b428859ef10f275e72bdf6095fd77f24f73ad4de1d88b6bcca395c3c7672e551

Analysis

max time kernel
178s
max time network
186s
platform
android_x64
resource
android-33-x64-arm64-20240603-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240603-enlocale:en-usos:android-13-x64system
submitted
04/06/2024, 21:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9662206ad98bc814c11ebfc22627ce12_JaffaCakes118.apk
Size 6.4MB
Sample240604-1q8e5ade59
SHA256 b428859ef10f275e72bdf6095fd77f24f73ad4de1d88b6bcca395c3c7672e551
MD5 9662206ad98bc814c11ebfc22627ce12
SHA1 f91dc4e4681205c2c501a8d590d4c182ac091013
SHA512 23b6f12cf2dc77cae142bb52c0c1baeacd519d0777545881f28154eb09c0b32ab25a7b4d923983d7da0dc702566f39b7323b0ef894b6e99e4cae02c6baf5a320
SSDEEP 196608:UGc+ZBz6YQPYVvutCLXL8IoFTujfrp0GBd:Uh+36YlutOdocplBd
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

banker collection credential_access discovery evasion impact

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.shenl.qinqinmh

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.shenl.qinqinmh
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.shenl.qinqinmh:remote

Queries information about active data network 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.shenl.qinqinmh
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.shenl.qinqinmh:remote

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Checks the presence of a debugger
evasion

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.shenl.qinqinmh
Framework API call	javax.crypto.Cipher.doFinal	com.shenl.qinqinmh:remote

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.shenl.qinqinmh

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.shenl.qinqinmh

com.shenl.qinqinmh
1⤵
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
PID:4230

com.shenl.qinqinmh:remote
1⤵
- Queries information about running processes on the device
- Queries information about active data network
- Uses Crypto APIs (Might try to encrypt user data)
PID:4421

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

sinmh.db

Path /data/user/0/com.shenl.qinqinmh/databases/sinmh.db
Size 13KB
SHA256 c278e8533c67c471278bbf7293fd300b92088f2bfed3fbf89fb0f657f5d6b274
MD5 627bd158992b0cf137ae4d5d145f8abf
SHA1 305ea9b960ee704da9cf22bc8680298b4c50808f
SHA512 c610dd9b6e855bdbefc864f978d819c6760f7b736404e4b4907e93264e4fb2f745e8f844490216390e339881b533724f2b7ed4303560f77ac18ca2d261aba45e
SSDEEP 96:gHkOKi9YzO2xvOKi9YzbvOKAFjUczQJWdPlOzQ:gHkOKi6zjvOKi6zDOKAFj7Qc9lOzQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

sinmh.db-journal

Path /data/user/0/com.shenl.qinqinmh/databases/sinmh.db-journal
Size 512B
SHA256 a14542514940d5022df964c20db79a1aa56fede58f2e3fcc3f96f1271fabca7b
MD5 4d88c228c964427240b1c5b5749b9a1c
SHA1 867d6539c7093a9987dcaa2bf4b321a9e12892b0
SHA512 ee6e98a9e800ad2f9ee7ef2a611e9229558bd32a13b57a6e79f645849a785f8db6a97ae16cc82af4cd1258224f948d499f6c0e99b470a3151634180776211543
MD5 SHA1 SHA512

Submit Download

sinmh.db-journal

Path /data/user/0/com.shenl.qinqinmh/databases/sinmh.db-journal
Size 3KB
SHA256 e540773ea14f293700a9ef5b80e7b9f3a24198fc7c0aa9a4f8a97f8893f39ac9
MD5 aa4839dbcb930c0c80c4ae64af3dd7d5
SHA1 99e90fa7df86c30a31fa4ecd41b7003724750450
SHA512 88ad7bc12dba15da7d2da09876ec265036ba38218f6b1285fda863614317c7619332d48f6c850d2e3427fb897b616ccb5dc713b54e6848764649ce8f8f47bb01
MD5 SHA1 SHA512

Submit Download

sinmh.db-journal

Path /data/user/0/com.shenl.qinqinmh/databases/sinmh.db-journal
Size 2KB
SHA256 9a345f669be66b35a7acf25cf2a85b962128bb39e99ec257f4f15fd445a3f179
MD5 efe4478406a6e31c4b741e07d0d72c05
SHA1 c12d0a1415c05cb8a63906b64e2210f80aea11a9
SHA512 ee5d137d4cba6bf493736a9564d425d473b627ad704c926f80553cfa1e1d6a4cc3c9d7625f75c824f4d240bbb22cf0d6a6e51d4512c777412ce3e61290bf3fe7
MD5 SHA1 SHA512

Submit Download

sinmh.db-journal

Path /data/user/0/com.shenl.qinqinmh/databases/sinmh.db-journal
Size 2KB
SHA256 d41da67e4cefea5cb6065202b78aa573432f72bca2400d567c6f54b41e32cb40
MD5 3041d4a74d1c54d11433443d3e7a8cd8
SHA1 926dd68269c51b6bc41a008a45e0aae416e6bcec
SHA512 87e0a3e6411dc9cd46ab0fbaf7d6fdf1da4919beccf3f7cbbe869f0f20880d5617ed8f8f54b8ad08d13f7bce7b94b44ac295bbbbd7ac4359566f5819c252e68e
MD5 SHA1 SHA512

Submit Download

libcuid.so

Path /data/user/0/com.shenl.qinqinmh/files/libcuid.so
Size 109B
SHA256 d2f465bd5fbf41656fe1f6f1c5349c160b27f47db257914ab2708c0f7901022f
MD5 d02bcee7aa71ecdc7a6be3069e49558a
SHA1 e604b15fd6c308dc75aa39709ff287bc9e830b52
SHA512 90e7f90f06bc844029829ad23299e5148e62d64b0227a1261d11f084c6f37d2120bef134b3a8f8be961960f9b20768af18d4d7d85bc898f540c049d35cc3572d
MD5 SHA1 SHA512

Submit Download

.confd

Path /storage/emulated/0/backups/system/.confd
Size 20KB
SHA256 452b98f7a5ab103891d119c75b2158a53a8a5a86295d5a39d094c3e05c2c4f68
MD5 0ddc066dd1b65ec4fb584cbb35408dd1
SHA1 4c3d4dec74adbf2143b4295f9d647f18aa4e1aaf
SHA512 405e0e741bfd1f917b3feed83bd53d3e77f48076ca98b9eb76e47736c6d3168486291b365d122e3f4809fe3a251499831b0b87e03d9470578b771984cce658fe
SSDEEP 12:TLyKYDyNTSFbyNHUP9YERmBEyPbAVOwG:TLybuLwY/GSEG
MD5 SHA1 SHA512 SSDEEP

Submit Download

.confd

Path /storage/emulated/0/backups/system/.confd
Size 24KB
SHA256 a0a652236d75cd002f8850de2252f8fbc831e43b2da917dc5cdd4451890236bc
MD5 30803013c74755b2a79810d47c2bb9d8
SHA1 81c38079f8509e3479b4dd989614b3212504f7f4
SHA512 b8fad74833377afeed60fdf1df17de32b8d8db6366f04ecb6930c2a1957573f8f8938a27261d564b1babf5f55fe3cfc539ae15c6e6ce0e3f18e358accadecc78
SSDEEP 12:TLWeB5Wzkya9YurNTSFbyNHUP9YERmBEyPbD+:TLZI8YuBLwY/GSK
MD5 SHA1 SHA512 SSDEEP

Submit Download

.confd

Path /storage/emulated/0/backups/system/.confd
Size 24KB
SHA256 c64dddcd61f4834126df20f4908b5529cbf50b16a15f1d6e293722043176f61e
MD5 36e48fb4a5bfbbc23fc751eef0b3334a
SHA1 b868a9aba455db4b88540218e46c07045b8e5279
SHA512 72849959e836d2f4edbe78753e6201a2db8c0a371d054bf6119fc2ee2124d3ec7a12c48b99c1d9e9fbd3e6254e31cb6ebb68c2b759cd9a83b0fa7bff3d8456fc
SSDEEP 24:TLS8YuBLwY/GSP/VMKhZD6NoxHPtA35pfKU:TFXBLwpSP/v6altspiU
MD5 SHA1 SHA512 SSDEEP

Submit Download

.confd

Path /storage/emulated/0/backups/system/.confd
Size 32KB
SHA256 6ed2b2a20c182a8a4b0bc40aa9b98707878c68a96ad4e79765772b5d8a4e74e0
MD5 7f7f8dfebb47669a2cb5c2811fb589cd
SHA1 8a59107e9425754068d98572e9b5a717907261b6
SHA512 7322dcfa0bb90a204886c7c34ded7acf5f3c0538fc681e47f6c39c61543b946bc61ee02f8a11bfaf60e8e5c82d4d7379e9056a003d38abdfa59e1c546b1f507d
SSDEEP 96:5BadnZsoU4CvMlZfTQhe5frs+rBhdGIsJnYZfITCv1SrqKRPD:GDsoU4CW0heO+dDGIbNQ1RPD
MD5 SHA1 SHA512 SSDEEP

Submit Download

.confd

Path /storage/emulated/0/backups/system/.confd
Size 40KB
SHA256 daba3ab5efaaa89bf0723a8f30c25f434012054aee5b7cfbf8570f1dd7b6d365
MD5 49cac5f58938dc9890286f76123b2e78
SHA1 69c4fe297514eb08c30ff7398d67f4f57ab74957
SHA512 578e934fbd1bb8a4cc734108d975cb6f42e940f1a9eb20d755942b03d017c46a2c130886f545771c99bba54578a98c6babebb700f308bbc137598e1bf837bcb1
SSDEEP 192:o3Ut9v8Oe65Q1nDsoU4CW0heO+dDGIbNQ1RPD:NtbiaheHDBNuD
MD5 SHA1 SHA512 SSDEEP

Submit Download

.confd-journal

Path /storage/emulated/0/backups/system/.confd-journal
Size 512B
SHA256 016801a75a2edb38a8d70f7b68262b870eadd4c7584df6af69f5a663e2319273
MD5 d46f0f34917772e508e6af76dcaf872c
SHA1 468486c23e7862b79c68d9938a0e75538334b18d
SHA512 222884719d6b6efc75e198b3f6dc3113cb9fe5e937770654b6273b90322d36f414db0995184a7b6fcf60b5973bd5a743df9005d6acc16b711f65926d23e72468
MD5 SHA1 SHA512

Submit Download

.confd-journal

Path /storage/emulated/0/backups/system/.confd-journal
Size 8KB
SHA256 5ecc38f4419aa1e51f2ff99066aa6c90cc36ecf0580a06bf10078a639a484eda
MD5 ca63dbb0023103198bd783245cbbfb42
SHA1 9296c431a4a3bd3472081e51db62440f6520be76
SHA512 7a90eb4a68ca965f707a9bbd5f36c27e58aa5ab1406a13259ccb09ba52e9cf9ceeadf8b6aaec9e493247ba207e5fb922128d9b11f518fed6fd305b15b73da0c3
SSDEEP 6:7+/l9XGFn1k2Lg9bNFlEuWdOAlOERX4PBX4ogLugMBX4suuKI:7+tVGAGqLiuWd7RmBEyPbz
MD5 SHA1 SHA512 SSDEEP

Submit Download

.confd-journal

Path /storage/emulated/0/backups/system/.confd-journal
Size 4KB
SHA256 e205be91c745a1f88af31a92e6e6c5e9e1f42167fbfa9e439da1f3ccdf76d8cc
MD5 0892438069bf657b50b71112f723348a
SHA1 1c56001c97be0868caa6d817aee613501a7cd590
SHA512 9438d9b5a31eafbd40c9e1f8852321bcc0053cb7307e5c1bf4ece9e67c8d6be54a5469d662362df9cdb01a5c90748974886ff3eb8dbc3fd5e65e207b9a10b0fb
SSDEEP 6:7+/lH1gPg9bNFlLdKEAlOERX4PBX4ogLugMBX4suuKDn:7+tHKqLJdKBRmBEyPbQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

.confd-journal

Path /storage/emulated/0/backups/system/.confd-journal
Size 8KB
SHA256 e979ba1d54acd3de0a9c44444d184849c3211da2a144076bc7222c24abe531cd
MD5 82e7bb2fefa954a023b19af4a70bf1f4
SHA1 51a180962cb6b57913d24546bc092935ed00cddb
SHA512 264aa224915ae37bad3469d32491f1d1b4bc9f7f9676aea9794e801d127a61db6f0f211fc0870ed0f58f708735c71aa32e618f54073b523b5661381d58d5081f
SSDEEP 6:7+/l98vgPg9bNFlqhO1oAlOERX4PBX4ogLugMBX4suuKxM/q:7+tLqLmq9RmBEyPbVq
MD5 SHA1 SHA512 SSDEEP

Submit Download

.confd-journal

Path /storage/emulated/0/backups/system/.confd-journal
Size 8KB
SHA256 81c7d57fe191d1fd72d91c195cefb13aaa603835063b6a6a761b53191b3cfc90
MD5 be769cb14013bab158c687d6319b8bf3
SHA1 37274dcf120df8bc7de354a26944f9c46685c398
SHA512 b0212fd66238ac435cb40278da4a5d8264ee79a921ccbedbb9525e04b4c32d8d0d0d170088152c777ebfe6c66bcd7d33e251130e58d97561f2a48efd7fe9ccf7
SSDEEP 12:7+tHnqLyKYDyNTSFbyNHUP9YERmBEyPbNJE:7+tHqLybuLwY/GSN2
MD5 SHA1 SHA512 SSDEEP

Submit Download

.confd-journal

Path /storage/emulated/0/backups/system/.confd-journal
Size 16KB
SHA256 0fcdc0a8bbdcd0937c489a7f00dd6bbdf68e8bd7fc09b2dc5dc66172100fd654
MD5 6620b2669821e0715c64f45e161d3d48
SHA1 b7e750b9edb55dcb49de089bd76e1e64612da57b
SHA512 ef65b007e2a5dd47168004764da133d5d715277a44d7cc5143a620b58b3c69fd0f49300614c0e8245152159265bb6b4002c5841e0bf304c1f10bba8ee412a390
SSDEEP 96:74NtBssoU4CvMlZfTQhe5frs+rBhdGIsJnYZfITCv1SrqKRPs:74NcsoU4CW0heO+dDGIbNQ1RPs
MD5 SHA1 SHA512 SSDEEP

Submit Download

.timestamp

Path /storage/emulated/0/backups/system/.timestamp
Size 25B
SHA256 011240a2257517d8780627fedd8592c4765afb85f07ce63a8ae8055ec8678482
MD5 23ec43733c72c1b9a2ef2dfef59776f3
SHA1 e829906b7bf2fe49f7690b15f2782bbe94df505a
SHA512 b141528549eab5edec9fae0ea84aae037e283506cff2a6dfee1d4c2424071366987cf2861b544424e646902be8b4c46bf9bf6cb9e44f7576cf53208dd4101602
MD5 SHA1 SHA512

Submit Download

.timestamp

Path /storage/emulated/0/backups/system/.timestamp
Size 55B
SHA256 8dfaa8a7cbe91e9579773e2fb70892d28da79908b41047dac4cb8390becdcdb7
MD5 763d83cb0b719b86f290aaece8f6575c
SHA1 19db9fbf2969fbaf3b4c70f212d89f3073709132
SHA512 2065a77e4f94b4a4c10ca18039392df9777f8aabd0e3620cc2d9c490f94ff52d639f5ba9964334c7b813413d8ade7f79309cdd8f793a0412c6e195c96944f769
MD5 SHA1 SHA512

Submit Download

.timestamp

Path /storage/emulated/0/backups/system/.timestamp
Size 84B
SHA256 e4873f68a33ebf012f23a2f2900fc3a4852286ea8b8a508a33dc63b9c01ddd2c
MD5 9961add172488a7310378150c29aecd9
SHA1 326de5a7eb06696216ed0e0a40e9cdfeb804f285
SHA512 0a696430b6d944bb2c56ccb8383cbca1110ffcf45a783331c6cf88047ec9bb2dff58cdfd78ea244d34afab6d3dcacaa8f89784e8cf39be4b6e13951121ae680e
MD5 SHA1 SHA512

Submit Download

.timestamp

Path /storage/emulated/0/backups/system/.timestamp
Size 114B
SHA256 3e8e10c995819b48a0ff3fe724224b2a0220300d8d680e7b38f9d07c3d46ce14
MD5 9730330eb4e3fda3914dd0260c7294a0
SHA1 bc5a52b150a1791f1640ba795604f02c264752dc
SHA512 cef02be082ee29e243d53fcbcd68ec782bbb9769e23f061f1ed32d2d4421492db91a39d139fb387a40dc7ae20d9c22e84045e48c212f877558596fd875a23dbe
MD5 SHA1 SHA512

Submit Download

.timestamp

Path /storage/emulated/0/backups/system/.timestamp
Size 138B
SHA256 5fa84d2369ba5a016584687a753094658f16cfafa084f77dbde4714bfc4699a5
MD5 7ba744cf021c1cd9eb1f340c21999441
SHA1 f45c3d49e1c34c0ea63f526d5866040605356409
SHA512 a0f9781fac37f74a7e0b9ed635bdeb287b89acf4a79a45fc3e2c7e188bb15ded1f9ca52ebb4c9e1627843e6d094aea9bb9a936b7e98c9dd796e62934c8da3944
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads