Analysis
-
max time kernel
168s -
max time network
186s -
platform
android_x86 -
resource
android-x86-arm-20240514-en -
resource tags
-
submitted
02/06/2024, 20:34
General
-
Target
8f569562061b82988b7172951ed8d559_JaffaCakes118.apk
-
Size
13.7MB
-
MD5
8f569562061b82988b7172951ed8d559
-
SHA1
625d00c957fcb34b052dcbcdaf561c52321a4919
-
SHA256
2d15747ba2d474bcdcbd031dfd54e88ba69ca90404eb53a83db63a61764fa064
-
SHA512
25dee4d1046e69a165ba3deeb55c478b9fa291bbb69591ec5e67b9b89d025f8a1e14103445d79a23a8075b4bc599d1451fb13a61509a44a24907fc1b6542410e
-
SSDEEP
196608:p34J1EiDTP0lVJztTwNFQ9yuh2fTyPmZgxUy1RlcKq+7ZubkZaQFi72E00Sgu:pI7EUcx2rGoTqmZEXRurlboU72nTZ
Malware Config
Signatures
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
-
Checks memory information 2 TTPs 1 IoCs
Checks memory information which indicate if the system is an emulator.
-
Loads dropped Dex/Jar 1 TTPs 11 IoCs
Runs executable file dropped to the device during analysis.
-
Queries information about running processes on the device 1 TTPs 2 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
-
Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.
-
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
-
Queries the phone number (MSISDN for GSM devices) 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
-
Checks if the internet connection is available 1 TTPs 2 IoCs
-
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
-
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes
-
com.mfyueduqi.bool1⤵
- Requests cell location
- Checks memory information
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries information about the current nearby Wi-Fi networks
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Listens for changes in the sensor environment (might be used to detect emulation)
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/data/com.mfyueduqi.bool/.jiagu/tmp.dex --output-vdex-fd=43 --oat-fd=44 --oat-location=/data/data/com.mfyueduqi.bool/.jiagu/oat/x86/tmp.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
-
com.mfyueduqi.bool:pushcore1⤵
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
-
sh -c id2⤵
-
-
id2⤵
-
-
getprop ro.build.version.emui2⤵
-
-
sh -c service call iphonesubinfo 12⤵
-
-
getprop ro.build.version.emui2⤵
-
-
service call iphonesubinfo 12⤵
-
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Execution Guardrails
1Geofencing
1Hide Artifacts
1User Evasion
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.9MB
MD54a533836dbb1b277a498f237a625f5d2
SHA167d1231fb131605174bb55404d91f5d16e8ca128
SHA256d3faa1dacb7fd48653575448cdb13ad45d552997b938718d98af1bbd9634f11d
SHA512a930393c216a0555a7a6520dcc98b38fb27e0e17ee906db84afa4b40d71ee1450a219c35a80fb95bcb901b2fbda1e5c0b1f84d15efc95c79164b87e69bda4e69
-
Filesize
5.1MB
MD58bafe4f7d13731508fb5b06e135ca253
SHA1ca6a1c5f3d22555fa11399697663f188e97b8dee
SHA256bd6b750daa09572c5defc7816dae21e3fd6a129702021db7cf9e1516e16aedfc
SHA512d85b7749c99d72cc0b6b9368cf9ba09024d42e1f547cd2b986c9153e2456d4145c59d7e5f6f993c7712a2432e607df6c6cd3ce15591f5c974ed291f5a34b05d5
-
Filesize
4.6MB
MD5526fa4ac8bb444c3f27cfee48c619b79
SHA1b6f9177c0cd8d6b439db928889d087f2865e2d47
SHA2567af26ea89ced69d157b0136058832a3761078afefa3728efe56fae08bfb5d49d
SHA5122760ff8f835315aa6e8131a52d6aa0962fb300670e78b169e8f66023d84dcb2537096a272c231aee885d3700946abf3799df6d4a66cf83e010e687c56246b6c9
-
Filesize
485KB
MD51da618896802fdb4b6f17c92703424f4
SHA1b48aa81ac014a5a7f6e95e618e4f951ee12d34c3
SHA2562cbf986b5e1357e00347d75d6f631539c0f368208079df36bb44603ac4e6973f
SHA512620a06d8df24597467318582a12bce45e2e2cb66069ffbd6fa27ac5a164c58398ddb9c2348e6ef443272a22ca85fcfa03439d0f0f22109a93708d562e0737cb6
-
Filesize
284B
MD5f1771b68f5f9b168b79ff59ae2daabe4
SHA10df6a835559f5c99670214a12700e7d8c28e5a42
SHA2569f8898ce35a47aeafced99ea0d17c33e73037bb2307c7688e50819966f4ae939
SHA512dae27d19727b89bec49398503baa6801640540355688dfabbe689c97545295c2c2d9b0f0dcd7cbc4cfbf701d0c0c3289e647a152f49ff242d1ecc741efe4145d
-
Filesize
32B
MD595af500a8d150fc9b9772cce7c06a1c5
SHA1f020ebb4d1bac4e01424ee38a08eece18a1cf55b
SHA2561deabb3a7910e9089723bf0a66f16867b345a41fcf160e05ab12a361a23c56bd
SHA5125a37f403e5e1422c7b3590830fd0343b8a4322acd36c50ad0f067879ad9fd5d6e08c74809203900c2c271006d636301ebdcd72065187b429c8ddca9106626c35
-
Filesize
340B
MD5dbbb91b01e3949578b10653966077acb
SHA10a703e855be46916c9f5168e1ec95b6ca3936d25
SHA256ef2e251bf83607a828b74af332ebe584f2b16301e282bbcc2306b42d4e80aa0c
SHA5123c9c6bdb902e92dcade2864146c350b15acf81bdee7d6cc1f7f823d54b95b4694e8f4e9cd41e7cb8d2440af534b68d0c3aee0394a47d84cf6a4363dd669619d5
-
Filesize
32B
MD5c4b93c239058a848123241d851ff5d8f
SHA164f821980f0743760110782f6f14bbd1dd57142f
SHA256816688713b1cb725cb61f3b508cb8d12c61a4fe3b0b6c6f8a54eaec842db116f
SHA51216ddc91df08c55f03ed5d22c1ff807b2abc92e5454e0df5fdc2d00fecbd5b007542374eb8d975d04165b629dc87c9af34e840af8df19c2d1e8d9c96dfafc006e
-
Filesize
73B
MD51218d9348a9a1e39d5d8ac780c253dc8
SHA1c08e3330da21b90d82480f5ab26f62363f83385e
SHA256f3e8aac8256c6b8eb4b17f0f5c77919d192490df9f3f4f60fe03d628f7a362d1
SHA5122a34872909a1a17fef22dfe2b266ba8231687557fe744e7e472d083451734fc3169789f0f7c2f62ed2b68d648a53c742d084f3d3ce640bfd12e101d01d2e8c48
-
Filesize
307B
MD5577d1964dbb43751869a55fc6586c478
SHA1ebb2a5f4edbde7bc1feedffe8c4e89343661958a
SHA256c407e2ee773a2260a3bdad0066cbe0cde944c9c6f4f9cbc323514d96b5f2c3e1
SHA5123a53c59fcc183ca9f6a598ac3f183550ec5bb7fb80ea00f98eba7aef02b9026c8a3e0d3bb5c54c02cb80ea5251acd63e518eb4a44277bf41dbf90470ebf6c509
-
Filesize
32B
MD5b528a4fa6fb866efa66a7c5715558c62
SHA10e0f9d662d2e272e44312b5a36bf2126838b14bb
SHA2569e93fba7e798d2395cef2c810eb6fc601b6af3a9f9c84bae0967392e558f8a97
SHA51206a5e8c3d0ad2923ad389128a0b9ea747bbf6489f424033b01c7eb24ade326e5495cc0684a6d07a4a3b24688a5710db87ba169686d7cacbb8708e2cb474c6566
-
Filesize
27B
MD58a8cfd7d7c98994d35605617a65bf355
SHA16a51536aabd8c5ea94804d2242f8b569eca9c023
SHA256caba23a1b137eaed202de206da1177cbfd36f38f44aac43f339144520a01ce85
SHA512040e2b9fa607e1ca3428b43f4bebd811c064e3a9eefc9c57be70ae1d58d60a27e98f8a5298103e6dca0e0466894f294d14ff78ba60eefa8749d9adf07ac77cfe
-
Filesize
48B
MD51d8d16c4e3b19ebf18988530d9b9a757
SHA1bc94c1cce05cd848a53271ecb9c5311e27ffebf5
SHA256abd87140da8de3d0aa39a24a8d52bfe7b2eb28f7a3d505f205471c7e8f4964d7
SHA5124562d1eedbc5c2dd7f25cd1c70343053fd451026403585182b142a64f17016c1bd0bf6ad51667b439b220e425640e55fbbda08517e7106376cdc220a4555da82
-
Filesize
32B
MD558da9871436fa4d60cba7417cb7a17cb
SHA1e31957285fedb23f96a643b6b00c1ba65c24469d
SHA256dbd2e555f57d4c054d888b9bf8242a1936f033e45f2203555f461a6b5de2290f
SHA512fe52ffe720233f407ddb87798461e9ce941312c6c4b29f9b65f8560f5fd2a05ae71301f5725c70a258850d0894dc19d0f463655b73b22d4085ec4e3215890225