal
        • Size 12KB
        • SHA256 12c3c60a0e4e592a7f079fdf5c7005c38ecf874b2f8fd0cd19959369fefa31aa
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MessageStore.db-journal
        • Path /data/user/0/com.stkj.android.dianchuan.tl/databases/MessageStore.db-journal
        • Size 512B
        • SHA256 1fa979f30505489a1523b111eb95ff44764b028640a1215206050aa0338071cc
        • MD5 SHA1 SHA512
        Submit Download

        MessageStore.db-journal
        • Path /data/user/0/com.stkj.android.dianchuan.tl/databases/MessageStore.db-journal
        • Size 12KB
        • SHA256 06529196c1aba421e3ef70b77af108fe068eae5d041c782a7bfc0c4e3a2af655
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MessageStore.db-journal
        • Path /data/user/0/com.stkj.android.dianchuan.tl/databases/MessageStore.db-journal
        • Size 20KB
        • SHA256 b4ef8a71919ac4b6ef9a895a991b527f5c3316fd6204eb815366c9614dc71f00
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MessageStore.db-journal
        • Path /data/user/0/com.stkj.android.dianchuan.tl/databases/MessageStore.db-journal
        • Size 8KB
        • SHA256 c80773fdec572e6584ec62cd42adc9dcf3151c084a561927c4e4cfdfa2b0fbb6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MessageStore.db-journal
        • Path /data/user/0/com.stkj.android.dianchuan.tl/databases/MessageStore.db-journal
        • Size 8KB
        • SHA256 8f1c7998c53d50c40850017e6bbadb23ce0b7c7c9da4f284a6b386a25c10259c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MsgLogStore.db
        • Path /data/user/0/com.stkj.android.dianchuan.tl/databases/MsgLogStore.db
        • Size 56KB
        • SHA256 ab8ad15a5e9d0295af41d69aaf6607eeae432841eacf3dd01332caa24e3a28e5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MsgLogStore.db-journal
        • Path /data/user/0/com.stkj.android.dianchuan.tl/databases/MsgLogStore.db-journal
        • Size 36KB
        • SHA256 f2434b69ad5ddbdeb3796b9e34fa428cf6fc31bf987dee42c12816e3632a128b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MsgLogStore.db-journal
        • Path /data/user/0/com.stkj.android.dianchuan.tl/databases/MsgLogStore.db-journal
        • Size 8KB
        • SHA256 c9619d580ecc0e86e4091e98a486e69c61956d0749e8a06b867732ce46ac4616
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MsgLogStore.db-journal
        • Path /data/user/0/com.stkj.android.dianchuan.tl/databases/MsgLogStore.db-journal
        • Size 8KB
        • SHA256 9481c2b47d4a0ff82755bc721384a8385f8905e5909973c95927716a60453dda
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        hs.db
        • Path /data/user/0/com.stkj.android.dianchuan.tl/databases/hs.db
        • Size 20KB
        • SHA256 dd323c884e52180eccffd2195910b85c5e98d80cdec42989c5c8367b67c01935
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        hs.db-journal
        • Path /data/user/0/com.stkj.android.dianchuan.tl/databases/hs.db-journal
        • Size 512B
        • SHA256 b5ff4ff4322a1cf58811fdedd254ef705b225ec4fb50d3166094638f66697819
        • MD5 SHA1 SHA512
        Submit Download

        hs.db-journal
        • Path /data/user/0/com.stkj.android.dianchuan.tl/databases/hs.db-journal
        • Size 8KB
        • SHA256 40d5700b1aa473396335848a0aee6fd0d5b489d2ae9ec48d54c68d4f651fbbc1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        hs.db-journal
        • Path /data/user/0/com.stkj.android.dianchuan.tl/databases/hs.db-journal
        • Size 8KB
        • SHA256 6a765cd9f72fb0b07a7982da32c627a3993995d2292935255002337b6ee36a64
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        i==1.2.0&&V2.2.61_1716961928859_envelope.log
        • Path /data/user/0/com.stkj.android.dianchuan.tl/files/.envelope/i==1.2.0&&V2.2.61_1716961928859_envelope.log
        • Size 2KB
        • SHA256 803d14c1cb23267734d690e8c200207e0a67c6b2355ca7581b1d292bda77d71d
        • MD5 SHA1 SHA512
        Submit Download

        exchangeIdentity.json
        • Path /data/user/0/com.stkj.android.dianchuan.tl/files/.umeng/exchangeIdentity.json
        • Size 162B
        • SHA256 8e06110fce643be5af7a442ffe82e8e7f3ca619c64f39b76584313d5439728ca
        • MD5 SHA1 SHA512
        Submit Download

        latch
        • Path /data/user/0/com.stkj.android.dianchuan.tl/files/_obj_note/latch
        • Size 60B
        • SHA256 25c9130df4cc2659daeb6b9b0567cd17497c7541a37bae1c3c2780399c687581
        • MD5 SHA1 SHA512
        Submit Download

        exid.dat
        • Path /data/user/0/com.stkj.android.dianchuan.tl/files/exid.dat
        • Size 62B
        • SHA256 8531449d8b49d4529774341a5d776d99072ec3a4905310ac198cc1ec62303d54
        • MD5 SHA1 SHA512
        Submit Download

        dW1weF9pbnRlcm5hbF8xNzE2OTYxOTI4Njky

        • Path /data/user/0/com.stkj.android.dianchuan.tl/files/stateless/dW1weF9pbnRlcm5hbA== /dW1weF9pbnRlcm5hbF8xNzE2OTYxOTI4Njky
        • Size 1KB
        • SHA256 ce89f3ceacd41d333b0187a6cf9b1f702a580eda5b0871cac38afc127cdbc7e4
        • MD5 SHA1 SHA512
        Submit Download

        dW1weF9pbnRlcm5hbF8xNzE2OTYxOTYwNDE3

        • Path /data/user/0/com.stkj.android.dianchuan.tl/files/stateless/dW1weF9pbnRlcm5hbA== /dW1weF9pbnRlcm5hbF8xNzE2OTYxOTYwNDE3
        • Size 1KB
        • SHA256 58627e93d91bdf7634059289cf8ef706319a308b8e19ca100e16646b0e051850
        • MD5 SHA1 SHA512
        Submit Download

        umeng_it.cache
        • Path /data/user/0/com.stkj.android.dianchuan.tl/files/umeng_it.cache
        • Size 433B
        • SHA256 8d458f94bc37eeef746b3a7510772b0468153a29b8a9746d4564e507638d8873
        • MD5 SHA1 SHA512
        Submit Download

        ContextData.xml
        • Path /storage/emulated/0/.DataStorage/ContextData.xml
        • Size 65B
        • SHA256 3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793
        • MD5 SHA1 SHA512
        Submit Download

        ContextData.xml
        • Path /storage/emulated/0/.DataStorage/ContextData.xml
        • Size 111B
        • SHA256 f718fc5661e09bbfb529e48b72ec140c1f3c639c429773c9305d6553711656c1
        • MD5 SHA1 SHA512
        Submit Download

        ContextData.xml
        • Path /storage/emulated/0/.DataStorage/ContextData.xml
        • Size 213B
        • SHA256 29ea5e506929eb7670da98d261ea99edef186a5db89ae2b75abe1124434372b8
        • MD5 SHA1 SHA512
        Submit Download

        Alvin2.xml
        • Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
        • Size 111B
        • SHA256 073b6d60e893c52d719cb69402cc707233ee784522fb67e38d6fad86f16cd5f9
        • MD5 SHA1 SHA512
        Submit Download

        Alvin2.xml
        • Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
        • Size 167B
        • SHA256 d022627e0f78aeacdad92f15aaf01c505387820eb8243fef23d5b429f4edab18
        • MD5 SHA1 SHA512
        Submit Download

        Alvin2.xml
        • Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
        • Size 8KB
        • SHA256 9951b8723d9ea8cd47675e25eb49662dd27e39c4434df606356154bd224f7818
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download