Analysis

  • max time kernel
    179s
  • max time network
    178s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240514-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
  • submitted
    02/06/2024, 11:43

General

  • Target
    8df6193cd8f519b51ecdd42608771a61_JaffaCakes118.apk
  • Size 23.0MB
  • Sample240602-nvv95scf39
  • SHA256 ce5cbffaf03212dbfe30df6979fae0401137cc5fd00f40699b2b65f7c4b1ab01
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 2 IoCs
  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

  • Checks memory information 2 TTPs 1 IoCs

    Checks memory information which indicate if the system is an emulator.

  • Loads dropped Dex/Jar 1 TTPs 5 IoCs

    Runs executable file dropped to the device during analysis.

  • Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Checks if the internet connection is available 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Requests dangerous framework permissions 5 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.xsj.h5sword.aligames
    1⤵
    • Checks if the Android device is rooted.
    • Checks CPU information
    • Checks memory information
    • Loads dropped Dex/Jar
    • Obtains sensitive information copied to the device clipboard
    • Queries information about running processes on the device
    • Queries information about the current Wi-Fi connection
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4680

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        msg_1717328733323

        • Path /data/user/0/com.xsj.h5sword.aligames/app_xgsdk-data/msg_1717328733323
        • Size 935B
        • SHA256 8dcb54d47b04d11ab848c6decf194c0eb43affe1fccbea3fa734881efa5015b9
        • MD5 SHA1 SHA512

        xgsdk-channel-20180607155902.apk

        • Path /data/user/0/com.xsj.h5sword.aligames/app_xgsdk-pwd/xgsdk-channel-20180607155902.apk
        • Size 20KB
        • SHA256 bb462df16dec44527bbf4b1b4e7f523e818ff2aae27b6b55453bffff11e9e8c3
        • MD5 SHA1 SHA512 SSDEEP

        xgsdk-data-2.0.apk

        • Path /data/user/0/com.xsj.h5sword.aligames/app_xgsdk-pwd/xgsdk-data-2.0.apk
        • Size 35KB
        • SHA256 9f2f3ad45ed72b8431777b4d1d39a4931f957b62d4ddd75e6c77113b185201e1
        • MD5 SHA1 SHA512 SSDEEP

        sdk_config.properties

        • Path /data/user/0/com.xsj.h5sword.aligames/app_xgsdk/sdk_config.properties
        • Size 790B
        • SHA256 6cd406f151481482c37514b6c9b892418825a07f2ed1e74e39eeec7d8edfaff7
        • MD5 SHA1 SHA512

        xgsdk-channel-20180607155902.apk

        • Path /data/user/0/com.xsj.h5sword.aligames/app_xgsdk/xgsdk-channel-20180607155902.apk
        • Size 20KB
        • SHA256 7b99bd593640bd785e8be52b0a1a373f798d577d5a91b5892201bc7979acd347
        • MD5 SHA1 SHA512 SSDEEP

        xgsdk-channel-20180607155902.apk

        • Path /data/user/0/com.xsj.h5sword.aligames/app_xgsdk/xgsdk-channel-20180607155902.apk
        • Size 48KB
        • SHA256 fba9b991832a57565090e23e70df2176f24f5c7433e034228f70024bcea78888
        • MD5 SHA1 SHA512 SSDEEP

        xgsdk-data-2.0.apk

        • Path /data/user/0/com.xsj.h5sword.aligames/app_xgsdk/xgsdk-data-2.0.apk
        • Size 34KB
        • SHA256 8a964d1697cc7281306eac323ba25873406854f0d92bd53cb309b1ad3f0049cb
        • MD5 SHA1 SHA512 SSDEEP

        xgsdk-data-2.0.apk

        • Path /data/user/0/com.xsj.h5sword.aligames/app_xgsdk/xgsdk-data-2.0.apk
        • Size 73KB
        • SHA256 6e9185371583b7c35919632037b1aa0d61c1f1c797ea043ace458a4c2c54037f
        • MD5 SHA1 SHA512 SSDEEP

        gamesdk_stat.db

        • Path /data/user/0/com.xsj.h5sword.aligames/databases/gamesdk_stat.db
        • Size 32KB
        • SHA256 a8c63e19359a61684eaaabd56bfe9cf6dcb6a8896962fcda8cdab2b6e00bdce1
        • MD5 SHA1 SHA512 SSDEEP

        gamesdk_stat.db-journal

        • Path /data/user/0/com.xsj.h5sword.aligames/databases/gamesdk_stat.db-journal
        • Size 512B
        • SHA256 ba2144abfa19744999c42e734b97036f6ebefc1201af98dc7dfa34de52b24362
        • MD5 SHA1 SHA512

        gamesdk_stat.db-journal

        • Path /data/user/0/com.xsj.h5sword.aligames/databases/gamesdk_stat.db-journal
        • Size 8KB
        • SHA256 c93087d694b40ae268f91bdeaee53c0e3675c4c83bb6885884dcba1c40ced035
        • MD5 SHA1 SHA512 SSDEEP

        gamesdk_stat.db-journal

        • Path /data/user/0/com.xsj.h5sword.aligames/databases/gamesdk_stat.db-journal
        • Size 8KB
        • SHA256 386ff2fd81156c8ea21556a10387fa834fb69909b625f13e6ccd1778bb7236a7
        • MD5 SHA1 SHA512 SSDEEP

        gamesdk_stat.db-journal

        • Path /data/user/0/com.xsj.h5sword.aligames/databases/gamesdk_stat.db-journal
        • Size 12KB
        • SHA256 e17b1383e5cf144b5d1964f8f670e697e5d699ab3de265257f9eb20852cde4b4
        • MD5 SHA1 SHA512 SSDEEP

        gamesdk_stat.db-journal

        • Path /data/user/0/com.xsj.h5sword.aligames/databases/gamesdk_stat.db-journal
        • Size 12KB
        • SHA256 d4ffe1b666f9d1b01fc94931bd3587765648a535e3bf1fd05be8658d9e77b6d6
        • MD5 SHA1 SHA512 SSDEEP

        gamesdk_stat.db-journal

        • Path /data/user/0/com.xsj.h5sword.aligames/databases/gamesdk_stat.db-journal
        • Size 16KB
        • SHA256 3d72c1a9a1910e8cb1116d04c672054a164e1a7b98d57ed163fe4686281a8cca
        • MD5 SHA1 SHA512 SSDEEP

        session-CrasheyeSavedData-1-1717328753956.json

        • Path /data/user/0/com.xsj.h5sword.aligames/files/session-CrasheyeSavedData-1-1717328753956.json
        • Size 531B
        • SHA256 ae42cbdd066756d56771eb3d2c0798b64b9476d274b576a3803764455f7d9746
        • MD5 SHA1 SHA512

        ModuleManifest.json

        • Path /data/user/0/com.xsj.h5sword.aligames/gamesdk_modules/ModuleManifest.json
        • Size 11KB
        • SHA256 1cc1ee016dc2f69cdf1eab26673799ed83376bc47a23ea8a4643e6b4d3b0a87a
        • MD5 SHA1 SHA512 SSDEEP

        libcn.uc.gamesdk.init.apk

        • Path /data/user/0/com.xsj.h5sword.aligames/gamesdk_modules/cn.uc.gamesdk.init/7.5.2.8/libcn.uc.gamesdk.init.apk
        • Size 143KB
        • SHA256 4206c210a22fb05c48b991ca73b7e1752db3b83cd165620d96c5b9b1005eddef
        • MD5 SHA1 SHA512 SSDEEP

        libcn.uc.gamesdk.init.apk

        • Path /data/user/0/com.xsj.h5sword.aligames/gamesdk_modules/cn.uc.gamesdk.init/7.5.2.8/libcn.uc.gamesdk.init.apk
        • Size 61KB
        • SHA256 c6f095d039203e89706f007ee046d54fcaa3c513da87211b45b2a109281a0ce8
        • MD5 SHA1 SHA512 SSDEEP

        property

        • Path /data/user/0/com.xsj.h5sword.aligames/gamesdk_modules/cn.uc.gamesdk.init/7.5.2.8/property
        • Size 78B
        • SHA256 5e0981ba66bcf8f22520ef52df6e1f4c5d3ccd88225faf99b493dda60cdd3e04
        • MD5 SHA1 SHA512

        property

        • Path /data/user/0/com.xsj.h5sword.aligames/gamesdk_modules/cn.uc.gamesdk.init/7.5.2.8/property
        • Size 78B
        • SHA256 4192bb8393db7fc37035e52daa24afb242ef41a19f873178e8ac95713614de5a
        • MD5 SHA1 SHA512

        signature

        • Path /data/user/0/com.xsj.h5sword.aligames/gamesdk_modules/cn.uc.gamesdk.init/data/signature
        • Size 95B
        • SHA256 d326be6dd5706d857f3384a059022bee269203db7dcb7e537fb879d75f9fd8fb
        • MD5 SHA1 SHA512

        lib_ucsdk_softlink.so

        • Path /data/user/0/com.xsj.h5sword.aligames/ucgamesdk/lib/lib_ucsdk_softlink.so
        • Size 13KB
        • SHA256 e17055c0f9ee7dd26d366820e45d510242508a53c5ddaae56e8db58a91cb13a3
        • MD5 SHA1 SHA512 SSDEEP

        lib_ucsdk_xcrypt.so

        • Path /data/user/0/com.xsj.h5sword.aligames/ucgamesdk/lib/lib_ucsdk_xcrypt.so
        • Size 18KB
        • SHA256 72e171aa8dce74bf8a5b2106184222e54929bc754cea4c77ceacf027a4e822ed
        • MD5 SHA1 SHA512 SSDEEP

        ucsdk.apk

        • Path /data/user/0/com.xsj.h5sword.aligames/ucgamesdk/lib/ucsdk.apk
        • Size 29KB
        • SHA256 b4071a983a0a546aa5685cf0a49dcf941cc2274a5bb673b8688c1fe7c54ce490
        • MD5 SHA1 SHA512 SSDEEP

        ucsdk.apk

        • Path /data/user/0/com.xsj.h5sword.aligames/ucgamesdk/lib/ucsdk.apk
        • Size 55KB
        • SHA256 4b9ada634b69923299cadcd49c1e6cae19f22ec5de2ef875e0220573e8e23bdf
        • MD5 SHA1 SHA512 SSDEEP

        stat_64.log

        • Path /data/user/0/com.xsj.h5sword.aligames/ucgamesdk/logs/log_shell/stat_64.log
        • Size 366B
        • SHA256 ca1aed355b248aef8ba8a91c158c403b947de93872bfaa5eebe0c78c9884ea11
        • MD5 SHA1 SHA512

        stat_64.log

        • Path /data/user/0/com.xsj.h5sword.aligames/ucgamesdk/logs/log_shell/stat_64.log
        • Size 720B
        • SHA256 162c4cfd16428dd34aea4032990a5e1047215c612b0d89465f14dc97bfa79b6a
        • MD5 SHA1 SHA512

        stat_64.log

        • Path /data/user/0/com.xsj.h5sword.aligames/ucgamesdk/logs/log_shell/stat_64.log
        • Size 1KB
        • SHA256 8f65008dd2c0833cd299b5b791f621023ef9afcd9aa7c942bdcb355596c70b16
        • MD5 SHA1 SHA512

        .verify

        • Path /data/user/0/com.xsj.h5sword.aligames/ucgamesdk/modules/odex/.verify
        • Size 95B
        • SHA256 fcee27de0a8ecdc1bf78deab85c761a0a7ad2137bb0a746926596a3ac3a37726
        • MD5 SHA1 SHA512

        .verify

        • Path /data/user/0/com.xsj.h5sword.aligames/ucgamesdk/modules/odex/.verify
        • Size 95B
        • SHA256 971fe3f0aa109697ff370860d9e4ea97162e6892fa9aad4134c2e0dcdd7cf8a8
        • MD5 SHA1 SHA512

        cn.uc.gamesdk.loader.apk

        • Path /data/user/0/com.xsj.h5sword.aligames/ucgamesdk/modules/stable/cn.uc.gamesdk.loader.apk
        • Size 2.4MB
        • SHA256 6e7d08db870927384b68b37e0f59941b9ed272c47d594fb9acab256d374e2d9d
        • MD5 SHA1 SHA512 SSDEEP

        .verify

        • Path /data/user/0/com.xsj.h5sword.aligames/ucgamesdk/modules/update-1/.verify
        • Size 32B
        • SHA256 27f30efae035b6dabf59d66bb448871648a39855235fb0f63d81789703e24e55
        • MD5 SHA1 SHA512

        cn.uc.gamesdk.loader.apk

        • Path /data/user/0/com.xsj.h5sword.aligames/ucgamesdk/modules/update-1/cn.uc.gamesdk.loader.apk
        • Size 4.4MB
        • SHA256 7b028cd271441eae195bbe2d762a6f8c5e4f31d71914f972c4ed11293b926e8d
        • MD5 SHA1 SHA512 SSDEEP

        version.ini

        • Path /data/user/0/com.xsj.h5sword.aligames/ucgamesdk/modules/update-1/version.ini
        • Size 11B
        • SHA256 7b79f4f2f33c273da70170f6d328cdf4528326662289c70bd9029bb5503b92bc
        • MD5 SHA1 SHA512

        ContextData.xml

        • Path /storage/emulated/0/.DataStorage/ContextData.xml
        • Size 111B
        • SHA256 ddb25db4347953ff2507a2216b58031aeff4064d4452d175bf51da0e0953d9b3
        • MD5 SHA1 SHA512

        ContextData.xml

        • Path /storage/emulated/0/.DataStorage/ContextData.xml
        • Size 213B
        • SHA256 702f3e2def33f26db32a997498b90029a59e049ae72b9513ddc410cbf9826619
        • MD5 SHA1 SHA512

        Alvin2.xml

        • Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
        • Size 65B
        • SHA256 3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793
        • MD5 SHA1 SHA512

        Alvin2.xml

        • Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
        • Size 111B
        • SHA256 3bd0e6628d5382b4dbb7bffff9a7dfcb050b26d26130c5c1ea63572161a5da8b
        • MD5 SHA1 SHA512

        Alvin2.xml

        • Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
        • Size 167B
        • SHA256 f25b4df095d39d21149d2c68ad4da889429547c5470256d06ede499725a2385e
        • MD5 SHA1 SHA512

        tbslog.txt (deleted)

        • Path /storage/emulated/0/Android/data/com.xsj.h5sword.aligames/files/tbslog/tbslog.txt (deleted)
        • Size 2KB
        • SHA256 f101155374e0c14d6ce4ccf049dda0f6c5a917c85611002fcfdbaef5cf6dc618
        • MD5 SHA1 SHA512

        anal_202406021145.loader.log

        • Path /storage/emulated/0/ucgamesdk/0/logs/analog/anal_202406021145.loader.log
        • Size 207B
        • SHA256 cc01e2f5e80a39bd356d92434e60f5e2717e971123e4e7265cd98d11c36593b0
        • MD5 SHA1 SHA512

        anal_202406021145.loader.log

        • Path /storage/emulated/0/ucgamesdk/0/logs/analog/anal_202406021145.loader.log
        • Size 414B
        • SHA256 8c4af5f17c4a4496094215ceffa5d60179c5daa92665624549bc41b1f9cce317
        • MD5 SHA1 SHA512

        anal_202406021145.loader.log

        • Path /storage/emulated/0/ucgamesdk/0/logs/analog/anal_202406021145.loader.log
        • Size 663B
        • SHA256 707ceef12382ce375c55ac444562ae071f0b8da6c5225acdca42a3170ce13723
        • MD5 SHA1 SHA512

        anal_202406021145.ucgamesdk.log

        • Path /storage/emulated/0/ucgamesdk/0/logs/analog/anal_202406021145.ucgamesdk.log
        • Size 162B
        • SHA256 9b4312dab4a811d4e8f9870dde2ceefb2b0ccc544c2b2ed35832474ea06ed1f3
        • MD5 SHA1 SHA512

        anal_202406021145.ucgamesdk.log

        • Path /storage/emulated/0/ucgamesdk/0/logs/analog/anal_202406021145.ucgamesdk.log
        • Size 324B
        • SHA256 0d7bc6049022b40b7cd7e0971db0d5a7da6f78b9f340a8d79ed58078b6d304a1
        • MD5 SHA1 SHA512

        debug_2024060211.loader.log

        • Path /storage/emulated/0/ucgamesdk/0/logs/debuglog/debug_2024060211.loader.log
        • Size 131B
        • SHA256 4ce037b72160ef23837471e8869b12870b6347cf25c2454daa361c0ff7336472
        • MD5 SHA1 SHA512

        debug_2024060211.loader.log

        • Path /storage/emulated/0/ucgamesdk/0/logs/debuglog/debug_2024060211.loader.log
        • Size 224B
        • SHA256 bc49d270e7e4b5fe58d80609fb6dd87ceb7e895a1d37eab04edb15c024335f7c
        • MD5 SHA1 SHA512

        debug_2024060211.preload.log

        • Path /storage/emulated/0/ucgamesdk/0/logs/debuglog/debug_2024060211.preload.log
        • Size 97B
        • SHA256 c8be22a5ddd03232fc8a5333025248c87286f2f6f77cdee345c40cf42539f1d2
        • MD5 SHA1 SHA512

        debug_2024060211.preload.log

        • Path /storage/emulated/0/ucgamesdk/0/logs/debuglog/debug_2024060211.preload.log
        • Size 176B
        • SHA256 9afdb1bd9782cf1598cbf31186e6504eb4e96aee691dcdbe461efb23773a5c84
        • MD5 SHA1 SHA512

        debug_2024060211.preload.log

        • Path /storage/emulated/0/ucgamesdk/0/logs/debuglog/debug_2024060211.preload.log
        • Size 242B
        • SHA256 dc2e6b7991f7f9b9bb7a5020f19bd418f98f8be1b808e057c30c02dfa9324282
        • MD5 SHA1 SHA512

        debug_2024060211.preload.log

        • Path /storage/emulated/0/ucgamesdk/0/logs/debuglog/debug_2024060211.preload.log
        • Size 321B
        • SHA256 3a5127506dfde708bc135a930d5a84c6df5ece0f1c5bd1000165a1c85992aaa2
        • MD5 SHA1 SHA512

        debug_2024060211.preload.log

        • Path /storage/emulated/0/ucgamesdk/0/logs/debuglog/debug_2024060211.preload.log
        • Size 398B
        • SHA256 a16d418ec39cfad78e1c01624485b8fe3acf31b37a6c506ccdda9a894eb440a3
        • MD5 SHA1 SHA512

        debug_2024060211.preload.log

        • Path /storage/emulated/0/ucgamesdk/0/logs/debuglog/debug_2024060211.preload.log
        • Size 18KB
        • SHA256 e94b301735d649b585f3312099419ba4013c0e826c6cf876c76a8fdfc9809ea8
        • MD5 SHA1 SHA512 SSDEEP

        debug_2024060211.ucgamesdk.log

        • Path /storage/emulated/0/ucgamesdk/0/logs/debuglog/debug_2024060211.ucgamesdk.log
        • Size 75B
        • SHA256 374e5387b34514984d1e7b80bfe1f4a7ae2fbf7813015d6a310b1b0ff04040fd
        • MD5 SHA1 SHA512

        error_202406021145.loader.log

        • Path /storage/emulated/0/ucgamesdk/0/logs/errlog/error_202406021145.loader.log
        • Size 1KB
        • SHA256 394a0847f47b8356c227d397f3e5d6beeb92185b425782e4f94f28da8b4bdfe4
        • MD5 SHA1 SHA512

        warn_2024060211.preload.log

        • Path /storage/emulated/0/ucgamesdk/0/logs/warnlog/warn_2024060211.preload.log
        • Size 159B
        • SHA256 79a9798edcd60eb05d2509048f742a0baf19719be7240f98a996a5e8a5d66eb3
        • MD5 SHA1 SHA512