Analysis

  • max time kernel
    179s
  • max time network
    191s
  • platform
    android_x64
  • resource
    android-x64-20240514-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system
  • submitted
    01/06/2024, 02:43

General

  • Target
    892965862ecf6dfba48e1c015ea063ed_JaffaCakes118.apk
  • Size 7.6MB
  • Sample240601-c7rxpsfh45
  • SHA256 157d3f1be4493f95efdd1c4ac73d02a808e795f081df3a0aaac355ed4f51b187
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Signatures

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Requests cell location 2 TTPs 2 IoCs

    Uses Android APIs to to get current cell location.

  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

  • Checks memory information 2 TTPs 1 IoCs

    Checks memory information which indicate if the system is an emulator.

  • Loads dropped Dex/Jar 1 TTPs 9 IoCs

    Runs executable file dropped to the device during analysis.

  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

  • Queries information about running processes on the device 1 TTPs 4 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 4 IoCs
  • Checks if the internet connection is available 1 TTPs 4 IoCs
  • Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 2 IoCs
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
  • Reads information about phone network operator. 1 TTPs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 4 IoCs

Processes

  • com.mianfeizs.book
    1⤵
    • Requests cell location
    • Checks CPU information
    • Checks memory information
    • Loads dropped Dex/Jar
    • Obtains sensitive information copied to the device clipboard
    • Queries information about running processes on the device
    • Queries information about the current Wi-Fi connection
    • Queries information about the current nearby Wi-Fi networks
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5181
  • com.mianfeizs.book:pushcore
    1⤵
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5402
  • com.mianfeizs.book:pushservice
    1⤵
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5441
  • com.mianfeizs.book:iwanvi_read_process
    1⤵
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5611

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ua.db

        • Path /data/data/com.mianfeizs.book/databases/.ua/ua.db
        • Size 32KB
        • SHA256 6de747824e63837bdf54c2dca4285be97e12873c63442fc9354ec3354a2f5376
        • MD5 SHA1 SHA512 SSDEEP

        ua.db

        • Path /data/data/com.mianfeizs.book/databases/.ua/ua.db
        • Size 28KB
        • SHA256 2d87b54ea92471ed6f93b2c604f5af4c2870361fd1d9a5ef03cec3b8198f7d8e
        • MD5 SHA1 SHA512 SSDEEP

        ua.db

        • Path /data/data/com.mianfeizs.book/databases/.ua/ua.db
        • Size 32KB
        • SHA256 f017754818540d598be648e26ca4591a20576181f3e2acba6b7d4cda14f7c557
        • MD5 SHA1 SHA512 SSDEEP

        ua.db

        • Path /data/data/com.mianfeizs.book/databases/.ua/ua.db
        • Size 16KB
        • SHA256 af136b6063d2ffa2a17d1be69db82da0ad3d547d49b4f7ef2d4ec744a0e5596a
        • MD5 SHA1 SHA512 SSDEEP

        ua.db

        • Path /data/data/com.mianfeizs.book/databases/.ua/ua.db
        • Size 16KB
        • SHA256 2f2a5adb706a286e70724ff57d3f811f0037d224f7727628238add96f2d7ec3b
        • MD5 SHA1 SHA512 SSDEEP

        ua.db

        • Path /data/data/com.mianfeizs.book/databases/.ua/ua.db
        • Size 16KB
        • SHA256 64670a57c882fadcc1952fb95f82c328c87a202871b8c0fd393eac3bd1229be5
        • MD5 SHA1 SHA512 SSDEEP

        ua.db-journal

        • Path /data/data/com.mianfeizs.book/databases/.ua/ua.db-journal
        • Size 512B
        • SHA256 5e7878df205e9fbfd786cf37ccb0bd4c583891981b7a9c7bdcd3fe6911fbf989
        • MD5 SHA1 SHA512

        ua.db-journal

        • Path /data/data/com.mianfeizs.book/databases/.ua/ua.db-journal
        • Size 8KB
        • SHA256 298d04ad860819a8de3b71476b9af627de20233b5e8ff813c8447ddbc2842bbc
        • MD5 SHA1 SHA512 SSDEEP

        ua.db-journal

        • Path /data/data/com.mianfeizs.book/databases/.ua/ua.db-journal
        • Size 8KB
        • SHA256 1784fb663ee2e0446dcc0d22fc08c2d3306f67dc519bc529711563d364465e34
        • MD5 SHA1 SHA512 SSDEEP

        ua.db-journal

        • Path /data/data/com.mianfeizs.book/databases/.ua/ua.db-journal
        • Size 16KB
        • SHA256 6dce7ca27fa90b5e6c05a734ad68200fe767c7159fc89216b1fe864b7a7900a1
        • MD5 SHA1 SHA512 SSDEEP

        ua.db-journal

        • Path /data/data/com.mianfeizs.book/databases/.ua/ua.db-journal
        • Size 12KB
        • SHA256 2c3695e3427a0d4a6b30a439c2167f1da783d0ec6f76723cbf7e540061428880
        • MD5 SHA1 SHA512 SSDEEP

        ua.db-journal

        • Path /data/data/com.mianfeizs.book/databases/.ua/ua.db-journal
        • Size 12KB
        • SHA256 f63d5c7d6052d1ce5981002434c790e0432b0db2ebe04105bcdaea1dbcd1f40c
        • MD5 SHA1 SHA512 SSDEEP

        cc.db

        • Path /data/data/com.mianfeizs.book/databases/cc/cc.db
        • Size 36KB
        • SHA256 38f8548795ca7470b449dd1de9598c07a247ba59883c0764c9c96ff0b7d31d7f
        • MD5 SHA1 SHA512 SSDEEP

        cc.db

        • Path /data/data/com.mianfeizs.book/databases/cc/cc.db
        • Size 36KB
        • SHA256 abda5dd4cc2e7dbb951637c4b49d6990f9f34411fab4dee1a387dbcc8e7eed40
        • MD5 SHA1 SHA512 SSDEEP

        cc.db-journal

        • Path /data/data/com.mianfeizs.book/databases/cc/cc.db-journal
        • Size 512B
        • SHA256 9f96a3752f3e653ebe065ed21368489477220378cb48004970ab1a41bd1f292d
        • MD5 SHA1 SHA512

        cc.db-journal

        • Path /data/data/com.mianfeizs.book/databases/cc/cc.db-journal
        • Size 8KB
        • SHA256 b12312f9b66c03f2612652e7b6f0a6146985c109acf16fdfed0476b44f826b5a
        • MD5 SHA1 SHA512 SSDEEP

        cc.db-journal

        • Path /data/data/com.mianfeizs.book/databases/cc/cc.db-journal
        • Size 8KB
        • SHA256 62d53b8250c497686179f23ee43fb1847e7054486fb8ba86ee51fd980050c278
        • MD5 SHA1 SHA512 SSDEEP

        cc.db-journal

        • Path /data/data/com.mianfeizs.book/databases/cc/cc.db-journal
        • Size 8KB
        • SHA256 c2c507c777c57ea13ababd6c5c4ca8712e4c6456eefe30669d153e3107ef2d3f
        • MD5 SHA1 SHA512 SSDEEP

        cc.db-journal

        • Path /data/data/com.mianfeizs.book/databases/cc/cc.db-journal
        • Size 8KB
        • SHA256 fa0e68659cbab88a64f8a72958f8b470e0120bd905278027461125689e5736d2
        • MD5 SHA1 SHA512 SSDEEP

        cc.db-journal

        • Path /data/data/com.mianfeizs.book/databases/cc/cc.db-journal
        • Size 12KB
        • SHA256 21aba369710e8b3bc4f2be2c2d9677f20c9c242e10088659ec814b0f758e3764
        • MD5 SHA1 SHA512 SSDEEP

        config.db

        • Path /data/data/com.mianfeizs.book/databases/config.db
        • Size 4KB
        • SHA256 4f90d1662691100e90a6fcfd4e917322745e4be5533730bbbd3b16e8e4b9ff8a
        • MD5 SHA1 SHA512

        config.db

        • Path /data/data/com.mianfeizs.book/databases/config.db
        • Size 48KB
        • SHA256 64ccbe6e16d2b24d9fca83d20f925b40e69ddfe3e82cfc285571d2fe63305236
        • MD5 SHA1 SHA512 SSDEEP

        config.db-journal

        • Path /data/data/com.mianfeizs.book/databases/config.db-journal
        • Size 4KB
        • SHA256 a2b737b51429583663efa5201b9af4e5b2b8295ca05268b06d6646aedb185b76
        • MD5 SHA1 SHA512 SSDEEP

        config.db-journal

        • Path /data/data/com.mianfeizs.book/databases/config.db-journal
        • Size 512B
        • SHA256 053b9fce3c2c1f3701e1d2cf2106c36856359be777fdecd24428c7d1e2a8dd0d
        • MD5 SHA1 SHA512

        config.db-journal

        • Path /data/data/com.mianfeizs.book/databases/config.db-journal
        • Size 8KB
        • SHA256 e73aab704003610df2ff3f1bd51a45dd637bb7feac65f205b92938a69dc16b33
        • MD5 SHA1 SHA512 SSDEEP

        config.db-journal

        • Path /data/data/com.mianfeizs.book/databases/config.db-journal
        • Size 8KB
        • SHA256 52949e1c150b19394c2f53c042fefce6a9334e316b2c54748f89184073955dfe
        • MD5 SHA1 SHA512 SSDEEP

        freebook_comm.db

        • Path /data/data/com.mianfeizs.book/databases/freebook_comm.db
        • Size 72KB
        • SHA256 8f1bab8f3e0e19595a60d77970aa65f89900f81a7574d438a4957f43698a9f54
        • MD5 SHA1 SHA512 SSDEEP

        freebook_comm.db-journal

        • Path /data/data/com.mianfeizs.book/databases/freebook_comm.db-journal
        • Size 512B
        • SHA256 a63b2386c72f947af5a6a94c357d1f45ef5af81e1771ad8d249cc7f8ec3fd208
        • MD5 SHA1 SHA512

        freebook_comm.db-journal

        • Path /data/data/com.mianfeizs.book/databases/freebook_comm.db-journal
        • Size 8KB
        • SHA256 25ea4157c5243948ac71491c2d94b20b20de7a47548d8db4c33b8af7d7d4d623
        • MD5 SHA1 SHA512 SSDEEP

        freebook_comm.db-journal

        • Path /data/data/com.mianfeizs.book/databases/freebook_comm.db-journal
        • Size 8KB
        • SHA256 c2af8c3938051ca2f3cbaca0c47f117c8b2484d4f2c36b420f79768e861cc556
        • MD5 SHA1 SHA512 SSDEEP

        freebook_comm.db-journal

        • Path /data/data/com.mianfeizs.book/databases/freebook_comm.db-journal
        • Size 8KB
        • SHA256 c9df03352625e3b2288a361579f664abbdda682a265d534f16a9b4dcc3893350
        • MD5 SHA1 SHA512 SSDEEP

        freebook_comm.db-journal

        • Path /data/data/com.mianfeizs.book/databases/freebook_comm.db-journal
        • Size 12KB
        • SHA256 be1faac1112b2b2e12cbc4f906c53408d6e0671a36c0956af8469ef32ea4ea2f
        • MD5 SHA1 SHA512 SSDEEP

        freebook_comm.db-journal

        • Path /data/data/com.mianfeizs.book/databases/freebook_comm.db-journal
        • Size 16KB
        • SHA256 8d7d43df30a4f36a39b8254f4edad56d1fc1899490dd068b5752f330ae6ad8c6
        • MD5 SHA1 SHA512 SSDEEP

        pushsdk.db-journal

        • Path /data/data/com.mianfeizs.book/databases/pushsdk.db-journal
        • Size 8KB
        • SHA256 872016cbc7ffa5656b1a1f7c063a63fd65feeecfed9fc1dc19033ba76114070d
        • MD5 SHA1 SHA512 SSDEEP

        pushsdk.db-journal

        • Path /data/data/com.mianfeizs.book/databases/pushsdk.db-journal
        • Size 8KB
        • SHA256 44b69e32edb42f206db017435c090e0df5784a499b4510b0052215b08525243b
        • MD5 SHA1 SHA512 SSDEEP

        um_cache_1717209969784.env

        • Path /data/data/com.mianfeizs.book/files/.um/um_cache_1717209969784.env
        • Size 1KB
        • SHA256 e08b624cfd5d2c021b1338dc00066a0c7caad0eda0da867e84a535d3891929f1
        • MD5 SHA1 SHA512

        exchangeIdentity.json

        • Path /data/data/com.mianfeizs.book/files/.umeng/exchangeIdentity.json
        • Size 162B
        • SHA256 9d54d89edb337d2e4c7b0f9fd7ce5f0a92f1223071bd9cfc3fa00959dd165f53
        • MD5 SHA1 SHA512

        exid.dat

        • Path /data/data/com.mianfeizs.book/files/exid.dat
        • Size 69B
        • SHA256 3e1eabbb507e940062e72762bcde8d66eb7ebf44e3aa8d9fb5056d0e9c4fe1bd
        • MD5 SHA1 SHA512

        init_c1.pid

        • Path /data/data/com.mianfeizs.book/files/init_c1.pid
        • Size 14B
        • SHA256 03f489132641d4d22134f3fb87d0ef7dee4743a5d6d2aa700dd28f9db3f08840
        • MD5 SHA1 SHA512

        jpush_stat_cache.json

        • Path /data/data/com.mianfeizs.book/files/jpush_stat_cache.json
        • Size 133B
        • SHA256 163deb34bf1b44eb47c20c7cb97a0ad0b4aa37f5276b3b6f282a9e3dd0e03b4a
        • MD5 SHA1 SHA512

        finalcore.jar

        • Path /data/data/com.mianfeizs.book/files/sllak/core/finalcore.jar
        • Size 108KB
        • SHA256 7850f76ecdbfd301c02005a2e1b95ae7758a1f1fc2edcb730b49baf419a93fc6
        • MD5 SHA1 SHA512 SSDEEP

        finalcore.jar.cur.prof

        • Path /data/data/com.mianfeizs.book/files/sllak/core/oat/finalcore.jar.cur.prof
        • Size 524B
        • SHA256 5d75da7935a5dfe2a183f0f246a3469206542ba1268891ab97a2c964b83230c1
        • MD5 SHA1 SHA512

        log1717209839865

        • Path /data/data/com.mianfeizs.book/files/sllak/logcache/log1717209839865
        • Size 2KB
        • SHA256 7ad18451986c095b613cd1f8ac6fced526525a82e617fa4af49545e16cdcc433
        • MD5 SHA1 SHA512

        umeng_it.cache

        • Path /data/data/com.mianfeizs.book/files/umeng_it.cache
        • Size 350B
        • SHA256 48a048c8b18683209070648d678e26575a3035dec64f7c7631978049a3528ebc
        • MD5 SHA1 SHA512

        finalcore.jar

        • Path /data/user/0/com.mianfeizs.book/files/sllak/core/finalcore.jar
        • Size 250KB
        • SHA256 6e796e309af4c61c112ba210e9e02401ab7afcd9585a25bf8e325883771ce68a
        • MD5 SHA1 SHA512 SSDEEP

        com.google.android.maps.jar

        • Path /product/framework/com.google.android.maps.jar
        • Size 315KB
        • SHA256 67a651acd867e046fb4463b31ea584c1468f7243a9d1e2efd34059e8ee2f130f
        • MD5 SHA1 SHA512 SSDEEP

        .cer

        • Path /storage/emulated/0/.cxb/.cer
        • Size 730B
        • SHA256 40860a1b3d4bd196aeb8cdf1d91c03e91134740337602aa83157aa93d766108b
        • MD5 SHA1 SHA512

        .ygzhang

        • Path /storage/emulated/0/.hide_freebook/.ygzhang
        • Size 32B
        • SHA256 6b0143a51085c5b3900e88911561b7af937b2a773e71792b576e744924d1968e
        • MD5 SHA1 SHA512

        .sfp

        • Path /storage/emulated/0/.sfp/.sfp
        • Size 83B
        • SHA256 a8688a198faae2a59beb92eb0619fc495068bf5116557d45c06377f16be96317
        • MD5 SHA1 SHA512

        .fb

        • Path /storage/emulated/0/FreeBook/book/60003253/.fb
        • Size 107B
        • SHA256 005909229df46cc90ab7528c65cbb25b9f20a96c2a281db501f0ce6bfc00b27d
        • MD5 SHA1 SHA512

        .fb

        • Path /storage/emulated/0/FreeBook/book/80001644/.fb
        • Size 96B
        • SHA256 4e845f6e33f4d3d2fc3306034e80adc3677dc6ce2c549cec11a6d894936cbab0
        • MD5 SHA1 SHA512

        .fb

        • Path /storage/emulated/0/FreeBook/book/80001911/.fb
        • Size 107B
        • SHA256 b007d004612bbc37e76b141579a06fac98c363604ec445dac524b0f2f6cd1fd6
        • MD5 SHA1 SHA512

        .fb

        • Path /storage/emulated/0/FreeBook/book/80002410/.fb
        • Size 96B
        • SHA256 cecf9441686787500b500b20127b97ab9987409aed93ae05fd38f4ac44bc35e2
        • MD5 SHA1 SHA512

        .fb

        • Path /storage/emulated/0/FreeBook/book/80002449/.fb
        • Size 107B
        • SHA256 378180bbf132ac00e928863488199eb8b8d45bc936e1c5c3f8d83fdcb2405bd7
        • MD5 SHA1 SHA512

        .fb

        • Path /storage/emulated/0/FreeBook/book/80002628/.fb
        • Size 118B
        • SHA256 6d41acd5b27819ca85806014d1bfff935cdb47eb56fcfb5a4333985d82de62e7
        • MD5 SHA1 SHA512

        -2002406654.tmp

        • Path /storage/emulated/0/FreeBook/img/-2002406654.tmp
        • Size 14KB
        • SHA256 4b17d0c578ca1deb78924a2f84c572ad19df2748db831eb1306f9493d2baa30c
        • MD5 SHA1 SHA512 SSDEEP

        -281292385.tmp

        • Path /storage/emulated/0/FreeBook/img/-281292385.tmp
        • Size 13KB
        • SHA256 23922a8b1bebea37fc5c47d46882468f8ccfae572d1750ea345693e59281dc0f
        • MD5 SHA1 SHA512 SSDEEP

        -308871807.tmp

        • Path /storage/emulated/0/FreeBook/img/-308871807.tmp
        • Size 13KB
        • SHA256 4e7b3d72d343a06d1a1fdc4f180f53c1d8ec24b89b7f80fd27154482012e77c3
        • MD5 SHA1 SHA512 SSDEEP

        -403070949.tmp

        • Path /storage/emulated/0/FreeBook/img/-403070949.tmp
        • Size 13KB
        • SHA256 21aaf322c2b86c252bc5046729fd4b03e01cb4fa4bda82f95ea386077be6840c
        • MD5 SHA1 SHA512 SSDEEP

        -576146247.tmp

        • Path /storage/emulated/0/FreeBook/img/-576146247.tmp
        • Size 11KB
        • SHA256 0b25a5b5ae6923d2eb9af095b478ab857974e5f0e71b33c7e3f61866a6b188a2
        • MD5 SHA1 SHA512 SSDEEP

        1407953732.tmp

        • Path /storage/emulated/0/FreeBook/img/1407953732.tmp
        • Size 13KB
        • SHA256 5e08b1517d1576a3e75525d36379e4f02e501a9130ce4c961a1cdc7a171992d4
        • MD5 SHA1 SHA512 SSDEEP

        .push_deviceid

        • Path /storage/emulated/0/data/.push_deviceid
        • Size 32B
        • SHA256 d7a05fd785af42257893a839441cacce523e4f60ec5d3d85312c9dd13cc2e683
        • MD5 SHA1 SHA512