Analysis

  • max time kernel
    4s
  • max time network
    131s
  • platform
    android_x86
  • resource
    android-x86-arm-20240603-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240603-enlocale:en-usos:android-9-x86system
  • submitted
    03/06/2024, 22:51

General

  • Target
    92e1f3226401d9b5fb3079024973c52a_JaffaCakes118.apk
  • Size 17.3MB
  • Sample240603-2s9lmsca4x
  • SHA256 65e5a777c01711befca5fc480ffab29e3773a6c7285caeabd3449c2b12c85536
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Signatures

  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Checks if the internet connection is available 1 TTPs 1 IoCs
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

Processes

  • com.tszunxiang.qile
    1⤵
    • Checks CPU information
    • Queries information about running processes on the device
    • Queries information about the current Wi-Fi connection
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Listens for changes in the sensor environment (might be used to detect emulation)
    PID:4289

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        okgo.db

        • Path /data/data/com.tszunxiang.qile/databases/okgo.db
        • Size 4KB
        • SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
        • MD5 SHA1 SHA512

        okgo.db-journal

        • Path /data/data/com.tszunxiang.qile/databases/okgo.db-journal
        • Size 512B
        • SHA256 22d02d8f6010fa0d5f9e84f9c053f5ba76020f652c92ab6c4f299a144b4e10fb
        • MD5 SHA1 SHA512

        okgo.db-shm

        • Path /data/data/com.tszunxiang.qile/databases/okgo.db-shm
        • Size 28KB
        • SHA256 18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
        • MD5 SHA1 SHA512 SSDEEP

        okgo.db-wal

        • Path /data/data/com.tszunxiang.qile/databases/okgo.db-wal
        • Size 56KB
        • SHA256 7430b892fc4cd61cb8377152a30d9f6de5caf134e36c1549e9cf01db1cfea3bf
        • MD5 SHA1 SHA512 SSDEEP

        clientudid.dat

        • Path /storage/emulated/0/Android/data/com.snssdk.api/cache/clientudid.dat
        • Size 36B
        • SHA256 90f23cf1f5eb92c54bc40b5e32f54e23c3e0c64ea2ce172511c3d89faf39c389
        • MD5 SHA1 SHA512

        tbslog.txt

        • Path /storage/emulated/0/Android/data/com.tszunxiang.qile/files/tbslog/tbslog.txt
        • Size 543B
        • SHA256 d9f03393a5df3e2c1709a2fce3ce4d8c0f52fe0f590d911089519a468cf66111
        • MD5 SHA1 SHA512