Analysis

  • max time kernel
    173s
  • max time network
    142s
  • platform
    android_x86
  • resource
    android-x86-arm-20240603-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240603-enlocale:en-usos:android-9-x86system
  • submitted
    04-06-2024 01:04

General

  • Target

    9339cf5497ec189cd57b7fd89d45e0f3_JaffaCakes118.apk

  • Size

    5.9MB

  • MD5

    9339cf5497ec189cd57b7fd89d45e0f3

  • SHA1

    c4962525bf649a2d7a892daac0a00d089ea6682b

  • SHA256

    63c166ac29f1260e5647758c7d260064958dc50d5e4ebb59bfa44b2c39155681

  • SHA512

    c0d550a76dc8dcfba0e1465bb71a96ec5b14c60d60f7b7cbd42c435bf576d8ecd6d17c3a1af389b9a00ca3f0236b8bdd8231e1fe80c0ec93d60421807ce02467

  • SSDEEP

    98304:/OKW+OQ5b74SNQ3mCSaFZrrgU9Ze17U4PpVCfafKijDrl2R90MnuB3wkl+:/ONi5bBWLU7U4PpQCfVxE0MnuI

Malware Config

Signatures

  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

  • Checks memory information 2 TTPs 1 IoCs

    Checks memory information which indicate if the system is an emulator.

  • Loads dropped Dex/Jar 1 TTPs 4 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about the current Wi-Fi connection 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Queries information about the current nearby Wi-Fi networks 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
  • Checks if the internet connection is available 1 TTPs 2 IoCs
  • Requests cell location 1 TTPs 2 IoCs

    Uses Android APIs to to get current cell information.

  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs

Processes

  • com.tianqi.tianqitianqi
    1⤵
    • Checks CPU information
    • Checks memory information
    • Loads dropped Dex/Jar
    • Queries information about the current Wi-Fi connection
    • Queries information about the current nearby Wi-Fi networks
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Requests cell location
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:4275
    • sh -c ps -ef
      2⤵
        PID:4490
      • ps -ef
        2⤵
          PID:4490
      • com.tianqi.tianqitianqi:remote
        1⤵
        • Loads dropped Dex/Jar
        • Queries information about running processes on the device
        • Queries information about the current Wi-Fi connection
        • Queries information about the current nearby Wi-Fi networks
        • Registers a broadcast receiver at runtime (usually for listening for system events)
        • Checks if the internet connection is available
        • Requests cell location
        • Listens for changes in the sensor environment (might be used to detect emulation)
        • Uses Crypto APIs (Might try to encrypt user data)
        PID:4401

      Network

      MITRE ATT&CK Mobile v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • /data/data/com.tianqi.tianqitianqi/.00000000000/A3AEECD8.dex

        Filesize

        63KB

        MD5

        936afc4570078f5ef2b6fbe1abb985fe

        SHA1

        fed9bc4acd6b5719b589643d86c79719570ea278

        SHA256

        73a13902423efd32474b155030e5c1787a4e4576fadbcb2c0be949df0849a130

        SHA512

        265744df1a6a11703022d2b3fc0d6cd75eb01d38cac77c1a08e2cbdeea618132ede727bd58deb9e9f10aa9472a0a5c7ac2ab9dce145c8c1022273d71b9a850eb

      • /data/data/com.tianqi.tianqitianqi/.00000000000/A3AEECD8.dex

        Filesize

        63KB

        MD5

        5061e4948844f7d366972ac8005e9f13

        SHA1

        a2b79a1c79afb095ddebf0f16a1f9db64482bcaf

        SHA256

        3aa6caecfcd101531539147e01382bc530b4fdc61e98937d63cc4648793c6a45

        SHA512

        223d18ce248912df18cdea3c8e864ea5e6ec058ca42cc5fde738188c54abcd260d7f24ac53d4987d3e32f4ae3e1e40e01354054d035bb100eef51b2d695f5299

      • /data/data/com.tianqi.tianqitianqi/.jiagu/classes.dex

        Filesize

        4.8MB

        MD5

        31603c22ef582041a5a31223425a93e7

        SHA1

        af5cbad4e410cc0ca84ff391c7016ed3323e05fc

        SHA256

        b78c8d3dcc9b9d6e5dd1e7b457e4e7a5cc8ef1593a941e6b5bee20b582f4aa81

        SHA512

        afb3d43db9c477764253304b3189459bee87b9cb1f2785e0ee3086a8ef347da68b37148ae3f432fefb7c829db9ac11e3e5b2d3e3b24f826bd4a02a7694e98560

      • /data/data/com.tianqi.tianqitianqi/.jiagu/libjiagu.so

        Filesize

        491KB

        MD5

        940317093cc329d45cf45ea8713b1c1f

        SHA1

        3f9ff8cef8e41d03ea714b8d5f030ad1fcaec0be

        SHA256

        57f0ffa7062aaa03074648a0c9df78ed9d3f78c2f07fb846b11bb1b667e246bc

        SHA512

        3f40076d241bc3a2b83e56d01e826b8cb7d310a67128ac8b1165bdb93dd917c6a7219c1e65dbd8a40432fb38331828c7171e266e8474dfc69db2675e29e2723f

      • /data/data/com.tianqi.tianqitianqi/files/.jglogs/.jg.ac

        Filesize

        40B

        MD5

        680eb14a669ad07ffb3ab70c881a1d67

        SHA1

        af97db1407193cb2512cef48f40ead6bb2fca867

        SHA256

        36eec4ed9fb36a6b8730596f966ade178578cd95e0efeddbd94ffb99d84b060a

        SHA512

        0b0347c89a330cd4b98f2689c7f8600f801644f6a5befbab103dfce4f21c6e7ce1401bd7b3af48ba2fbf0b7d965e7018e4032373c784e4fcbc3e8cfb506ccaf2

      • /data/data/com.tianqi.tianqitianqi/files/.jglogs/.jg.ic

        Filesize

        32B

        MD5

        a629718788ec5fc099d96d8500d0a4cd

        SHA1

        f451c3116405378d19b285ce24cf9e95f88c8012

        SHA256

        c4e125257484ef534977edd4effaf70a283fcccbdae98a44e2f4ed19c616d925

        SHA512

        069eebe7ff764e4214348cd4e934102e6121f604e9905615e83e054a7a44c731c36c4bc3717e34c7a5b317f22c24d4ea40f468773b0e445aabed7abbf7e54815

      • /data/data/com.tianqi.tianqitianqi/files/.jglogs/.jg.pk

        Filesize

        32B

        MD5

        8deda67a258854d3fddf8826c36c0372

        SHA1

        0a27a02d5353aad4b6f8ae62c4e8473a86cbd99f

        SHA256

        8bf51df7c2e5db05d96a932ce6f79af4679a8bb5921563290edba4499cb8e96e

        SHA512

        5eb9b921ddf0ff2ba998936740fff1d2e88527b9f7555f9da5b2e35a44a82ef06fdca2ff7732e200e64cea0d0db9d770d4ee6066e2a524b8e5f0015ff6569519

      • /data/data/com.tianqi.tianqitianqi/files/.jglogs/.jg.pk.h

        Filesize

        64B

        MD5

        ba10b982a59abd45335e3d97e869b2b4

        SHA1

        8a0531afd3f318b23ab1b89979cc7ae60485c3c5

        SHA256

        c681edf8df1a95a1952a70f024ca887b9859d3da0ed560adcc9859d3ab5532fd

        SHA512

        89045954060266d00bdbf09e52db3aa65613ebd3aa277673077e5296d8305e28eb176cf960ab45eb0ea8c861d3dd768724cb2c21259622a173182ea55e39448b

      • /data/data/com.tianqi.tianqitianqi/files/.jglogs/.jg.rd

        Filesize

        73B

        MD5

        a5d37b1a13dda279590f0daf33483f88

        SHA1

        273ab0444b6176c431370402199584312054dba5

        SHA256

        9a8e0e1847bcdb6e2269dd01476d5fbe5e0a007cebf0a86fb3c6c4ae41d00d29

        SHA512

        47c60ac89080fbba4b69c92510ed5d7d156a84a7a6eda1d4eb6b14f33ce668326c892b928328c0459fad58d301f2aa6e9152646c603a06609ab313880bd03fe6

      • /data/data/com.tianqi.tianqitianqi/files/.jglogs/.jg.ri

        Filesize

        512B

        MD5

        1da703828d9956e146104f6adc8bb0b7

        SHA1

        09498e7ded01cd4dea8ffacf066c2400cb9eb5b9

        SHA256

        8f6ee350272cfedf821dd27ca83fadd81f77a145756853fd2092d464c14532c3

        SHA512

        0685eada9d69c407ec809d0512ca41cd8775d976dc81c373f4ca4e73a7ced575fc83c922ea393f8ba33b9c110dcd2c8a980eaf7bd270b244edad425b2f63263e

      • /data/data/com.tianqi.tianqitianqi/files/.jglogs/.jg.store.report_cf

        Filesize

        4KB

        MD5

        f2b4b0190b9f384ca885f0c8c9b14700

        SHA1

        934ff2646757b5b6e7f20f6a0aa76c7f995d9361

        SHA256

        0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

        SHA512

        ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

      • /data/data/com.tianqi.tianqitianqi/files/.jglogs/.jg.store.report_pid

        Filesize

        54B

        MD5

        8ae3bdebb67541f4cbd94e8f41d84b1e

        SHA1

        393931370dd6e0e29399390085893ba4ff44dd98

        SHA256

        8ec0fb2a0f42b8146c65ff86d9799efc74515cf697679aad5f54ddeffc509c4a

        SHA512

        e12b7ec6d47581011404c3fe4239c94f26d22094c6001f2d8ed7aff7a00bed534cfe3766f594d9552f545d978e041c6958aac11a14689a73521bb53a984f771a

      • /data/data/com.tianqi.tianqitianqi/files/.jglogs/.jg.store.report_pid

        Filesize

        36KB

        MD5

        6e185497928ac98160b89176bc22b8b1

        SHA1

        f69f4985ba8efd433dadf15ca3e11c83cc914027

        SHA256

        5cfdd1880b107f74cd1121cc7de6129597ee0c14a3bbd226695c1820baf8013b

        SHA512

        097e2800b7f5d96af8cafdb72f7b481c1563b59c1c699558d24e42e9c2b7aa613bea4162c350e7743bb2ffae8e3ed0b711e62407a5fcb95decef465e61a5a2f7

      • /data/data/com.tianqi.tianqitianqi/files/libcuid.so

        Filesize

        129B

        MD5

        054df80e7a069249a371a9f5957dc1c1

        SHA1

        953feb1bd68bc1aaeade0f067b238db5bd007ee0

        SHA256

        0b8f4db65c1c35181a27eae06104459b146b9042d895049e0889c5eff83dd90e

        SHA512

        99086d56fedf5e0171ef0d7fd7748137f3e11d76e8e95e61fa9fa1453bb58ef3c323998216585a890c41fe9313bfeaa87e341fc53290269f2bafd9e5e1a363f7

      • /data/data/com.tianqi.tianqitianqi/files/lldt/firll.dat

        Filesize

        27B

        MD5

        93ba5cf006ba12ac4d82082c9712027b

        SHA1

        f2a51a47b4083c1440a804c5fa6c68a56675e3c7

        SHA256

        aabc1adabca25dab061b633cc80bddfe1ee219be30b3313b0bff811f3a715f22

        SHA512

        f99ac17c489d268312f05a511908cf30fb5c7696cc6a4ceb31d7c9cf2c9f53a38d1828b25eda93455d9436ec5151fd374de869d09338a3667e9d61a09c940a93

      • /data/data/com.tianqi.tianqitianqi/files/lldt/grtcfrsa.dat

        Filesize

        801B

        MD5

        daaf83092446dab706fd81f619efc031

        SHA1

        db366961bbb232cfdf6c47f4cfc61fb23f22a638

        SHA256

        eb0b7e2bf53fa383afb3cd0cbbdc89dcf5ceed3ba656e98808b32718083d2c3b

        SHA512

        caaaf68f93fd9055b4c4ff6a53b2f7385b574f749f2686c122662cd224d5811b9e00d9d6b05889568a9433ea9992e3cea0952781e595e0786a71e8508ab6885a

      • /data/data/com.tianqi.tianqitianqi/files/lldt/grtcfrsa.dat

        Filesize

        314B

        MD5

        86b763390b88efcba72e94c680bcb321

        SHA1

        3e1175c85d6c35d80329007632f374a57913faef

        SHA256

        c95c4db35de1a50a8ac2e5f290840253c2b24827ebab9e0f25138669cb5bbd74

        SHA512

        98552a5dfca96b332f58e4e6a0e003a67ee40add8a019acd50c6844c28f6bd387d3f8a2d7d852d720985b32b6c7883e89330da3257881d5b7e0177018622d01c

      • /storage/emulated/0/backups/.SystemConfig/.cuid2

        Filesize

        129B

        MD5

        7c0c7f5e7a3647d03f0368e2a36fff29

        SHA1

        48e89cbe3ed325ecfdf8f28db836b408f61dd76c

        SHA256

        15aa9b8fa0dcde50502468beb45115ccfc02add3ecaddba074d85557513acc9e

        SHA512

        718b838a921458076a2f73cef6595b35a30a98c116eabbeecab0695c7f0e02039abbc637dd03003cff2d19d3cfbd0203ffdf089612a8e4af540c5f5d8b5c08c7