44d31901bfb2b5d8a020f45a480592ed8ff7288e21ea9ee586602e34097d7e46

Analysis

max time kernel
6s
max time network
131s
platform
android_x86
resource
android-x86-arm-20240514-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
submitted
03/06/2024, 10:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9186f1eaaa5a1d30ae9fc154310c3d38_JaffaCakes118.apk
Size 22.8MB
Sample240603-m2e13add53
SHA256 44d31901bfb2b5d8a020f45a480592ed8ff7288e21ea9ee586602e34097d7e46
MD5 9186f1eaaa5a1d30ae9fc154310c3d38
SHA1 7f21df436b372a74f31960209aa8f91df9d6f40f
SHA512 7ae20874ae951c7a56d30aa136e7ed8041d8a6391d367c32d383fd31daff32cc10380eb8a7f5cd6e2dfc1d04bb4226e31c394da32a1ed00d73a5030f6aaa153a
SSDEEP 393216:nzIfT+VK8Wu+rh9uF9HKP6ynPaROUBO5T/AtAXolmYmpg8F15mIHAAEyY:nzIC0pV789APCObT/AtSooVgwWX
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery evasion impact persistence

Malware Config

Signatures

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.tencent.tmgp.HolyCowHD.cn

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.tencent.tmgp.HolyCowHD.cn/app_dex/ysdk_hackdex.jar	4564	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tencent.tmgp.HolyCowHD.cn/app_dex/ysdk_hackdex.jar --output-vdex-fd=73 --oat-fd=74 --oat-location=/data/user/0/com.tencent.tmgp.HolyCowHD.cn/app_dex/oat/x86/ysdk_hackdex.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.tencent.tmgp.HolyCowHD.cn/app_dex/ysdk_hackdex.jar	4303	com.tencent.tmgp.HolyCowHD.cn

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.tencent.tmgp.HolyCowHD.cn

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.tencent.tmgp.HolyCowHD.cn

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.tencent.tmgp.HolyCowHD.cn

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.tencent.tmgp.HolyCowHD.cn

com.tencent.tmgp.HolyCowHD.cn
1⤵
- Checks CPU information
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4303
- cat /sys/class/net/wlan0/address
  2⤵
  PID:4430
- cat /sys/class/net/wlan0/address
  2⤵
  PID:4450
- cat /sys/class/net/wlan0/address
  2⤵
  PID:4504
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.tencent.tmgp.HolyCowHD.cn/app_dex/ysdk_hackdex.jar --output-vdex-fd=73 --oat-fd=74 --oat-location=/data/user/0/com.tencent.tmgp.HolyCowHD.cn/app_dex/oat/x86/ysdk_hackdex.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4564

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

ysdk_hackdex.jar

Path /data/data/com.tencent.tmgp.HolyCowHD.cn/app_dex/ysdk_hackdex.jar
Size 1KB
SHA256 1f88fdf320cae29d1fd7c639b09ce4d4b468e349cd8bc71376d7c928ffa66f6a
MD5 d428e23060b3b30cd1926a33a17f96a4
SHA1 37eb661405ebe0cad99e83ed625cf2bc2e1ae612
SHA512 daac098768844f55ee1528f40b334b50928ad1862b948a5c942338a36c7cfd947356bbe605bd554e9ac85c00f6a39022c30374625311ce17c36734e291daf2db
MD5 SHA1 SHA512

Submit Download

MessageStore.db

Path /data/data/com.tencent.tmgp.HolyCowHD.cn/databases/MessageStore.db
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

MessageStore.db-journal

Path /data/data/com.tencent.tmgp.HolyCowHD.cn/databases/MessageStore.db-journal
Size 512B
SHA256 d2ad674e17b119f9595a2d0320f418da17913240e5f044324f5e2c9b7b4b371f
MD5 b5478411f523b92036f08c7b78e2d475
SHA1 688244243fbda85090498218582e0066410a3612
SHA512 9c038d360fec6d03c1af4ca0e50562473fe44ad8330546556ec42a18a477c6e8f98a8b5c4dd39894a853b2d75071c190a0252ecc59f44bbb248960ae949c3a8d
MD5 SHA1 SHA512

Submit Download

MessageStore.db-shm

Path /data/data/com.tencent.tmgp.HolyCowHD.cn/databases/MessageStore.db-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

MessageStore.db-wal

Path /data/data/com.tencent.tmgp.HolyCowHD.cn/databases/MessageStore.db-wal
Size 48KB
SHA256 eb016a5b3b60e8e2d5bfe44e2c29079e4327160c980a31dbd4f5665ae8dbe655
MD5 26981423d7333eac576c4024cd513f52
SHA1 5649582084491600e98cda2a664e07e50a6983fa
SHA512 169bf290f001f3db9404d6ca92251590e261f6bd46643c2b3b0492f933c7305fecd6dacb4f4e69cdb9ffaa69b299b8375b5873ab1260a517c14bf68530103d70
SSDEEP 24:KfOXzyGSP/0EqHwMpZM6PzmD6ZW/elJy2M0yAN9GSP/jfZdiXrf:6YzNSP/0EenM3d2M0yIoSP/ddiX
MD5 SHA1 SHA512 SSDEEP

Submit Download

MsgLogStore.db-journal

Path /data/data/com.tencent.tmgp.HolyCowHD.cn/databases/MsgLogStore.db-journal
Size 512B
SHA256 527b05fc24bee1d55e8a505b0686c22156ab781b6056420c98e6cbde82331018
MD5 708b0a5a798e6fd7f58509238d4bcea6
SHA1 c2f37e52358344972dc5ea6e002ef763cae24498
SHA512 204325020def5aa491c01e6c6e5143ca245178004bd9cccadad07991fbbacfc882c6a5b43681e3210acefd5f296a5b59fc1ae01c9e934561ea382a165476196c
MD5 SHA1 SHA512

Submit Download

MsgLogStore.db-wal

Path /data/data/com.tencent.tmgp.HolyCowHD.cn/databases/MsgLogStore.db-wal
Size 60KB
SHA256 211610921064962899582706b2d4b318b1e7ac56105f8d5c573ea64e9fa84b78
MD5 821f6fea3d281721f7cdcbafaa530982
SHA1 1aed315bfa72dd4990b88458a53fcbe958fb3194
SHA512 891a109d1377814199c013c474aec6e3bec8ea8e9b6de01a808c99663cf84ea2373339a576529ec2e50a2c6efe3f6439610768400fa13d3a572667635611739e
SSDEEP 48:5VzNSP/Vcm070OCJfhF8GIUWZwbSP/1ZM:5R0Pt+0OdP9
MD5 SHA1 SHA512 SSDEEP

Submit Download

accs.db-journal

Path /data/data/com.tencent.tmgp.HolyCowHD.cn/databases/accs.db-journal
Size 512B
SHA256 8b5dbea7678c05ded5c39273e1de70c4d93e9b199a83494ce15ded2bacec4006
MD5 8ed5393d3dc2ced52cb05686e50e8058
SHA1 b45aabb0e4a81cea073fff22c43a145d5e2b5b88
SHA512 633c6a60250ce904270094b7fbe2ffd196c54e05a2fa3c64f1ec3556e3a13848cf8a9b91e3e35b54dd9bba82252a2093a9fd3d37d4a0a8441e4b747b55981abc
MD5 SHA1 SHA512

Submit Download

accs.db-wal

Path /data/data/com.tencent.tmgp.HolyCowHD.cn/databases/accs.db-wal
Size 32KB
SHA256 33c218d373bebc2ef4ab5d4ee21c9b1243804503e9e2bb70c486212bde6f0f88
MD5 db82b2d8c6bdf83756ac705c1511be70
SHA1 cbdfbc71cac2ec224078d58b79a87dbec965cd23
SHA512 cd80004b28dd65133a7c0151c2c9b0fa995243b3b24a2b2421c777f60367e03c578e9fb037eee65c0e04580bb4b5e5c036b4781fd47dc81ea92fe13632ec1479
SSDEEP 12:KFX9XzdTRmBEyPbP/71VOwClTTqDV//UyNTSFbyBh43R90Ef7c7VDERmBEyPbP/5:KLzyGSP/ZRdDBBqj0W7yVD/GSP/k
MD5 SHA1 SHA512 SSDEEP

Submit Download

ysdk_hackdex.jar

Path /data/user/0/com.tencent.tmgp.HolyCowHD.cn/app_dex/ysdk_hackdex.jar
Size 436B
SHA256 4d28cee7bd9454d59664193f54185a90349e8ae9300a5b601266dd0d1fdd641f
MD5 557e34701d1eda281061d8a640d19916
SHA1 b1c811b27e0b84913979178a74b4d60d6ae1a20d
SHA512 36fdf0eb413880753205b2595dc4d3a381e0e8051d2db5502ea1559cd54a35d1b5178eb40c3ff4e3baed20b9d62b1762315b65e8b854441440a3faeeb9fd6914
MD5 SHA1 SHA512

Download

ysdk_hackdex.jar

Path /data/user/0/com.tencent.tmgp.HolyCowHD.cn/app_dex/ysdk_hackdex.jar
Size 436B
SHA256 f77c4b20ed10a4c168f723d502fb277391a2fa8ac9d189a4085928609b551acb
MD5 9b20e11634237a1f000b7afb886dadfd
SHA1 004892c488dd2bacf9309dc19497364571804181
SHA512 3d23490c2dcd16f998d7665208efb7a5dad0ec3c6755f06a5885197cb4d3fd3ec49ba4db16a841057abadc7f25533f1edd5b598a2419e4fea2a57c5fb76cdbd6
MD5 SHA1 SHA512

Download

ContextData.xml

Path /storage/emulated/0/.DataStorage/ContextData.xml
Size 111B
SHA256 27a8f1b2213628bac6867e2f7d1db8f448e6118fcd79c59cb5af0471987ee982
MD5 08dd37a6d319367325b79f508ad61d32
SHA1 7dc557c35b7e0c671e144831851d18d41374c315
SHA512 99f21b761af651a0820806ccb7e17d428673cb65608277f75d986cfdf63fd1943aef71da184d3c09148be40ea375db6801d38832e84a66d9a67a82611e87fc81
MD5 SHA1 SHA512

Submit Download

Alvin2.xml

Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Size 111B
SHA256 7bd8c30241b77b5327ccf4dd1bbed3fab939fadfd8a2676a14bee5408113b637
MD5 3e7925bb6ffff2917f0ac8b5fef5fd85
SHA1 813a1090cb7189caf3ce481b9455e87c34ec9dcf
SHA512 4441c59def97d479c0368e9e43be547093cdb55dcf3ed650afc15e024ec44d19715c43ac135fa66a6eb984a080360bf9064d9b46313a10c4e6460b1981d96604
MD5 SHA1 SHA512

Submit Download

Alvin2.xml

Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Size 167B
SHA256 64a4dbcf0028888b554ada4a4b0f5b193b79901f39700da6b426d170a04db0d2
MD5 d81c51524dffa3c58181265f03b481cc
SHA1 3ec607261c810d8dc14d14f93df04293ef2250b8
SHA512 dead812bffa63cf50eb8cc20cb4ec009e5e0e363df03d6328197598901ff3ce95b37c76fd2bf0e54ccc8e8c77f6011a543d8d836e3ac5210a951a12da6c7d26d
MD5 SHA1 SHA512

Submit Download

Alvin2.xml

Path /storage/emulated/0/.UTSystemConfig/Global/Alvin2.xml
Size 65B
SHA256 3325d2a819fdd8062c2cdc48a09b995c9b012915bcdf88b1cf9742a7f057c793
MD5 9781ca003f10f8d0c9c1945b63fdca7f
SHA1 4156cf5dc8d71dbab734d25e5e1598b37a5456f4
SHA512 25a9877e274e0e9df29811825bd4f680fa0bf0ae6219527e4f1dcd17d0995d28b2926192d961a06ee5bef2eed73b3f38ec4ffdd0a1cda7ff2a10dc5711ffdf03
MD5 SHA1 SHA512

Submit Download

inapp_20240603.log

Path /storage/emulated/0/Android/data/com.tencent.tmgp.HolyCowHD.cn/files/tnetlogs/inapp_20240603.log
Size 544B
SHA256 46e1a0ae2fe346708ed2b57708979c93c1b47d95c663f04cb95f5d846c4e22f3
MD5 13e7107c5f2c9e3b2b2e0fb5640a9210
SHA1 89879caf98b155f9775dcfb94aa964107b8b72b9
SHA512 356e9fac4544dfcf6110d0a165cc23fca38a805b4d9a7212d07a7a35c767ea98c986cbad68170d26a5bd71da80c6e1c306829a5351c74a568ce9a22f36dc2ed4
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads