4f56ff8997dc4d1b89f33be5676cd06ada9590152cba07d6224efb73a98652fc

Analysis

max time kernel
4s
max time network
132s
platform
android_x64
resource
android-x64-arm64-20240603-en
resource tags

androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240603-enlocale:en-usos:android-11-x64system
submitted
04/06/2024, 00:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9321fa5d72164691ce5d36f15fd159c1_JaffaCakes118.apk
Size 30.4MB
Sample240604-as231sfe63
SHA256 4f56ff8997dc4d1b89f33be5676cd06ada9590152cba07d6224efb73a98652fc
MD5 9321fa5d72164691ce5d36f15fd159c1
SHA1 efd116957ad1822c75c3bbc0af7094e0ef3d3d4f
SHA512 974762283d6e3b9ab3bc1401b02210f3a5aac57de8d351684cdef3b908fa6d70edb8d1d824bcf99ac21af3b8b072eef2ac53daf9da096b1d5c91f270940ac550
SSDEEP 786432:wv3+LhsfskiVA4nG6UZVYHIIIhYp7cZa8E5:83+ifskiVA4GpZVYHXrp8re
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion impact

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 5 IoCs

evasion

System Information Discovery

T1426

ioc	Process
/data/local/xbin/su	com.mgamef.zqggs.vivo
/data/local/bin/su	com.mgamef.zqggs.vivo
/data/local/su	com.mgamef.zqggs.vivo
/system/xbin/su	com.mgamef.zqggs.vivo
/sbin/su	com.mgamef.zqggs.vivo

Checks known Qemu files. 1 TTPs 3 IoCs

Checks for known Qemu files that exist on Android virtual device images.

evasion

System Checks

T1633.001

ioc	Process
/system/lib/libc_malloc_debug_qemu.so	com.mgamef.zqggs.vivo
/sys/qemu_trace	com.mgamef.zqggs.vivo
/system/bin/qemu-props	com.mgamef.zqggs.vivo

Checks known Qemu pipes. 1 TTPs 2 IoCs

Checks for known pipes used by the Android emulator to communicate with the host.

evasion

System Checks

T1633.001

ioc	Process
/dev/socket/qemud	com.mgamef.zqggs.vivo
/dev/qemu_pipe	com.mgamef.zqggs.vivo

Checks memory information 2 TTPs 1 IoCs

Checks memory information which indicate if the system is an emulator.

evasion discovery

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.mgamef.zqggs.vivo

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.mgamef.zqggs.vivo

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.mgamef.zqggs.vivo

com.mgamef.zqggs.vivo
1⤵
- Checks if the Android device is rooted.
- Checks known Qemu files.
- Checks known Qemu pipes.
- Checks memory information
- Checks if the internet connection is available
- Uses Crypto APIs (Might try to encrypt user data)
PID:4561

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

1004

Path /data/user/0/com.mgamef.zqggs.vivo/app_crashrecord/1004
Size 237B
SHA256 d06bd063f0418213b1fe8d4316d80d77bc81c102c975614c6b7de38bbccc9c4d
MD5 f2e466820f65ee61f93142abc5e61705
SHA1 8f899dbb43a6b117e23915bb14cb3baa43a2549a
SHA512 e6443a1b06dbfd86a8f652690d6fc07eb571d1634323f81c8a229f97c19593192c0bb22b794b006fe9bb5ffe77993e52654bc709dc02044b63f9f883df0dc151
MD5 SHA1 SHA512

Submit Download

1004

Path /data/user/0/com.mgamef.zqggs.vivo/app_crashrecord/1004
Size 58B
SHA256 988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d
MD5 0d210bfb2a0e1f1b4c082a6a0f79de07
SHA1 bb8ed9e364db79d1d9f2fcde3f15091893222faa
SHA512 536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1
MD5 SHA1 SHA512

Submit Download

bugly_db_yaq

Path /data/user/0/com.mgamef.zqggs.vivo/databases/bugly_db_yaq
Size 64KB
SHA256 9f72d0929e3000fe6cc006909524fdd0be4094cd8b97f9328a8cf99434301f78
MD5 ff2767df7bababb71a18baf10cb75951
SHA1 4a237f6391a07ccc415b104f9f370053b602421e
SHA512 5bca42ffebfde4111e8eea40bf8f471edba52131c26d14f8dae89cc396850a509351f8cc49415a1269089c1a7306707bfb99393c5815f7056a922423c517ea0d
SSDEEP 768:mM+cKericsnJizmGwcKericsnJizm28e11H:mMj
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_yaq-journal

Path /data/user/0/com.mgamef.zqggs.vivo/databases/bugly_db_yaq-journal
Size 8KB
SHA256 c4edad99d3ce838b96b3c838f789827e7f339736aa08f5a9f1f8262f76c9a386
MD5 86bc6895df6c3fde4e37d591ae62fa8f
SHA1 735674582e5ba6648de0a8c4ada5f134e05f5e93
SHA512 83fb2b67dd48e7df2b4a411229619d6c05841573a8ad50a64cd4df44bbbb4b478dfc1e5525b607a849f27cb65cbcc380aa19e34cf8bd123e9839306cc8016c85
SSDEEP 24:7+tCYqLL4XBq5JQfs6y2nriS3dVi6fXX+McEnKwm/mpLwBpGSI:7MCYqwX85WuAriStwwuMN5meposSI
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_yaq-journal

Path /data/user/0/com.mgamef.zqggs.vivo/databases/bugly_db_yaq-journal
Size 8KB
SHA256 09bc0ce5cc3c6cd9affd8ad2a43057bca4d4607ee48372a2e140ee441bdda27b
MD5 b1d45eba7187ecd3ad906945ee8f963b
SHA1 13f4c7aa6f16e6b47705c6f3739861d731304e97
SHA512 43c21077569a44c00d33cf7a0cd0f103c6e1a6a341e3d31319ff6c73904ce9eec82265ccd56ed31ce9c8055e3bb30ce85e5fb6aa68344fe3a1bb463ea07dbb95
SSDEEP 24:7+tIqLKXLXBq5JQfs6y2nriS3dVi6fXX+McEnKwm/mpLwBpGSQ:7MIqgX85WuAriStwwuMN5meposSQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_yaq-journal

Path /data/user/0/com.mgamef.zqggs.vivo/databases/bugly_db_yaq-journal
Size 12KB
SHA256 ec8fca61614cb730470aab978e3692a90970a318a9734caceafe1b37e2074c1d
MD5 fbe1343fca4395c09cc54812f6a5f542
SHA1 d0bf86afd21996e72c465f369ca0c8085c710ec6
SHA512 01589118bfb44ac5ad952e128252bc7be36e28549428af26e73acbc01bdcbcc2554273d1f7b09101e8e92788549bca0de4de57ed1dbd3a02918d1183bced09b0
SSDEEP 24:7+tIqLENXBq5JQfs6y2nriS3dVi6fXX+McEnKwm/mpLwBpGS:7MIqAX85WuAriStwwuMN5meposS
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_yaq-journal

Path /data/user/0/com.mgamef.zqggs.vivo/databases/bugly_db_yaq-journal
Size 512B
SHA256 c45deac1bea1ccb259e00a5ab4425368956230883fc3d464ead5c1d4fb440f1d
MD5 150934c9aaf6da078405474ee3052752
SHA1 2c8b75343add0d3cb6aebe5e09967a45e562b279
SHA512 573951b7465ad720b91cc057baeb30f5b2d011cd83ecab2a067568a65fc670b1a122fffc06523334e6f2438db922076281f9db8f8bb14c4e4ee0d0a802b9cf7a
MD5 SHA1 SHA512

Submit Download

bugly_db_yaq-journal

Path /data/user/0/com.mgamef.zqggs.vivo/databases/bugly_db_yaq-journal
Size 8KB
SHA256 1ae1ce1b9a51b7c38e8f3fcf71ed3e9abc61771f06cdf4a9d017fe6a1a9c967b
MD5 7339aab7fa709e2ab35a68be97a79538
SHA1 3c8c7bde230b30b003e5b4e3a236b1998504e07a
SHA512 4f609e22eb7b2f8d2cb147cf6f5a4de2eaa7cc40b4b559776b3dd92186300a91d7b99b100b26a39def4651a670efedef6eb49335da20931e13ff471b59626b7e
SSDEEP 6:7+/l9QOn1IRg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuK1n:7+tG9RqLiuWdYRmBEyPben
MD5 SHA1 SHA512 SSDEEP

Submit Download

bugly_db_yaq-journal

Path /data/user/0/com.mgamef.zqggs.vivo/databases/bugly_db_yaq-journal
Size 8KB
SHA256 f2381f9a55c6c1f2aa8f3513351ac9d1da247cdfc2363298c96b1c8f97d0f20a
MD5 c1944eedaa3966626b2a63e9ff8183bd
SHA1 cb90882f262f1792a2956029398ed362a73e702e
SHA512 2b26d00f70e102383138d557422e874e5c81be2b5a4ad4960ebf60ca2a5ab395e895eee268edb94113dab789dd5297beaf6871043d0728fe4cc7072e158db12f
SSDEEP 6:7+/l9P/gPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKo7s//t:7+txwqLJdeWRmBEyPbGXt
MD5 SHA1 SHA512 SSDEEP

Submit Download

0OO00l111l1l

Path /data/user/0/com.mgamef.zqggs.vivo/files/prodexdir/0OO00l111l1l
Size 1.5MB
SHA256 ce69483bd002225a1b31412b56cd2fd2244e23ec9343d6a55426cd4958564f85
MD5 38b10e0aa19469e212c11b6ad59d8f38
SHA1 a9ae46d395c2cfdebe69509e5b74931e7c5c4d50
SHA512 ac6d08db800162eb65ceb34b8e5a8b0a4249c1276f54a3ba8422fa95628322b6b0eedecda3a4e23112bb8a8defc5a4573de175df015e02f2575d6d6fc06b96ce
SSDEEP 24576:mt6C0dBclzgYv94nJhi7iQRSRYgVNSXsjOhyzi8QZvuoprSKM2csEdQdljES4bET:gJ0dBiN14nJhk3OxNSXs4o+Gqr9ldlgk
MD5 SHA1 SHA512 SSDEEP

Submit Download

o0oooOO0ooOo.dat

Path /data/user/0/com.mgamef.zqggs.vivo/files/prodexdir/o0oooOO0ooOo.dat
Size 96B
SHA256 141e0693700899d63875b512efb51fcce03ae0d291210a570646d9c623250138
MD5 c9f3240a0265051ac20053062c0ba5a5
SHA1 5d0decb4d276373b4540772ff85527cb2089c62d
SHA512 1d7fa76bfc5822f7769b9b259f5fd3788674d989cb525abbcff49008ddd0ae30628d985bde8cb0c706102879ff4ee3b198ef0f5283a52c81163c270aad8b7895
MD5 SHA1 SHA512

Submit Download

tosversion

Path /data/user/0/com.mgamef.zqggs.vivo/files/prodexdir/tosversion
Size 31B
SHA256 be281ba0ce6dacd5b89da86446f28acfe0e672f0d9683a9281858a49a018911f
MD5 1c24296b983ad4cbcf4297d1e07c0745
SHA1 4c61e9858a049836bd3fd0f4d531e9c3b710ecd2
SHA512 14c962e8cf6282c95c36f3880a622201d592db96375a5a5a60c735350886cbc9e46e4768341f20767af48596582264aeacd258c77ee0bf640c1d0263e48ed086
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads