63c166ac29f1260e5647758c7d260064958dc50d5e4ebb59bfa44b2c39155681

Analysis

max time kernel
5s
max time network
170s
platform
android_x64
resource
android-33-x64-arm64-20240603-en
resource tags

androidarch:arm64arch:x64image:android-33-x64-arm64-20240603-enlocale:en-usos:android-13-x64system
submitted
04/06/2024, 01:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9339cf5497ec189cd57b7fd89d45e0f3_JaffaCakes118.apk
Size 5.9MB
Sample240604-bezamsge44
SHA256 63c166ac29f1260e5647758c7d260064958dc50d5e4ebb59bfa44b2c39155681
MD5 9339cf5497ec189cd57b7fd89d45e0f3
SHA1 c4962525bf649a2d7a892daac0a00d089ea6682b
SHA512 c0d550a76dc8dcfba0e1465bb71a96ec5b14c60d60f7b7cbd42c435bf576d8ecd6d17c3a1af389b9a00ca3f0236b8bdd8231e1fe80c0ec93d60421807ce02467
SSDEEP 98304:/OKW+OQ5b74SNQ3mCSaFZrrgU9Ze17U4PpVCfafKijDrl2R90MnuB3wkl+:/ONi5bBWLU7U4PpQCfVxE0MnuI
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery evasion

Malware Config

Signatures

Loads dropped Dex/Jar 1 TTPs 1 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.tianqi.tianqitianqi/.jiagu/classes.dex	4190	com.tianqi.tianqitianqi

Checks if the internet connection is available 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.tianqi.tianqitianqi

com.tianqi.tianqitianqi
1⤵
- Loads dropped Dex/Jar
- Checks if the internet connection is available
PID:4190

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Credential Access

Discovery

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

classes.dex

Path /data/user/0/com.tianqi.tianqitianqi/.jiagu/classes.dex
Size 4.8MB
SHA256 b78c8d3dcc9b9d6e5dd1e7b457e4e7a5cc8ef1593a941e6b5bee20b582f4aa81
MD5 31603c22ef582041a5a31223425a93e7
SHA1 af5cbad4e410cc0ca84ff391c7016ed3323e05fc
SHA512 afb3d43db9c477764253304b3189459bee87b9cb1f2785e0ee3086a8ef347da68b37148ae3f432fefb7c829db9ac11e3e5b2d3e3b24f826bd4a02a7694e98560
SSDEEP 49152:1/RVDcqUAsgK62YZAjPQbsGk0ceUw97sK2nT8IKJnB5qGTk:lRVDmAjK62TPyBUw9QT8IK1k
MD5 SHA1 SHA512 SSDEEP

Download

libjiagu.so

Path /data/user/0/com.tianqi.tianqitianqi/.jiagu/libjiagu.so
Size 491KB
SHA256 57f0ffa7062aaa03074648a0c9df78ed9d3f78c2f07fb846b11bb1b667e246bc
MD5 940317093cc329d45cf45ea8713b1c1f
SHA1 3f9ff8cef8e41d03ea714b8d5f030ad1fcaec0be
SHA512 3f40076d241bc3a2b83e56d01e826b8cb7d310a67128ac8b1165bdb93dd917c6a7219c1e65dbd8a40432fb38331828c7171e266e8474dfc69db2675e29e2723f
SSDEEP 12288:fqPfCZt8eA9b4/vdzZn2PEPKCmtYzcIckwNABNbxt:CPfwW90/vdzZ2PEmJInoABNP
MD5 SHA1 SHA512 SSDEEP

Submit Download

libjiagu_64.so

Path /data/user/0/com.tianqi.tianqitianqi/.jiagu/libjiagu_64.so
Size 522KB
SHA256 1be9b3aae5673a5682250fb218d427aafe3ffb4e6f54ab701a025dafa19c4c20
MD5 a44c75172a12b00d8b420d9209fe2862
SHA1 a7f4b181857ba570d3942bf26e59cbd1ec445610
SHA512 697e5d18f2278147f03df34c6d5065c34295188b13ccdba73a6ac48e3424b29dadeb96a9e35c3106eecefe49b6717ad2fc9a36ec4e85a2b2b8fda2de78943186
SSDEEP 12288:rN70S1qeuE/pgh6E0PAU+SoX5uADwoH9PaPHAxbK94k71R9u9D+Hw:rNp/pgh6E0PAU+HXTdktj71K
MD5 SHA1 SHA512 SSDEEP

Submit Download

.jg.ri

Path /data/user/0/com.tianqi.tianqitianqi/files/.jglogs/.jg.ri
Size 307B
SHA256 7b84af82e263e03ee0c616355872495c260503a8ebecdcf604e927212997f6a5
MD5 203208612bb3ccc74a13d4bf59434bce
SHA1 6ceef489fcd5eac94f9338223930e1255188ca46
SHA512 1163afa38fe7517570552e3ece8b0342387c330e5384f6948fb33c38ec3b030b9a3cda0654250b74c13fb186d08a1039cb953e967500f729c4c781e0fc74571b
MD5 SHA1 SHA512

Submit Download

.jg.store.report_cf

Path /data/user/0/com.tianqi.tianqitianqi/files/.jglogs/.jg.store.report_cf
Size 32B
SHA256 b20f2ba067976d4c8abadb6066fc75aef54e3d6fae053ffaffd2f8531940fb24
MD5 aca230d0547cc92cc1ef631e05bb6ccf
SHA1 9b2b4b6b5d29d50b9e992796126cc23278827192
SHA512 f1c4167d04bc4188a0e6db1026ddf1f8c1ccdf532ccb8f382dc30b29ee4de3009edc3d0710e1208ca4b251704fc4c4bb2de166e71df3b57040d6a99c14bb8c09
MD5 SHA1 SHA512

Submit Download

.jg.store.report_pid

Path /data/user/0/com.tianqi.tianqitianqi/files/.jglogs/.jg.store.report_pid
Size 32B
SHA256 df9c9dba9577fe9aa03c13ce1c233495634ed309e47f6e7e2c3ba1cdde9d2025
MD5 3e7408869713b18ae626efdcb3666890
SHA1 4ce38e983f2cb06da749f5ba7730121323aa9149
SHA512 e4443d3ec82589705b9967b09bd77d23b23b0987d0cea6e1d0324cfa0ddab51fad11ce7587b32e63c3dcf62eca85c2a989f29803420a9b05ae38d5a1fbd582e6
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads