27136aabef5d05d29a2b7d7dd390f1a2e459b1fa1f3612f4e4cdac0821e6ddc3

Analysis

max time kernel
17s
max time network
155s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
30-05-2024 04:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

830e84fbba8e3b4d1f86fe837b9bd31a_JaffaCakes118.apk
Size

4.7MB
MD5

830e84fbba8e3b4d1f86fe837b9bd31a
SHA1

8ffc6f739ce450dec5b1b11faa36df50de59a35b
SHA256

27136aabef5d05d29a2b7d7dd390f1a2e459b1fa1f3612f4e4cdac0821e6ddc3
SHA512

022e335c24010f40e36a8545f29078eb159fc8ce45e9e1a716dc39cc996512fc49f182d1591ea9b8e7501af582f662dc67a45f3b5d4008caa6beeb36401958cd
SSDEEP

98304:gjEVxDmWY6vSnxwAtKIragS2x+/fmDUOFUb+ML9busiUB3uo1m4WXOU:QQDmf66xbFxQm5U99fVB3/WN

Score

8^/10

discovery evasion impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	cn.openice.yxlzcms
/sbin/su	/system/bin/sh -c type su

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	cn.openice.yxlzcms

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	cn.openice.yxlzcms

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	cn.openice.yxlzcms

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	cn.openice.yxlzcms

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	cn.openice.yxlzcms

cn.openice.yxlzcms
1⤵
- Checks if the Android device is rooted.
- Checks memory information
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4264
- /system/bin/sh -c getprop ro.board.platform
  2⤵
  PID:4346
- getprop ro.board.platform
  2⤵
  PID:4346
- /system/bin/sh -c type su
  2⤵
  - Checks if the Android device is rooted.
  PID:4413
- logcat -d -v threadtime
  2⤵
  PID:4523
- logcat -d -v threadtime
  2⤵
  PID:4541
- /system/bin/sh -c getprop ro.miui.ui.version.name
  2⤵
  PID:4565
- getprop ro.miui.ui.version.name
  2⤵
  PID:4565
- /system/bin/sh -c getprop ro.build.version.emui
  2⤵
  PID:4591
- getprop ro.build.version.emui
  2⤵
  PID:4591
- /system/bin/sh -c getprop ro.lenovo.series
  2⤵
  PID:4616
- getprop ro.lenovo.series
  2⤵
  PID:4616
- /system/bin/sh -c getprop ro.build.nubia.rom.name
  2⤵
  PID:4642
- getprop ro.build.nubia.rom.name
  2⤵
  PID:4642
- /system/bin/sh -c getprop ro.meizu.product.model
  2⤵
  PID:4666
- getprop ro.meizu.product.model
  2⤵
  PID:4666
- /system/bin/sh -c getprop ro.build.version.opporom
  2⤵
  PID:4693
- getprop ro.build.version.opporom
  2⤵
  PID:4693
- /system/bin/sh -c getprop ro.vivo.os.build.display.id
  2⤵
  PID:4718
- getprop ro.vivo.os.build.display.id
  2⤵
  PID:4718
- /system/bin/sh -c getprop ro.aa.romver
  2⤵
  PID:4744
- getprop ro.aa.romver
  2⤵
  PID:4744
- /system/bin/sh -c getprop ro.lewa.version
  2⤵
  PID:4769
- getprop ro.lewa.version
  2⤵
  PID:4769
- /system/bin/sh -c getprop ro.gn.gnromvernumber
  2⤵
  PID:4795
- getprop ro.gn.gnromvernumber
  2⤵
  PID:4795
- /system/bin/sh -c getprop ro.build.tyd.kbstyle_version
  2⤵
  PID:4834
- getprop ro.build.tyd.kbstyle_version
  2⤵
  PID:4834
- /system/bin/sh -c getprop ro.build.fingerprint
  2⤵
  PID:4862
- getprop ro.build.fingerprint
  2⤵
  PID:4862
- /system/bin/sh -c getprop ro.build.rom.id
  2⤵
  PID:4889
- getprop ro.build.rom.id
  2⤵
  PID:4889

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/cn.openice.yxlzcms/databases/bugly_db_legu

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/cn.openice.yxlzcms/databases/bugly_db_legu-journal

Filesize
512B

MD5
228ac338a84ebcbc0faa746943e80160

SHA1
205d907827223e7d5222dcb5b8f2a6ab2ec6f344

SHA256
9ea0e34ab9f7f3873e93852614658c22decd266f12f15825732c134840e8854c

SHA512
c57329b905e517bcceae406bfcc9a72aff357825f2c297929d181c5fd71bb429d891f8652b39b042ec4c7705dd60f3a71c4780fdb7a051fe58da0108ac71dcd6

Download Submit
/data/data/cn.openice.yxlzcms/databases/bugly_db_legu-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/cn.openice.yxlzcms/databases/bugly_db_legu-wal

Filesize
237KB

MD5
2b685584a9484e218d2b25405c8205cd

SHA1
996ca7727c31bd4880012f2f7e2972ac52d9c5be

SHA256
96692c790e9d4093a0734706c64b0bf2e15111a6d80291bd2fcb35537b135a71

SHA512
c9f5511a00cfd0eb9682442d294f614d359632d442057b8f3cfe416a600fc2406dad60f366d02f022ad6f13fba3c4310c839b4cc88856253328c8280d78af05d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads