Overview

overview

7

Static

static

6

90b6eee861...18.apk

android-9-x86

7

bdxadsdk.apk

android-9-x86

bdxadsdk.apk

android-10-x64

bdxadsdk.apk

android-11-x64

gdtadv2.apk

android-9-x86

gdtadv2.apk

android-10-x64

gdtadv2.apk

android-11-x64

yap.apk

android-9-x86

yap.apk

android-10-x64

yap.apk

android-11-x64

Analysis

  • max time kernel
    177s
  • max time network
    182s
  • platform
    android_x86
  • resource
    android-x86-arm-20240514-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
  • submitted
    03/06/2024, 05:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    90b6eee861f365f727a35bcd787a6e10_JaffaCakes118.apk
  • Size 5.0MB
  • Sample240603-gdspcsef73
  • SHA256 823c292932584826ac0cb7e01c90c9fa498a1dae385e948f9d6e39f8deb6e0d3
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
discoveryevasionimpactpersistence

Malware Config

Signatures

  • Checks memory information 2 TTPs 28 IoCs

    Checks memory information which indicate if the system is an emulator.

    evasiondiscovery
  • Loads dropped Dex/Jar 1 TTPs 61 IoCs

    Runs executable file dropped to the device during analysis.

    evasion
  • Makes use of the framework's foreground persistence service 1 TTPs 2 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

    evasionpersistence
  • Queries information about running processes on the device 1 TTPs 31 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

    discovery
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

    discovery
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
    discovery
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 3 IoCs
    persistence
  • Checks if the internet connection is available 1 TTPs 29 IoCs
    discovery
  • Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
    discovery
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 28 IoCs
    impact

Processes

  • com.excelliance.dualaid:olle
    1⤵
    • Queries information about running processes on the device
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    PID:4295
  • com.excelliance.dualaid
    1⤵
    • Checks memory information
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4336
    • chmod 755 /data/user/0/com.excelliance.dualaid/.platformcache/kxqpplatform2.jar
      2⤵
        PID:4403
      • chmod 755 /data/user/0/com.excelliance.dualaid/.platformcache/main.jar
        2⤵
          PID:4416
        • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.excelliance.dualaid/.platformcache/main.jar --output-vdex-fd=53 --oat-fd=54 --oat-location=/data/user/0/com.excelliance.dualaid/.platformcache/oat/x86/main.odex --compiler-filter=quicken --class-loader-context=&
          2⤵
          • Loads dropped Dex/Jar
          PID:4440
        • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.excelliance.dualaid/.platformcache/kxqpplatform2.jar --output-vdex-fd=47 --oat-fd=48 --oat-location=/data/user/0/com.excelliance.dualaid/.platformcache/oat/x86/kxqpplatform2.odex --compiler-filter=quicken --class-loader-context=&
          2⤵
          • Loads dropped Dex/Jar
          PID:4467
      • com.excelliance.dualaid:smtcnt
        1⤵
        • Loads dropped Dex/Jar
        • Makes use of the framework's foreground persistence service
        • Queries information about running processes on the device
        PID:4543
        • /system/bin/sh -c ps
          2⤵
            PID:4728
          • ps
            2⤵
              PID:4728
          • com.excelliance.dualaid:lebian
            1⤵
            • Checks memory information
            • Loads dropped Dex/Jar
            • Queries information about running processes on the device
            • Checks if the internet connection is available
            • Uses Crypto APIs (Might try to encrypt user data)
            PID:4576
          • com.excelliance.dualaid:lbcore
            1⤵
            • Loads dropped Dex/Jar
            • Makes use of the framework's foreground persistence service
            • Queries information about running processes on the device
            • Queries information about the current Wi-Fi connection
            • Registers a broadcast receiver at runtime (usually for listening for system events)
            • Checks if the internet connection is available
            PID:4638
          • com.excelliance.dualaid:lebian
            1⤵
            • Checks memory information
            • Loads dropped Dex/Jar
            • Queries information about running processes on the device
            • Checks if the internet connection is available
            • Uses Crypto APIs (Might try to encrypt user data)
            PID:4863
          • com.excelliance.dualaid:lebian
            1⤵
            • Checks memory information
            • Loads dropped Dex/Jar
            • Queries information about running processes on the device
            • Checks if the internet connection is available
            • Uses Crypto APIs (Might try to encrypt user data)
            PID:5059
          • com.excelliance.dualaid:lebian
            1⤵
            • Checks memory information
            • Loads dropped Dex/Jar
            • Queries information about running processes on the device
            • Checks if the internet connection is available
            • Uses Crypto APIs (Might try to encrypt user data)
            PID:5111
          • com.excelliance.dualaid:lebian
            1⤵
            • Checks memory information
            • Loads dropped Dex/Jar
            • Queries information about running processes on the device
            • Checks if the internet connection is available
            • Uses Crypto APIs (Might try to encrypt user data)
            PID:5330
          • com.excelliance.dualaid:lebian
            1⤵
            • Checks memory information
            • Loads dropped Dex/Jar
            • Queries information about running processes on the device
            • Checks if the internet connection is available
            • Uses Crypto APIs (Might try to encrypt user data)
            PID:5688
          • com.excelliance.dualaid:lebian
            1⤵
            • Checks memory information
            • Loads dropped Dex/Jar
            • Queries information about running processes on the device
            • Checks if the internet connection is available
            • Uses Crypto APIs (Might try to encrypt user data)
            PID:5730
          • com.excelliance.dualaid:lebian
            1⤵
            • Checks memory information
            • Loads dropped Dex/Jar
            • Queries information about running processes on the device
            • Checks if the internet connection is available
            • Uses Crypto APIs (Might try to encrypt user data)
            PID:5822
          • com.excelliance.dualaid:lebian
            1⤵
            • Checks memory information
            • Loads dropped Dex/Jar
            • Queries information about running processes on the device
            • Checks if the internet connection is available
            • Uses Crypto APIs (Might try to encrypt user data)
            PID:5867
          • com.excelliance.dualaid:lebian
            1⤵
            • Checks memory information
            • Loads dropped Dex/Jar
            • Queries information about running processes on the device
            • Checks if the internet connection is available
            • Uses Crypto APIs (Might try to encrypt user data)
            PID:5921
          • com.excelliance.dualaid:lebian
            1⤵
            • Checks memory information
            • Loads dropped Dex/Jar
            • Queries information about running processes on the device
            • Checks if the internet connection is available
            • Uses Crypto APIs (Might try to encrypt user data)
            PID:6018
          • com.excelliance.dualaid:lebian
            1⤵
            • Checks memory information
            • Loads dropped Dex/Jar
            • Queries information about running processes on the device
            • Checks if the internet connection is available
            • Uses Crypto APIs (Might try to encrypt user data)
            PID:6317
          • com.excelliance.dualaid:lebian
            1⤵
            • Checks memory information
            • Loads dropped Dex/Jar
            • Queries information about running processes on the device
            • Checks if the internet connection is available
            • Uses Crypto APIs (Might try to encrypt user data)
            PID:6362
          • com.excelliance.dualaid:lebian
            1⤵
            • Checks memory information
            • Loads dropped Dex/Jar
            • Queries information about running processes on the device
            • Checks if the internet connection is available
            • Uses Crypto APIs (Might try to encrypt user data)
            PID:6453
          • com.excelliance.dualaid:lebian
            1⤵
            • Checks memory information
            • Loads dropped Dex/Jar
            • Queries information about running processes on the device
            • Checks if the internet connection is available
            • Uses Crypto APIs (Might try to encrypt user data)
            PID:6750
          • com.excelliance.dualaid:lebian
            1⤵
            • Checks memory information
            • Loads dropped Dex/Jar
            • Queries information about running processes on the device
            • Checks if the internet connection is available
            • Uses Crypto APIs (Might try to encrypt user data)
            PID:6792
          • com.excelliance.dualaid:lebian
            1⤵
            • Checks memory information
            • Loads dropped Dex/Jar
            • Queries information about running processes on the device
            • Checks if the internet connection is available
            • Uses Crypto APIs (Might try to encrypt user data)
            PID:6886
          • com.excelliance.dualaid:lebian
            1⤵
            • Checks memory information
            • Loads dropped Dex/Jar
            • Queries information about running processes on the device
            • Checks if the internet connection is available
            • Uses Crypto APIs (Might try to encrypt user data)
            PID:7179
          • com.excelliance.dualaid:lebian
            1⤵
            • Checks memory information
            • Loads dropped Dex/Jar
            • Queries information about running processes on the device
            • Checks if the internet connection is available
            • Uses Crypto APIs (Might try to encrypt user data)
            PID:7233
          • com.excelliance.dualaid:lebian
            1⤵
            • Checks memory information
            • Loads dropped Dex/Jar
            • Queries information about running processes on the device
            • Checks if the internet connection is available
            • Uses Crypto APIs (Might try to encrypt user data)
            PID:7323
          • com.excelliance.dualaid:lebian
            1⤵
            • Checks memory information
            • Loads dropped Dex/Jar
            • Queries information about running processes on the device
            • Checks if the internet connection is available
            • Uses Crypto APIs (Might try to encrypt user data)
            PID:7614
          • com.excelliance.dualaid:lebian
            1⤵
            • Checks memory information
            • Loads dropped Dex/Jar
            • Queries information about running processes on the device
            • Checks if the internet connection is available
            • Uses Crypto APIs (Might try to encrypt user data)
            PID:7659
          • com.excelliance.dualaid:lebian
            1⤵
            • Checks memory information
            • Loads dropped Dex/Jar
            • Queries information about running processes on the device
            • Checks if the internet connection is available
            • Uses Crypto APIs (Might try to encrypt user data)
            PID:7749
          • com.excelliance.dualaid:lebian
            1⤵
            • Checks memory information
            • Loads dropped Dex/Jar
            • Queries information about running processes on the device
            • Checks if the internet connection is available
            • Uses Crypto APIs (Might try to encrypt user data)
            PID:7796
          • com.excelliance.dualaid:lebian
            1⤵
            • Checks memory information
            • Loads dropped Dex/Jar
            • Queries information about running processes on the device
            • Checks if the internet connection is available
            • Uses Crypto APIs (Might try to encrypt user data)
            PID:7838
          • com.excelliance.dualaid:lebian
            1⤵
            • Checks memory information
            • Loads dropped Dex/Jar
            • Queries information about running processes on the device
            • Checks if the internet connection is available
            • Uses Crypto APIs (Might try to encrypt user data)
            PID:7930
          • com.excelliance.dualaid:lebian
            1⤵
            • Checks memory information
            • Loads dropped Dex/Jar
            • Queries information about running processes on the device
            • Checks if the internet connection is available
            • Uses Crypto APIs (Might try to encrypt user data)
            PID:8121

          Network

                MITRE ATT&CK Mobile v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                kxqpplatform2.jar
                • Path /data/data/com.excelliance.dualaid/.platformcache/kxqpplatform2.jar
                • Size 1010KB
                • SHA256 b545a5b9cd95bc7f19168cc7142eb9aa5ebba2b8c077f23a1f594de64dbb3d49
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                libkxqpplatform.sinfo
                • Path /data/data/com.excelliance.dualaid/.platformcache/lib_kxqpplatform/libkxqpplatform.sinfo
                • Size 238B
                • SHA256 5bede343abdd4ba563f066ac909359089ec0bcedb3ad2b52af25e077ea764c49
                • MD5 SHA1 SHA512
                Submit Download

                airpushitemnew.db-journal
                • Path /data/data/com.excelliance.dualaid/databases/airpushitemnew.db-journal
                • Size 512B
                • SHA256 6da9769ef23feee9c2fe4148f8938a0306dba5b071fc0265c3dbbed3198a95a8
                • MD5 SHA1 SHA512
                Submit Download

                airpushitemnew.db-wal
                • Path /data/data/com.excelliance.dualaid/databases/airpushitemnew.db-wal
                • Size 32KB
                • SHA256 ff67d18474f74fe81bfd7ffd976535924a261ac18e38c9b172394c9415fbb9f6
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                lio_statistics.db
                • Path /data/data/com.excelliance.dualaid/databases/lio_statistics.db
                • Size 4KB
                • SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
                • MD5 SHA1 SHA512
                Submit Download

                lio_statistics.db-journal
                • Path /data/data/com.excelliance.dualaid/databases/lio_statistics.db-journal
                • Size 512B
                • SHA256 8fd63185109a1165772c8918a83b6f90e8402af689cad09ca1e9b6bf35428a1e
                • MD5 SHA1 SHA512
                Submit Download

                lio_statistics.db-shm
                • Path /data/data/com.excelliance.dualaid/databases/lio_statistics.db-shm
                • Size 28KB
                • SHA256 18619b678a5c207a971a0aa931604f48162e307c57ecdec450d5f095fe9f32c7
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                lio_statistics.db-wal
                • Path /data/data/com.excelliance.dualaid/databases/lio_statistics.db-wal
                • Size 88KB
                • SHA256 4b36e8f4889252da9823e6d2d83d8fb556397d36b12a20b271b07c81624f8538
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                lb_packages
                • Path /data/data/com.excelliance.dualaid/gameplugins/lb_packages
                • Size 252B
                • SHA256 d041845439f0abd1099676e99e2d23e6cd9807777136949c96257dd8df1b15a3
                • MD5 SHA1 SHA512
                Submit Download

                kxqpplatform2.jar
                • Path /data/user/0/com.excelliance.dualaid/.platformcache/kxqpplatform2.jar
                • Size 1.2MB
                • SHA256 cc6c7092ccab4a79ab44a307c9f658ab940434de2dfe4331c079a9d5ee02b5f6
                • MD5 SHA1 SHA512 SSDEEP
                Download

                kxqpplatform2.jar
                • Path /data/user/0/com.excelliance.dualaid/.platformcache/kxqpplatform2.jar
                • Size 1.2MB
                • SHA256 50a93fff3074814bac21d003a11bd25d08474d818533efea9d4164fd74a5960f
                • MD5 SHA1 SHA512 SSDEEP
                Download

                main.jar
                • Path /data/user/0/com.excelliance.dualaid/.platformcache/main.jar
                • Size 2.3MB
                • SHA256 48336f8fbb2e722262c9d7cf89b866149880d98dc65d279a94495064a1b7345a
                • MD5 SHA1 SHA512 SSDEEP
                Download

                main.jar
                • Path /data/user/0/com.excelliance.dualaid/.platformcache/main.jar
                • Size 2.3MB
                • SHA256 897fc1c8d9d82b42f886be83a838ca470e44d857362e8fb120070ea721c6fbc5
                • MD5 SHA1 SHA512 SSDEEP
                Download

                .idcard
                • Path /storage/emulated/0/.android/.systems/.idcard
                • Size 41B
                • SHA256 3d6be975eaf69124f1531293a86df51eb23d0159beb89104313cfac3429803d4
                • MD5 SHA1 SHA512
                Submit Download

                compVersion
                • Path /storage/emulated/0/.com.excelliance.dualaid/game_res/compVersion
                • Size 966KB
                • SHA256 68eb1d90a1ebb54408d3d33c1ed34a1482d03c6bee419c97f5c0428fe5f4f111
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                verinfo.cfg
                • Path /storage/emulated/0/.com.excelliance.dualaid/game_res/verinfo.cfg
                • Size 9KB
                • SHA256 1e8540fc4ea9b9ba1f3ae495b8d0c9e4ded10b2afea8fdbecbde28bdbdca93f5
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                verinfo.cfg
                • Path /storage/emulated/0/.com.excelliance.dualaid/game_res/verinfo.cfg
                • Size 82B
                • SHA256 91044e749d0f935fc226de42a992d650dd5c3afbce0114c581b3dc36d0e49751
                • MD5 SHA1 SHA512
                Submit Download