12923114112d716d97b4f607022b1a2583fd05887675574d36c35cf601daa42a

Analysis

max time kernel
171s
max time network
179s
platform
android_x64
resource
android-x64-arm64-20240603-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240603-enlocale:en-usos:android-11-x64system
submitted
03/06/2024, 17:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9295262a0e02d3a15d15094d07068267_JaffaCakes118.apk
Size 2.9MB
Sample240603-vvxarsef65
SHA256 12923114112d716d97b4f607022b1a2583fd05887675574d36c35cf601daa42a
MD5 9295262a0e02d3a15d15094d07068267
SHA1 b6a97dfb2a9b1b6f5cf299e9bff17764cebe0976
SHA512 36f671312b77cc41d509bc34a06182667be280d2759a9a1695b3e35a29fe45ff7303084f854c082eac3d4d483e4018a9dd0161d78dd5e6ddc1832ea560593d94
SSDEEP 49152:znDwJhAJCFdGeTIl39fC23YmpNSnQTqbi3YpGP3/Pn4piSoWNxLhlUvApHL3pJXb:znDabjG9tfCeknfiwWXn4piSoW7LhlRF
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

banker collection credential_access discovery evasion impact

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.yht.jianfeishishijihuaruanjian03

Checks CPU information 2 TTPs 1 IoCs

Checks CPU information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.yht.jianfeishishijihuaruanjian03

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.yht.jianfeishishijihuaruanjian03

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.yht.jianfeishishijihuaruanjian03

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.yht.jianfeishishijihuaruanjian03
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.yht.jianfeishishijihuaruanjian03:mult

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.yht.jianfeishishijihuaruanjian03

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.yht.jianfeishishijihuaruanjian03

Checks if the internet connection is available 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.yht.jianfeishishijihuaruanjian03
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.yht.jianfeishishijihuaruanjian03:mult

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.yht.jianfeishishijihuaruanjian03

com.yht.jianfeishishijihuaruanjian03
1⤵
- Requests cell location
- Checks CPU information
- Checks memory information
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Queries information about the current nearby Wi-Fi networks
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4699

com.yht.jianfeishishijihuaruanjian03:mult
1⤵
- Queries information about running processes on the device
- Checks if the internet connection is available
PID:4744

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Execution Guardrails

T1627

Geofencing

T1627.001

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Location Tracking

T1430

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

__local_ap_info_cache.json

Path /data/user/0/com.yht.jianfeishishijihuaruanjian03/files/__local_ap_info_cache.json
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

__local_stat_cache.json

Path /data/user/0/com.yht.jianfeishishijihuaruanjian03/files/__local_stat_cache.json
Size 639B
SHA256 00fd8c89baa9497d60b35f518dbe1936b4a6372f03bb11edcc62586a3b1a9d53
MD5 369d555f943b1336d3346c33bd8af4bc
SHA1 2a666cd0f56cbbf0658a3d6d674dfac2ea92b260
SHA512 453ae6448f653d5b9b8cb8e32722db805e5898aa43c1495eaeefb157601c300e7076e9d286a49af52c68e821cf9759bfe33e3e651d97addf05dbdb4d2729ee75
MD5 SHA1 SHA512

Submit Download

__send_data_1717435163269

Path /data/user/0/com.yht.jianfeishishijihuaruanjian03/files/__send_data_1717435163269
Size 815B
SHA256 50667e5eb4fe2da408f40b8aba5e0fc832155b9a011f313abe1a5b0e5c822d93
MD5 126b801b5391fd68d046db37098e5166
SHA1 687a62233aae24a66e757c669b9429b3c60e269a
SHA512 2e7908e30041975242b5a0040b0f081453b35b15afcdeab02b7134a3f94f5c367c35893c02bea04292a4ad4fdf5e12679cf4ab85cb5b549a8c5cb3e8eeac69a0
MD5 SHA1 SHA512

Submit Download

jpush_stat_cache.json

Path /data/user/0/com.yht.jianfeishishijihuaruanjian03/files/jpush_stat_cache.json
Size 144B
SHA256 4abda64857047ad670c095b3856722c65d18749140388c3fea14dc03a5627b77
MD5 c1d7ebf012fe60237f46a1a514459a89
SHA1 419f4bd758e773056181a35888178c4d671fe0d4
SHA512 15753e2cf7b88aa382d3fb4abc9b28b53d748dee9c29fd7cd684a2e91bc9afb86a3a4eb25ab5cde95d47d609d52bac248efece551dabd880330b0ceaf57933e8
MD5 SHA1 SHA512

Submit Download

libcuid.so

Path /data/user/0/com.yht.jianfeishishijihuaruanjian03/files/libcuid.so
Size 109B
SHA256 60877c284b05e3bb90433a6bc8290afaf666c9d1299b6e96a72c7b7a366a8ec1
MD5 296dbb249867dfcd2196026fa53b3bab
SHA1 6737a80cee060a5c9a73f61d04cc547d5685ac21
SHA512 d2482cb94131e6657ce439eceadee5b966311e226840c590310b8a0d1961f85b40fab7104810ed259d965a6601d6468181083ca2e6b538ce51ea9698a78f50b6
MD5 SHA1 SHA512

Submit Download

.confd

Path /storage/emulated/0/backups/system/.confd
Size 20KB
SHA256 72d1e0672f5346f5904aaa5cb09085dc2b71bc594034760bce25fe973fccb80e
MD5 1c8872cc763afb2f791a9347e8dc895b
SHA1 92d9e156ea2640bdaf7e883cb8e4e11264e381ab
SHA512 58327074c8b6442221caf181c2f979714d98240c4a8e43ea41b10eb11f67d3941731ad0ac0a6edfe49f2fab2081f4e8cfbb22ffc2652648ecc594054c15d8e00
SSDEEP 12:TLyKPXDyNTSFbyNHUP9YERmBEyPbAVOwG:TLy2XuLwY/GSEG
MD5 SHA1 SHA512 SSDEEP

Submit Download

.confd

Path /storage/emulated/0/backups/system/.confd
Size 24KB
SHA256 03024cb648aea2f615db16ad719bb230e4f7ae7b54c47dac309089821c45fd28
MD5 915b14670a6e358714ac6afe9458360d
SHA1 a80bce9280db4aa28fa17f27bebdc9c1075ca964
SHA512 ca97b5a8f52446894d36feae7d8d3a76e0d361b914027705ee564ab7b4855faa7faac702ee3d1542a9c2c253cf60fc6e0c1fc517f998b1b92559c36a6170180a
SSDEEP 12:TLWemHWzkya9YurNTSFbyNHUP9YERmBEyPbD+:TLu28YuBLwY/GSK
MD5 SHA1 SHA512 SSDEEP

Submit Download

.confd

Path /storage/emulated/0/backups/system/.confd
Size 24KB
SHA256 322174a3a60ab144f2f688de439e410d7a513d8dacf7075cfa741aaf1820a647
MD5 4e7b22a9705f87cabaaacfb4db49d808
SHA1 5321fa2981b3a2744f57ff3bebfb3b853c223086
SHA512 f77cc3429d7180096ecf4faf90c8cf3843f39052279d8e9373f39116f5f98c09a7bda3c01fb7e4041e358cd7a8da43fa0d6069f720e12dff9d95b82f67391b3d
SSDEEP 24:TLv8YuBLwY/GSP/VOnlbIPVSAqe8cFepjCj2MtWPFU:TAXBLwpSP/ClbIPE6eNY2oWPFU
MD5 SHA1 SHA512 SSDEEP

Submit Download

.confd

Path /storage/emulated/0/backups/system/.confd
Size 24KB
SHA256 f88f7bb0db29432f02f0f1ad169fa9cbaf56efaa309b53c68d32fb984dd678af
MD5 cbc690a951988daa9ba397e876797c5c
SHA1 007b5c084a353b944f46251dc70208191b24079a
SHA512 3f129f2a4bfd361e491b85298fd9c590f7984ced319a55ef93bb4fb0a4f5c704301e3c8b2712dd3933f0e86d1c208b0a28215003291b43a7b294f00b5c5b5af1
SSDEEP 96:63BPLbmV1BGSI720UZWEKb5y4oXyQg6AJb76d2ri:65G9FIK0UZBmoXyh76dqi
MD5 SHA1 SHA512 SSDEEP

Submit Download

.confd

Path /storage/emulated/0/backups/system/.confd
Size 32KB
SHA256 5d2154f39432341d6da949b2f1bbab10025e8c47a65f1bd34954f27732bd258e
MD5 5e7c3704a7aea9f134bc2513581cc4e3
SHA1 f7586cd756ab33802529516b7433d9c326cbc3dc
SHA512 dec92ea6b107e2600f2d5a61ec78d6d05b01165503ab9d78e564fccbe5b164a12299e439898251aa4c7539b89fea60c6373fcc69a5936090dd83e192bb907620
SSDEEP 48:T515VXBLwpSTaO7AoeOPjfX1ibxqZcHPY:ntBL4MjfXGq
MD5 SHA1 SHA512 SSDEEP

Submit Download

.confd-journal

Path /storage/emulated/0/backups/system/.confd-journal
Size 512B
SHA256 2e9156435f54ce0413440d24e1ca1d4fe80d1c51a3160ec490a5d862b51ec816
MD5 7e235c911b5aaa938b8970b9fda8eb41
SHA1 2e6073e3d579671f2ad0dac10ae6cd69cc16363f
SHA512 43fe92fb626fffa207685fd98e409edaffc11ceae5451e7fa62f5bf90b0f41c3bff862d5dfa959667ce6b6a864338138486e9baa1296087aaabfe16dd1cf52ee
MD5 SHA1 SHA512

Submit Download

.confd-journal

Path /storage/emulated/0/backups/system/.confd-journal
Size 8KB
SHA256 dbd3ad1c320b581eb0f4a62e0002cd681b4323f867df5a1daa7da45719045042
MD5 6dee51b40888c06a4bb6f598ebedcb8b
SHA1 cf159cb5a63dd55707195149e34fcc00d0150687
SHA512 f3e805cfb14a99f14504183470efe5a84af53741f205659110da86bdd2ebdb23664c6779120a99b524c795c922802f719664a79e6fb81ed554d8e8a45a8dff8a
SSDEEP 6:7+/l9bHn1hWg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKt:7+t9+qLiuWdYRmBEyPbG
MD5 SHA1 SHA512 SSDEEP

Submit Download

.confd-journal

Path /storage/emulated/0/backups/system/.confd-journal
Size 4KB
SHA256 2336312abe289664bd11e0c61df7e0ed93df65f1256479fe329e84e93bff613e
MD5 8d0610982a10eb1644dcc9edcde99368
SHA1 c20466392f8751983975ea04fe8253c2932247d4
SHA512 4963b4c38cbbaa4f2f507b49f1858912b20096758e32b134c92594e1aae22f3700a708ffea95ee81841637e071c0c152f7f243d3cf988df1055316e9bcebccc1
SSDEEP 6:7+/lZVPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKo:7+tZRqLJdeWRmBEyPbP
MD5 SHA1 SHA512 SSDEEP

Submit Download

.confd-journal

Path /storage/emulated/0/backups/system/.confd-journal
Size 8KB
SHA256 bc0c511fc7bb0ef8d14326381d17eab3d99b82b39bf35f26460948c22bc51da5
MD5 3a68594fcf6c9fc375fcdcc4780558be
SHA1 540cd1c2a1c4a2c2d963e92683dbc2e8035470b6
SHA512 02c505b33afda4902883dfcc804fdea24b15ee98a77bf44baf5430296d5406bb586638ed5bb3a3765aaa0279f685305a83168146dd1c9091814b3b03ed6b71c5
SSDEEP 6:7+/l9cqFPg9bNFlqhO1r/kPlOERX4PBX4ogLugMBX4suuK+/t/s:7+tPBqLmqKRmBEyPb99s
MD5 SHA1 SHA512 SSDEEP

Submit Download

.confd-journal

Path /storage/emulated/0/backups/system/.confd-journal
Size 8KB
SHA256 3383708b27d875f726f13a5325b7c479148134af306b67629e1b30513d977d5e
MD5 faa67a46af684dafd1aaf532c3d8792f
SHA1 65b3e88d6c5f1ef962e764b3eb8e3581eedde281
SHA512 ea6c126ab36848e92e7ef72abb0831f420b74ff1f91da5cef75690529b50151b4d629d7442c32698738ca3ef331c594ea0982818f190d26a3942d8b61cc453b6
SSDEEP 12:7+tx6nqLyKPXDyNTSFbyNHUP9YERmBEyPb14y:7+tQqLy2XuLwY/GSD
MD5 SHA1 SHA512 SSDEEP

Submit Download

.confd-journal

Path /storage/emulated/0/backups/system/.confd-journal
Size 12KB
SHA256 4d5d92734c5eb3f9a3ce8760af0c173e50a12a8f2f0e2b77756ce7675f71295b
MD5 77b96c8fa607073318195605381f0042
SHA1 e62885d5122a1822210a95674cff71e87b7f8c54
SHA512 6b734e19ca1fa6a70ae85b796e230c57bb44c2e6735e099f03330c1f5d26abdbfee32e7229d659b14e190209c1efd17b91db0743cd23203e4be1c0a3ef6ddbbc
SSDEEP 12:7+t8NPbqLE4gFydBl9Ye42aqX9YIIkya9YurNTSFbyNHUP9YERmBEyPbc:7+tQDqLJfnYe5Y0YuBLwY/GSc
MD5 SHA1 SHA512 SSDEEP

Submit Download

.timestamp

Path /storage/emulated/0/backups/system/.timestamp
Size 25B
SHA256 c174d455233fb01cb85dd18c9577c05d694b9643fe544595c7305ae1b744815e
MD5 bf5b5cac63ca2776d04d1dd669e3e613
SHA1 4f3818b1053f505b9b1ac49be7023b8faf7b0268
SHA512 945492164cdfb2ff333b8a916573200c60ff5b8aee8f17ee2a85fa846a2084ca398ebff40d18346fef66721106468c9e01f195a32680768dcabbe2626994531e
MD5 SHA1 SHA512

Submit Download

.timestamp

Path /storage/emulated/0/backups/system/.timestamp
Size 55B
SHA256 983d40089f86a9eeb7cd37a5e49d1f0ff9dc19b7d9c2ca6b4b7f3519bd185983
MD5 81b0a34a97323eb98d1530238e61e6ad
SHA1 f837c1bf390e5ba8adf0b9d5cefffc9f9c81a202
SHA512 74124b21597e5dd46ecd7d39e85e83300f4f48ab739be0bb2075b633aef546e7e0b6089db27736d4726ff076e4c732c3a44c910c620da018c5b5b7d586866ddc
MD5 SHA1 SHA512

Submit Download

.timestamp

Path /storage/emulated/0/backups/system/.timestamp
Size 84B
SHA256 a81a81c006e5553a880b85d0ba9d034910b10af1ac5b3084897a7df6559e1b37
MD5 03dde1e11594eeea6e49e13fcaab08d9
SHA1 fd35adbff8443b306920dba7a64e9b98f6d92683
SHA512 732884167bc528b8ef0a351a34159ff435aebd103144789468d3864891a851311796c0bb8ea7b5aabaf200e96f07c04d17d8284a0112056298117188f056b67b
MD5 SHA1 SHA512

Submit Download

.timestamp

Path /storage/emulated/0/backups/system/.timestamp
Size 114B
SHA256 92ca3a206176476c0980b6f37cfe5b51a579463c8679d859747a2b69bc765ba6
MD5 5ee124779bcde56eba2370c3414a418e
SHA1 b71f131fd255b33da67ab149c674b9e6421df86d
SHA512 22dc1d57517c943e6fb8375464162b9e7d72cd5f58fe0bf31f09459db3d9ed638f9f8995b906ff218e83dea093c50c2aff41d9bfc6c3bb38fa143dded8ca2788
MD5 SHA1 SHA512

Submit Download

.timestamp

Path /storage/emulated/0/backups/system/.timestamp
Size 138B
SHA256 3c9fbc2b84fe3782c2f110393f8cc3866b056b59e2a21dc1db2793e1e0cb96ee
MD5 fbca23be5787218f6bc2952a3e0b3621
SHA1 fe30c3bb0ac65a2d8678949c16d2d885b26a5bef
SHA512 24a68b5273aa8f37a773517877d28170c457a47551eb014970607a8e58dc488328209f81a259991038c63cbc717cbc93799574286d1c536c5403d8843c696b8d
MD5 SHA1 SHA512

Submit Download

.push_deviceid

Path /storage/emulated/0/data/.push_deviceid
Size 32B
SHA256 9c6d70a98f7743750ad29cd2ef95dd382709013158ec6212daff0568ab8aa010
MD5 9f31f34aeccd1fcd53543f29a88438a8
SHA1 955b3cc744c889fc47e09149990cf03bc6e28c9a
SHA512 a7b59281a613c9962d7be62156d8f5313748c511d059b5fc8eaf6d4fd3618e5f428f3f9f0a15b39f3dde26ca807b1af3f8a6a35355bdccf86b939805ef5e295f
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads