12a1949dfe3e34358a15cc8384bc0dd87be8c1d145645f69a2f52689f01bf6f8

Analysis

max time kernel
72s
max time network
149s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
31/05/2024, 08:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

86676516144a25f6e6fa5441f3c9e666_JaffaCakes118.apk
Size

27.8MB
MD5

86676516144a25f6e6fa5441f3c9e666
SHA1

4c18c02872c6a5ce8b7a484efbf7cd6c169cfe0d
SHA256

12a1949dfe3e34358a15cc8384bc0dd87be8c1d145645f69a2f52689f01bf6f8
SHA512

7c33d2d92f8e8c02e95000d320e3718c291adae222ea26caee59c289f00ea8c1bdb1fe95c70f075dbaa01551e48d6062d1ccfcc2491f131dc117e576fb8fa847
SSDEEP

786432:7d+CaDVIkEppqZMqrZ3Br6NsxXFQb2Ksk4FgD:7d+CaREetW6hFEfTFD

Score

8^/10

banker collection discovery evasion impact persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.baidu.yuedu

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.baidu.yuedu

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.baidu.yuedu

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.baidu.yuedu
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.baidu.yuedu:pushservice

Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.baidu.yuedu:pushservice
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.baidu.yuedu

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.baidu.yuedu:pushservice

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.baidu.yuedu

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.baidu.yuedu
Framework service call	android.app.IActivityManager.registerReceiver	com.baidu.yuedu:pushservice

Checks if the internet connection is available 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.baidu.yuedu
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.baidu.yuedu:pushservice

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.baidu.yuedu
Framework API call	javax.crypto.Cipher.doFinal	com.baidu.yuedu:pushservice

com.baidu.yuedu
1⤵
- Requests cell location
- Checks CPU information
- Checks memory information
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4293
- ls -ld /data/user/0/com.baidu.yuedu
  2⤵
  PID:4546
- chmod 701 /data/user/0/com.baidu.yuedu
  2⤵
  PID:4565

com.baidu.yuedu:pushservice
1⤵
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries information about the current nearby Wi-Fi networks
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4411

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Location Tracking

T1430

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.baidu.yuedu/.BD_SAPI_CACHE/918689903d7309f1c83e68165e7c1eab

Filesize
45B

MD5
e3ee5234264cf26c15c42ac7c5cd5a52

SHA1
938825f170d9137bce0174c6b0b898a548075f85

SHA256
ff6d890406a31f7ee610a8a1b9b28a297ea4cdd5af21e292299c24e7f2f88172

SHA512
7d37de7ad62aa3fc6d593f76eae1fceb9c8fdbbde1831d9d9275f803fc9a378c28dc73805d91894cbbe016cc3d66c2bdec61d2861024bf24a0ca75cb09a2c0ea

Download Submit
/data/data/com.baidu.yuedu/databases/BaiduGid.db-journal

Filesize
512B

MD5
22f6af8591c5ae9d0c8a390e59ac1f73

SHA1
b9511d9258f6d9c7be50064bfae9cb6334ef75f8

SHA256
54cafc2fd77854a1a4416c8b2751d18c81ab6b824182533c7a4a0d5d2cd12799

SHA512
583217e124341c115809187eef06d93d39edadb0732200cbf413e1747d7b4406e67090d46acbb470110a65ac199a86b729c3d46834974bac9c5e5b6c17487bf8

Download Submit
/data/data/com.baidu.yuedu/databases/customerservice.db

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.baidu.yuedu/databases/customerservice.db-journal

Filesize
512B

MD5
52ee9718c9c0a9e93bf398ed32c66298

SHA1
35ff9dff62a21488a5d4dc6cf11dee58d08d76e9

SHA256
0e91d2aba09e65bd768c4141fa2c89f65184618b08e50bd18b75d03f69aafdc2

SHA512
1e9040841c7a54204469c5239a85c71274dc6aeb70b51a3881a8d67ba48bfa74e2618ba4eec1973a28c34b574c89f5aa16cb6f1114984022a6dc08b1eae8d577

Download Submit
/data/data/com.baidu.yuedu/databases/customerservice.db-shm

Filesize
28KB

MD5
cf845a781c107ec1346e849c9dd1b7e8

SHA1
b44ccc7f7d519352422e59ee8b0bdbac881768a7

SHA256
18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7

SHA512
4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612

Download Submit
/data/data/com.baidu.yuedu/databases/customerservice.db-wal

Filesize
40KB

MD5
e436ef5585665d0d9e01364f7975e994

SHA1
4f7f5ccd52158f605191b151c7a83603a4540532

SHA256
775a99906679131968d7c58824ddd669319da8c9bb787cb09b67b9ec37748833

SHA512
c40cbaa2e238cdb6b6b0aa8ca55b4449916ae6dfae82c746d06289a442f27b3d80c79d02d260d3adae9d660989c92be9b60da63adab427c5fee5d68aa0c6d54c

Download Submit
/data/data/com.baidu.yuedu/databases/download.db-journal

Filesize
512B

MD5
4731cb0cc9cf4dfd13b5e2f64257badd

SHA1
0a6bcff28e2dede9822eb69b12c52feb10cb30ff

SHA256
e13b948c82e3b1d8f4398488e8cb938a0ac1dbaae1619c35e5a3724eeaa83c2d

SHA512
76d647a017216f9b376f89a4af221a0bed0923b5d75f3e8028e24e708c959c71ae3d64c922833cfd9d76244feaf6881a6346b236e905d3ef4333a287dcd2f78e

Download Submit
/data/data/com.baidu.yuedu/databases/download.db-wal

Filesize
40KB

MD5
2d033954eab3215dcb6d7c47c27c56ed

SHA1
e4c563af6e1e2b23bb52b634fd466b0446ce52be

SHA256
1ff3e219467fa2a845a40a20cbce3d168cb159c22910641c01ddd518a36e13b8

SHA512
3125f6c399d9a9f4813f1f06981a654dab36e6d5281d2e3ecb8b57eae955f61bfe8002485e88b3a99614a40c57234296e883b12cdac4080a166e7def5afc415c

Download Submit
/data/data/com.baidu.yuedu/databases/pushsdk.db-wal

Filesize
148KB

MD5
cba3c24678f0f302cf69a49dba12a933

SHA1
0e84fb7ef2d816e6d6b9db9bfa50e74ab34d5d26

SHA256
bf697d2149982d2353531ea38aedf1ea6e516451f0b0a8aedce564b319283eab

SHA512
6c92c4af797ce2f6b343de9d94fe6cf21328539eb0710121ebc221c16bd86f7980f73a05e88cc020b2cc2ccb58dfaadbf1594d65eb3168c66ee74331730b6618

Download Submit
/data/data/com.baidu.yuedu/databases/reader.db-journal

Filesize
512B

MD5
2f7876903c822b14384f9f9374d85eb9

SHA1
a580f13bfbab04cbdbeae9863de735f6eeebce05

SHA256
2b1bd763765ac1a37ba718f27b31ef8da9000b4adea572fa9f5264794105e383

SHA512
5090346f565ca6c375c061a70fde58fcb19bced0f953c2134eda563e91fc86907f64f961bc8ebdb1c3d15179c9255a577612ba317c124c3464696135f88748a5

Download Submit
/data/data/com.baidu.yuedu/databases/reader.db-wal

Filesize
120KB

MD5
ed584dae366896a3b65c1d21c07db9c2

SHA1
0ce0831bc13f003783ce5fbd09fbc2d128531d8f

SHA256
fc21080df3dd5a03ece1bd2e7ff27209b053ce28c9fd6cff2e15c5616bc6603d

SHA512
31bec9fbb020361df6f883a842daa715f8ca52538896784cddd2d9c7950e99643448e619ec3a18c059f33be79a9087d2a3d169f6e022132946e959bfd6d48a95

Download Submit
/data/data/com.baidu.yuedu/files/befe5b2c729481d3a0dea6748aaa7d98.json

Filesize
90B

MD5
a907d1911656f11575bd8e02021594e7

SHA1
d090a195716962eb3fd092eca2120e84d5b95cfa

SHA256
373ac955f6d7f17046acd8e342b41b9093570dd127184380c2cf0bf19dc17ebd

SHA512
8536f41f25cf6370a967f63d9d4cad47fae7982e9dacc945af6632c3d564601f83a02855062c7b179727fba75539706aa0cc96b127c59db86b9c7e6133edc665

Download Submit
/data/data/com.baidu.yuedu/files/is_newer.txt

Filesize
512B

MD5
1d88f03129b868bd4fcdc3981efe1e45

SHA1
192105d72eacd6c68bfd8d616e86ea5d7b8db538

SHA256
68c9ba9493024af25b1164ae5280d4edadc2f42449cbbc70753074e69a67d66d

SHA512
495155c6583991d60dffd3efe72ef98b2ec076849499f5ccf8b481326baf258b72e4d39985ec7490814a866d976701c2e8fd9c26997f2ea790a7e7a6d9d9c383

Download Submit
/data/data/com.baidu.yuedu/files/libcuid.so

Filesize
129B

MD5
0198d8fcccbc9053db20591886f43c2c

SHA1
6c46de414d4a0a6553a5f97fdc78771fd6dacc79

SHA256
7206bce1b1a8be9f85a85f389491d17f5e8be61d01bef1454dfd3aef1c727222

SHA512
babb53275f946019cee0b01b06b583611e4333461c059e9e83958202b07506ba8b3a6fac80fc2ea7f168def32c3f3641313b4e7fab64d38d4d66f50191d99e26

Download Submit
/data/data/com.baidu.yuedu/files/wenkunew/_nlog_6051_wenkunew.ebbc490e389d5bf8eadc08b8fb861068.dat

Filesize
277B

MD5
ba8b1cf4b1710025b888e10d8d14548d

SHA1
1941834070e5bf91295359e2672e2cc7235b3605

SHA256
b5ff63e87216000c5493e3d61324af8bd86c46c601d90ca72d953b1bffc853b7

SHA512
4b76946060fe9cdd58a20981590977339f78c86a7b7be24c2d730c6f5abaa98249f2990a07b0de083727634657dd5271d8d55ffcc02c15d291888de2d3333bd9

Download Submit
/data/data/com.baidu.yuedu/files/wenkunew/_nlog_6051_wenkunew.ebbc490e389d5bf8eadc08b8fb861068.dat

Filesize
444B

MD5
829cd89538a4ddb0f6d42da491f67598

SHA1
1c791aa783c5ccfc6f858648fc15c27eb1d879d6

SHA256
8905ca16c74cfacc7105a2da977b417bd016bfdb09a7241211d04c9adc5b7ded

SHA512
7f658fe129e0825a66a9aeef7b95e890caee43de522fb39c37ad247435a7388b9f410159f54e401699ba30006e3645c8d35ccc7c549a6e4284bb1b2bae8debed

Download Submit
/data/data/com.baidu.yuedu/files/wenkunew/_nlog_6051_wenkunew.ebbc490e389d5bf8eadc08b8fb861068.dat

Filesize
78B

MD5
c6741044cd3b0ee5a65942e531cbcda0

SHA1
7c15bf94e76d8ac37949a06e312c288433aab73f

SHA256
c1305acc849145264715a1e2c871b15068cc46ed0338c8e9da954312700f0bf5

SHA512
313ad3289643efd5fe232c8a10186c6ca500d23d90c594cbbd8ff8e99a1d07dc509861e87591dbe971da270da67da931f6f33f379efa5ccd0b95cafa1cfc866f

Download Submit
/storage/emulated/0/.BD_SAPI_CACHE/.libbaiducuid.so

Filesize
128B

MD5
1f4642859db5250c0e39ee3b458ae377

SHA1
169ddac18344be821ceb803f1a525c8032ee404f

SHA256
962ae93c73d99860513afacb5fcc0a3c226b53250e0dd291c8511ed8af348094

SHA512
5198b9efc509d1e273d5637cd0739a65c644be63cdded45424cdacb9a1730d70d9ebd53d3651ec4e5bff22072ce8595dadabadb77755ad3958f8ee2496eb5a04

Download Submit
/storage/emulated/0/.BD_SAPI_CACHE/.libbaiducuid.so

Filesize
32KB

MD5
e7b744196da1f40dae20b6d275c52798

SHA1
3c481a32fc8241deedf69f9518c49f11744d7e1f

SHA256
bd07e1bc9657b87d6a45b5aa7a83b33ea075f5f571d3b5fe3e20f9213fac67aa

SHA512
790c0e1f1aa5136638145e91a968556338f160d8950a17782aa703865390ca82a5184300c22197ecc2b288ed53ebdb477fe54666ae662b803a533a2c1c41cb5b

Download Submit
/storage/emulated/0/backups/.SystemConfig/.cuid2

Filesize
129B

MD5
dc114421513ed521db8949bfeff89e87

SHA1
2a0ffb1b5e7e533a373aa2555ae447068c7ce274

SHA256
bfd77332547ad4a3fd54abe7f8ace854643cdb2c9ea9e1f8bca550577319c559

SHA512
1303d9b3084615242b54758f73c1358f649a1050d55777a4e4ba0257007529d2debc17492ce97aabeb3374050e46260b20b747b95b598bd9ed89a345d34791b6

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads