Analysis
- max time kernel
4s - max time network
131s - platform
android_x86 - resource
android-x86-arm-20240603-en - resource tags
androidarch:armarch:x86image:android-x86-arm-20240603-enlocale:en-usos:android-9-x86system - submitted
03/06/2024, 22:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
92e1f3226401d9b5fb3079024973c52a_JaffaCakes118.apk
Resource
android-x86-arm-20240603-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
92e1f3226401d9b5fb3079024973c52a_JaffaCakes118.apk
Resource
android-x64-20240603-en
14 signatures
150 seconds
General
- Target 92e1f3226401d9b5fb3079024973c52a_JaffaCakes118.apk
- Size 17.3MB
- Sample240603-2s9lmsca4x
- SHA256 65e5a777c01711befca5fc480ffab29e3773a6c7285caeabd3449c2b12c85536
- MD5 92e1f3226401d9b5fb3079024973c52a
- SHA1 04a6bd1d76b9139b349a88ee666789b4d30fe45f
- SHA512 2ffb74d9b721385a41a4eddbeb9e6bbd4ddeb4ee2c9e401f9d132a2a458077329466b5ef943f44229975a61d11002e11bad082faa056ce38ca90a80a097851b3
- SSDEEP 393216:xPP/BRshjQJ994Nj6tGTyPpW5Nvqfp5mBZtwPv:RP/uw9OFUGCpWQ5eZtwPv
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
description ioc Process File opened for read /proc/cpuinfo com.tszunxiang.qile - Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
description ioc Process Framework service call android.app.IActivityManager.getRunningAppProcesses com.tszunxiang.qile - Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
description ioc Process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.tszunxiang.qile - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.tszunxiang.qile - Checks if the internet connection is available 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.tszunxiang.qile - Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
description ioc Process Framework API call android.hardware.SensorManager.registerListener com.tszunxiang.qile
Processes
-
com.tszunxiang.qile1⤵
- Checks CPU information
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Listens for changes in the sensor environment (might be used to detect emulation)
PID:4289
Network
MITRE ATT&CK Mobile v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.tszunxiang.qile/databases/okgo.db
- Size 4KB
- SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
- MD5 f2b4b0190b9f384ca885f0c8c9b14700
- SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
- SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
- MD5 SHA1 SHA512
- Path /data/data/com.tszunxiang.qile/databases/okgo.db-journal
- Size 512B
- SHA256 22d02d8f6010fa0d5f9e84f9c053f5ba76020f652c92ab6c4f299a144b4e10fb
- MD5 f2628481bccc52080c03fc6cc0d27761
- SHA1 8db5792de6596485a69910868ad6dc9c7583264b
- SHA512 efed83b8a6e37ecbd14264aec08bbb38e8fa3840cd4a22bcbd1064d11e34fc89ef57280ed493a033a047c941aa171e465881c690f3a560a8c1d84b7111d159c5
- MD5 SHA1 SHA512
- Path /data/data/com.tszunxiang.qile/databases/okgo.db-shm
- Size 28KB
- SHA256 18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
- MD5 cf845a781c107ec1346e849c9dd1b7e8
- SHA1 b44ccc7f7d519352422e59ee8b0bdbac881768a7
- SHA512 4802861ea06dc7fb85229a3c8f04e707a084f1ba516510c6f269821b33c8ee4ebf495258fe5bee4850668a5aac1a45f0edf51580da13b7ee160a29d067c67612
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
- Path /data/data/com.tszunxiang.qile/databases/okgo.db-wal
- Size 56KB
- SHA256 7430b892fc4cd61cb8377152a30d9f6de5caf134e36c1549e9cf01db1cfea3bf
- MD5 b095bbb54ef52ab9548b6463163f3585
- SHA1 c64aed9d191d5a73deb3777c41b7dec30c1b086f
- SHA512 61c967411ec0be8a25b54f1450bd02192030d715b78641c4d493f4293ed6f23bf9a01f73bef99df0e5e205bf3a41ae2affaeb2feb9a1a8b6c94fa8f36d862920
- SSDEEP 24:KKfsezyGSP/UvmLw5Wl0leGoTwufmcyZQk1TwufmU9COSgIU4pAXGSP/YB25:5sezNSP/UOLqWl9jyZQIhIU4A2SP/S
- MD5 SHA1 SHA512 SSDEEP
- Path /storage/emulated/0/Android/data/com.snssdk.api/cache/clientudid.dat
- Size 36B
- SHA256 90f23cf1f5eb92c54bc40b5e32f54e23c3e0c64ea2ce172511c3d89faf39c389
- MD5 b9f128e7cbc94b0927ccf4425279f941
- SHA1 6fb72c4795c751cc699ab3deabefabcffe6deaab
- SHA512 7d7b335783629f8aea137abc09f1ef1fcfa6fed3573c7a61db737a6d9ac8905807ff04ec518984f9297c19f013b9a85707aecaf3217694476c595b4fb80e7f5d
- MD5 SHA1 SHA512
- Path /storage/emulated/0/Android/data/com.tszunxiang.qile/files/tbslog/tbslog.txt
- Size 543B
- SHA256 d9f03393a5df3e2c1709a2fce3ce4d8c0f52fe0f590d911089519a468cf66111
- MD5 a34327df0af0b71cdad4d85974773253
- SHA1 01757489a5d4447eede7101e17524a486ba5a76b
- SHA512 fb7b442f546afa86f79480097dc41f3a2b194ed0cc3295e57bdd8b0380187ec8e0a0e0aba3d52120e8451f89e96b78f82b0b7b9bd7147a6e3596c0d94082bf17
- MD5 SHA1 SHA512