caaaa64ada842daa7569e6340ca622bd3c7a0f98dbb40cecaf32c8b76c5b8784

Analysis

max time kernel
9s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240603-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240603-enlocale:en-usos:android-11-x64system
submitted
03/06/2024, 17:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
92a5b7dfe613429608b70de1392fea90_JaffaCakes118.apk
Size 20.2MB
Sample240603-wavf4sfc22
SHA256 caaaa64ada842daa7569e6340ca622bd3c7a0f98dbb40cecaf32c8b76c5b8784
MD5 92a5b7dfe613429608b70de1392fea90
SHA1 285c89e3c81ff02e9666b562c01d9be2e64a24c1
SHA512 8c1eaff1c626c21226b84d2cdd2d8413fdfc106cdfa46de4dd699f47ec1e3c0cc02741b702119ec0c92be970abf567e668306e305f6703c428497a7cf8dd88ec
SSDEEP 393216:XsTnxVPnjkXnOLcx3HEWZ+QRdtKnEI8WQav0Wu:ixtnjkXnnx3HEdMtnau
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion impact

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 1 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	com.lp.merchant

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.lp.merchant

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/data/com.lp.merchant/mix.dex	4695	com.lp.merchant
/data/data/com.lp.merchant/mix.dex	4695	com.lp.merchant

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.lp.merchant

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.lp.merchant

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.lp.merchant

com.lp.merchant
1⤵
- Checks if the Android device is rooted.
- Checks memory information
- Loads dropped Dex/Jar
- Queries information about the current Wi-Fi connection
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4695

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

mix.dex

Path /data/data/com.lp.merchant/mix.dex
Size 292B
SHA256 4c76a3af64cdd2f8713ffe2733dea50dbe714d0ca41c17d1847ee5b62a7ca615
MD5 63f77f99bd2c2b772a479923bde11974
SHA1 c7632e7d301e4463fafce85f84e9c3d7da3fdbbe
SHA512 3aae4a89d1ed51fdd911cb367eb10afe3c2264e4222085891b18a60d5412f85d10bf5c8f3c6642db70abb9aa42732bac5c42c42ee32d587100f53c21b5beb16c
MD5 SHA1 SHA512

Submit Download

rqd_record.eup

Path /data/user/0/com.lp.merchant/app_bugly/rqd_record.eup
Size 352B
SHA256 b25208f7cd4d3702141aa136301fcd730c5da1f7df0f907dfe5610de65495bef
MD5 1ab5302f137c8ab22354962ce41dfc50
SHA1 297b24dbcb3255c7c70bcfc01043a1088795462a
SHA512 2529e46ed1d48ebcbbd73f7256401cda30a0e659b4780e6874229a8c8fad7ffbd5d101ad97705c0c9209ec0430c367983b38837e405ee15aa5cd821221a393f1
MD5 SHA1 SHA512

Submit Download

rqd_record.eup

Path /data/user/0/com.lp.merchant/app_bugly/rqd_record.eup
Size 1KB
SHA256 028ea5df6a1dc0560d57169cec2afac46c1f37ce7a81ea8c1b64cf66d7f8fd59
MD5 c296f5175d1b0f4ac2347a2e970a6535
SHA1 38841adc2b4abb65f8ea01a6eeeaca71510025f7
SHA512 940d428b9497caa96a260c5f01c5cd2c60c7f82179a8edbb6777eff29e60ea8ea457021e0cb05a7fae95726840986766d207efac375046e1317fdcdcd4e11c72
MD5 SHA1 SHA512

Submit Download

tomb_1717436636229.txt

Path /data/user/0/com.lp.merchant/app_bugly/tomb_1717436636229.txt
Size 23KB
SHA256 6b00a52fe9571a280f82eddbbc0f77dfa69e3226a641d29ce4d3e513502f172b
MD5 eb78c5c0a5bbf200b33f6882a75fb4ea
SHA1 e0cadde369a18924a0b029548ae8cf39e618758c
SHA512 f7c38d4a6dc4c3b3e2fbd0ebf301399c8e58d10fd90b1f19c036313237447befa3067c8e13da92f5a26d81ac5af43b5a1bd56b4101f12f8d84c66472540b1434
SSDEEP 192:wZkjva8chJXORGugFDzP90VXw0H1TMtUvOnjvDGAjeDpp5vp:8eAu4d0HtJvaCAkp
MD5 SHA1 SHA512 SSDEEP

Submit Download

tomb.zip

Path /data/user/0/com.lp.merchant/cache/tomb.zip
Size 4KB
SHA256 517af5a8fd27cb9dc89d38db464678a90b2f49ad6f4e1fb2353b5b28670803d6
MD5 d49b30bd8f9de68927ef981af3b5e707
SHA1 cb63e0fed9dedd853e07e8d4bc824bf71739d7c9
SHA512 b0a7f4cd2681ba8775d35e91711276583c579262a6579f60574afc3e628b4602cc7e81f018ba266b636e4a16a170a95949e5b794389bb4dd72514847aa72b183
SSDEEP 96:PHj3YR4jHNlo/TdFIvxoP8r6qaOFzSjhX7o4VH0yt+FQCJ:PDoR4jHpokmqaKGjhXs4G++FNJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu

Path /data/user/0/com.lp.merchant/databases/bugly_db_legu
Size 100KB
SHA256 b8c7264bb0cef85fac53b7f4ab219c903ebfa6530b41efec1b3694fe5841fe61
MD5 5e0d7400ee839955925a85b3ec055b9e
SHA1 fff34efa40f38752a236bd2b1e5fe0a6e598f18a
SHA512 48bc816678ce52ca9894bed164379a63ee8c84ac15a1c0b9c11c8a0afc41e658ecaf85295d869c163f0ddd1551c1ff271d94c441f3978042f3d6d72d9f415eac
SSDEEP 768:iuy4nTw2HcKericsnJizEJDwLxQrSVLzYWe1VanY6fcKericsnJizm04nTRcKerz:i
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/user/0/com.lp.merchant/databases/bugly_db_legu-journal
Size 12KB
SHA256 ae70740d787dd1caf7696b418dbf6ee55e6ae54634c79e54a273096e8343c1e5
MD5 7c7d41b381af0d6696c26ce5ff2a4e2e
SHA1 99fa446e07364fd8ec1fc8b4d10eb18d879d7701
SHA512 5291f47618672b5fe35354301a4e5f743b47e0b1d728c29311c6e90f39334ca630c35d78f1e5e2eb5adb35dbd8c43dba6a26ad9802068fc0bb13a96149a5b6e4
SSDEEP 48:7MhqyZfrQiw6uMg6/YBg72meposSYoXL0T:70b4m7no
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/user/0/com.lp.merchant/databases/bugly_db_legu-journal
Size 512B
SHA256 8f96d88d9e2ffa983be5639f8c5877575896edd105350c82059336f996b6689d
MD5 143062e466900ec2aff5f6edfcd7dc4e
SHA1 f36838bb54d98450e1b37f44945ae9712bd15b4f
SHA512 47ad12edbc702a4c1187661970d2e7b2799b06009cbb81e3deded6b2c2b8d52b745b7e3fbca2370fa1fc11faff4e4ea11e95003c34b14ad20d7c5cb3f2bead9a
MD5 SHA1 SHA512

Submit Download

bugly_db_legu-journal

Path /data/user/0/com.lp.merchant/databases/bugly_db_legu-journal
Size 8KB
SHA256 688348a9a0af1df97b403c7a3763d16a6c0630c43a8e23543cbfd38251318eee
MD5 96ee5f0684d7504bc5c91f2ac894be04
SHA1 7ec5d3f8979403635de35543f715461729afafb8
SHA512 164c5864cbc2404d805cc65cfcfae61694edabd46e6bb5d817a91685e4d552dd0ad72b31b16961a6df16203398f6e3f58571550261fbde2478139a6509610a62
SSDEEP 6:7+/l9ATGn1Evg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK44:7+tMqLiuWdYRmBEyPbi
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/user/0/com.lp.merchant/databases/bugly_db_legu-journal
Size 8KB
SHA256 f7c848b8544aa3c817d3a1ee72bbb8a9d74e4fb1682cd14fce1cf259d63cf125
MD5 e77ccf9ddf41bb7e19f6a0a1904988ed
SHA1 0d2e45a94b14b6ab88ec2a8bbfc6c9915877f9c1
SHA512 e6a04acf0dff00ccdf0949a0403b83d8f6d1026d61f59600e8d8408664fe0c3df61bde07811426444ea2a38c4808a56ac0cf13511125128f8c715b3c9022a51c
SSDEEP 6:7+/l9IHPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKse/z:7+tkqLJdeWRmBEyPbYz
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/user/0/com.lp.merchant/databases/bugly_db_legu-journal
Size 8KB
SHA256 e5e7ef27617a2bb81f5ed95b04dd92570501305eace953366966cde6929e1e09
MD5 9f7c39c071615531383c687ca04d5bae
SHA1 39a2766a6d81f90be7f1e08d56e1465b9fe6dd72
SHA512 2ec1b445c60457a1ad799215b305df080a5012794a6073a05c7e76d52e0609ea2d08d5ab53eabea9941ec892da1aa32fcaac5f05ff68d5576ea46bbe1ed53b4a
SSDEEP 24:7+tKyqLTtrrqqn26VnrQiVicXX+MgeRKkYBg72m/mpLwBpGS6:7M9qVZfrQiw6uMg6/YBg72meposS6
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_legu-journal

Path /data/user/0/com.lp.merchant/databases/bugly_db_legu-journal
Size 12KB
SHA256 bcbd1e9037c281e7901051e43e9eba454b37a4ef0f5c3f36f9347cd7ba3c9ff9
MD5 1b05de4db35906b1cc250467721d231f
SHA1 9242d5081fd9548796fa7b961ca17751f2519494
SHA512 f4277a736feef23e601c70e6735e58a4d85f449bd35b116ef64df72d1c8fb35b1bfb9fd43a7bb617f2f977fcbde3cc4b3b5ebbbc8101b204cd6a18d14292c72f
SSDEEP 24:7+tnqLMvtYrqqn26VnrQiVicXX+MgeRKkYBg72m/mpLwBpGSV:7MnqlZfrQiw6uMg6/YBg72meposSV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads