Analysis
- max time kernel
9s - max time network
152s - platform
android_x64 - resource
android-x64-20240514-en - resource tags
androidarch:x64arch:x86image:android-x64-20240514-enlocale:en-usos:android-10-x64system - submitted
01/06/2024, 06:37
Behavioral task
behavioral1
Sample
89a179ff243912a137eb99a8395a2c7f_JaffaCakes118.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral2
Sample
89a179ff243912a137eb99a8395a2c7f_JaffaCakes118.apk
Resource
android-x64-20240514-en
Behavioral task
behavioral3
Sample
amap_resource1_0_0.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral4
Sample
amap_resource1_0_0.apk
Resource
android-x64-20240514-en
Behavioral task
behavioral5
Sample
amap_resource1_0_0.apk
Resource
android-x64-arm64-20240514-en
General
- Target 89a179ff243912a137eb99a8395a2c7f_JaffaCakes118.apk
- Size 24.8MB
- Sample240601-hdrmqsdf48
- SHA256 bb00af6432802dc6ecb201c503e620423c1f916a3e7b4bd8d9ce5e80ac2984ae
- MD5 89a179ff243912a137eb99a8395a2c7f
- SHA1 4e0c805fb821050811ddf80998c112454f7c59b8
- SHA512 a0d48da321cdbef8e3482dac4fe74a22ad0309c97af22b826505ab32afa55ccf391cb9cb2954d50f6e711faecd6d1fb3acc5931939c98978b56d22b70985462c
- SSDEEP 393216:9hKmqaLkYIyIjNe49eLBRWEE/+k+2bXum7Pw0FVgRGcQzisKIqeUegaxhuOQavfK:POaYPjnEE/+idFV+GBziLHeJqH4ydgW
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Loads dropped Dex/Jar 1 TTPs 2 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/com.lqcx/[email protected] 5161 com.lqcx /data/user/0/com.lqcx/[email protected]!classes2.dex 5161 com.lqcx - Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.lqcx - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.lqcx - Checks if the internet connection is available 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.lqcx - Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
Processes
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.lqcx/.jiagu/classes.dex
- Size 3.5MB
- SHA256 182e76054bd0f6855a1ccfc49b3771097990de55ce33478b7cebb1bf01927410
- MD5 1631d62d2b18552e5a66e93e49428be5
- SHA1 d4b1a510899e2dea60e1914765580d31a4acfa20
- SHA512 11813b5e3dc6cc6d645dd7249ac85ca08ade7aa28cc56d5eb588fe23a4632eefba61c972e1e10857a212e70715ef111e10eb385d15b7dc9994d7c159e2cab578
- SSDEEP 49152:n1TVBSz+80UJoL8/XBGbqGT0sgNBkuuvINWPy2WX/SnNO:nzBXVfeBJo4jkue+07n4
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.lqcx/.jiagu/libjiagu.so
- Size 455KB
- SHA256 78e4ea857f10c2df6c7b94f0584524b52ecc099ed29478fe3964037b8a86ed2e
- MD5 e5a53000766ebc433b27d6a66ec4f555
- SHA1 2c8f53f1c03aec2005bcad67d731f07261dabde0
- SHA512 370a1cb93b14556ad861724f4e9995c9a4c6d37cf2d570f888d1c6000c66d27ac63496b0703361e9fc9bc7f309b7aa4407c5f339d186b0a5b72520d23d04b68d
- SSDEEP 12288:XfCZt8eDxO+LCDA89hC2KL/MqEvnapbMt6hVPZWJ:Xfw/O0Cc8zCD/MVvUHnRWJ
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.lqcx/files/.jglogs/.jg.ac
- Size 32B
- SHA256 7449210e83b6a9a3e5cad77d73d325f7fc9f7306c8a2feb2c094d89ec6c44e18
- MD5 c345a5385e663f42b0f81f3a3ba7954f
- SHA1 48ef4e4ba0c4d2b5b0cc33539575ace6743d159e
- SHA512 8e1eee0ee754d9ad519625eec0a5c18f2934f948192f64765a31decd5997b418b634df549120ddcb8ced163973f458c136eaa92d5b623bc51f0e9715e6410f72
- MD5 SHA1 SHA512
- Path /data/data/com.lqcx/files/.jglogs/.jg.di
- Size 340B
- SHA256 4b52377d7602862f0e1731b50a2d00bbbef365ab9cb7ecc0fbfa8c79e2bf19c4
- MD5 d669fc4000c43a7a956387e9f8a6221d
- SHA1 fb89389ab2dd5cc23b5133e32b318b6705adc3e0
- SHA512 151a703a3e807a73e9d751261a788948dfcf96c6bae0bf0684913d64441f8a31d7a7f4ec88d3fa556d00543459fead5ca16db171aa700ed5552e48a19d70e3c8
- MD5 SHA1 SHA512
- Path /data/data/com.lqcx/files/.jglogs/.jg.ic
- Size 32B
- SHA256 2a2bb6439c5d8d264effe11daf6bb7b65a3d8506a609ab0f7e8fbfea1630f3ae
- MD5 adf45677fb57c551a7e9bd83603cf7eb
- SHA1 7c428fc7ece71791733e6f368b8aa0216f57a888
- SHA512 3ae08bfb4051dc2dfd1fc4bdf3d7e7ab918ac06a0d6190f7647e019cbb728e5bf2e9a052882bc3e4c7ba5bb7771c6935bbded4e2f77bf045b31de9e6206fe348
- MD5 SHA1 SHA512
- Path /data/data/com.lqcx/files/.jglogs/.jg.ri
- Size 314B
- SHA256 f4f1d38afb2bf3220ca36427f684ac779f1facf4e9af06c5f0c93db19969c208
- MD5 b108718cd1aa1776000c02864a572e7d
- SHA1 60e1ab4ffb411ef0f0ae9eda9e28b2b75002695b
- SHA512 192f81852c8bdaa849a98bfde1e6a18cda4aa3777346a056b031e7b9acff61627a98e6a48841bc566c140caa01688d8d395eb5bd26f6f9831c7a5a83d78fb2be
- MD5 SHA1 SHA512
- Path /data/data/com.lqcx/files/.jiagu.lock
- Size 27B
- SHA256 25e9d7e0b3575627df8e34150209ec08db5641d15009b589bef688d319f51660
- MD5 4c92a2adc8fe7fcec1468b1a0f395df9
- SHA1 d43df5a77645ccdfd8f2c3feaeed8ca9249b5258
- SHA512 9338b2d0271304e26ff3495652ebbce1c619cc1f4fda1c5c9b229694722dbd923b7156af89712cfbd044be5cdd7cb4b62e0a4b74e03426fb39a1e6980a6d02d3
- MD5 SHA1 SHA512
- Path /data/data/com.lqcx/lib-main/dso_deps
- Size 124B
- SHA256 8af2a7646aeab18a3ed04d63f29bb125cf754dfc347745f25014d70aac79c093
- MD5 df0c6027906ef9faa5794827f5e2ec92
- SHA1 2c2458d1081e4c137a341af6a3bba7ab71161fa2
- SHA512 549fe6479e33c322aa3d708ef52fc6a91949a0ae964e216cbb4defaa2f34e202c6fd2e5d03423da5e907f0d5f62b05009351c0d05fd6b9c33cc69129e3dae5a5
- MD5 SHA1 SHA512
- Path /data/data/com.lqcx/lib-main/dso_manifest
- Size 5B
- SHA256 957b88b12730e646e0f33d3618b77dfa579e8231e3c59c7104be7165611c8027
- MD5 c06857e9ea338f3f3a24bb78f8fbdf6f
- SHA1 c5a0a2529d2deb60fec041b4fbd722a2ebe31702
- SHA512 29f61516876c25379a7bf4faa2b3ca6f6b53eac90e7de47671fec4a818d51441b4025cd7909f7c0a0d113ab6c5ff00cb3700c286bac7319185b77905feec4fb1
- MD5 SHA1 SHA512
- Path /data/data/com.lqcx/lib-main/dso_state
- Size 1B
- SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
- MD5 93b885adfe0da089cdf634904fd59f71
- SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
- SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
- MD5 SHA1 SHA512
- Path /data/data/com.lqcx/lib-main/dso_state
- Size 1B
- SHA256 4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a
- MD5 55a54008ad1ba589aa210d2629c1df41
- SHA1 bf8b4530d8d246dd74ac53a13471bba17941dff7
- SHA512 7b54b66836c1fbdd13d2441d9e1434dc62ca677fb68f5fe66a464baadecdbd00576f8d6b5ac3bcc80844b7d50b1cc6603444bbe7cfcf8fc0aa1ee3c636d9e339
- MD5 SHA1 SHA512
- Path /data/user/0/com.lqcx/[email protected]
- Size 6.2MB
- SHA256 6e04e83006cb494bb83c7ae9f27ec7635df66b0fd5cc3018871ba47c59de8f63
- MD5 339ba8d1f4a929cbbea278163a6eae2f
- SHA1 425f09d731651236f187b20fa2a97fe382c55b64
- SHA512 ff219babeac11bb7db5af7902a5ba630aa669214941f3dce2646807f8d8c220a03a1202ea7ec51d53341bb40a18f011a0e4fd98d698848f767cc677b05bb79d7
- SSDEEP 49152:XEMp6nmLcGa7199A6+B/678xxgjCgPXcd3J/Z3CNQpGpDsgNBkuuvINWPy2Q:Xtp6nAvxqPMJFMpFjkue+0k
- MD5 SHA1 SHA512 SSDEEP
[email protected]!classes2.dex
- Path /data/user/0/com.lqcx/[email protected]!classes2.dex
- Size 358KB
- SHA256 d32a7e26a7e513e29da4d5a9f6cf0169527e9c0e5957bc0d67a5e4aabc526294
- MD5 573f752753276daa9ae853571293cd68
- SHA1 b021eff8d1a949fbe3bde05203851191437497ea
- SHA512 0be55713998d11a78a6937f72b65334cf554670f6748e4b773824dde185f359cc538e6992e1f573afaedaab62f8178e34479fae1278d17b54b683892af4902b7
- SSDEEP 6144:wdHoguAZDY4SulRKuG7ntQlP7B3ITJTVCN0KP:koguDztQd7yNKP
- MD5 SHA1 SHA512 SSDEEP
- Path /storage/emulated/0/360/.deviceId
- Size 48B
- SHA256 36c5c63f39ddf7a6a9c01946e4f78b95790aa734176802e793e95724a1b5b731
- MD5 4c4c5285293d5141f582aefa4e038669
- SHA1 e01852a72e5a8e6f7d63a21426b515118196047b
- SHA512 097aa673273e307f7bfb7c08861ad389d4b5f7fae55d972a5c1636aa66d0b8d23b5eb9b696cefe0e5b942f23969dabf0147397aeca85fb9a4d75e0473104e399
- MD5 SHA1 SHA512
- Path /storage/emulated/0/360/.iddata
- Size 32B
- SHA256 e7c5b7fd0953e0d3562ff7e43c6e5397bb3036eb377cf8d462cf68295dc6a1fc
- MD5 7ab72636daf9a05300db8f2bcce5e744
- SHA1 ac3141321440eb789e73eaf4e8610147ca670663
- SHA512 d0b7fd5696b22753e8c175cb9f9a2b13b73e1c0c3e6fe06d87bc7ba7a4fafa166945487a8c1769c75b2739090a218282e5b03b20552644e5fc2a2994faaa75f0
- MD5 SHA1 SHA512