c015bddd1b040de5cb3a60b3b1d7f31540c01d723333178797a9029f3f91c975

Analysis

max time kernel
175s
max time network
185s
platform
android_x86
resource
android-x86-arm-20240603-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240603-enlocale:en-usos:android-9-x86system
submitted
04/06/2024, 15:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

954b1ad511ddbb44d9af8dbb89c8553f_JaffaCakes118.apk
Size

14.9MB
MD5

954b1ad511ddbb44d9af8dbb89c8553f
SHA1

41e036d833ddc47b634f76ed5e38d3ba9a39add1
SHA256

c015bddd1b040de5cb3a60b3b1d7f31540c01d723333178797a9029f3f91c975
SHA512

e5227457d456407b2099be542e892f8766c76796e2c20f9f43a746862ba0333dcbf020e2a18e354ad0c5a81254b5f144ebf239fe3882afc453e00b4d26b84804
SSDEEP

393216:Z6PaKJjKwmMnwgAb1nDIBpdJJYehgzyUNw8wzaZD8cQu7:ZUaKJ+wmMwgAb1DEJKeqOFzax8cT7

Score

7^/10

banker discovery impact persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.wufan.test20180311202153213:lebian.base
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.wufan.test20180311202153213

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
19	alog.umeng.com

Queries information about active data network 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.wufan.test20180311202153213:lebian.base
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.wufan.test20180311202153213

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.wufan.test20180311202153213

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.wufan.test20180311202153213

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.wufan.test20180311202153213

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.wufan.test20180311202153213

com.wufan.test20180311202153213
1⤵
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
PID:4294
- cat /sys/class/net/wlan0/address
  2⤵
  PID:4397
- cat /sys/class/net/wlan0/address
  2⤵
  PID:4503
- cat /sys/class/net/wlan0/address
  2⤵
  PID:4521

com.wufan.test20180311202153213:lebian.base
1⤵
- Queries information about running processes on the device
- Queries information about active data network
PID:4328

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/com.wufan.test20180311202153213/databases/ThrowalbeLog.db

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/data/com.wufan.test20180311202153213/databases/ThrowalbeLog.db-journal

Filesize
512B

MD5
d72eab8c7d62c80a75596ecc5f0420a5

SHA1
acd270ea93fb3906955f3fdb200b0ea1d777ae88

SHA256
5177b935372e4ec3913df551b30cca4d9d7136cdbf680659e94479fad95fa8a8

SHA512
52afe2c840d6e8c5a0d4c8f6fc3ff87a4808fe8086b76250c2148ebc5c0348f8ec8f0c76ea948ecb79cbfabfce03058a51073103be9f18043f0bc3720d6c0c66

Download Submit
/data/data/com.wufan.test20180311202153213/databases/ThrowalbeLog.db-wal

Filesize
32KB

MD5
5eab349a4ceec5636306ca2df2fa8b64

SHA1
32794b06ae9cfdb0506b63a9acde098ca51ef694

SHA256
3bc28b67079106a24bb7cdac347af25de6497370abfd7d1213093a37c6908055

SHA512
cff795cf2974ad18a665516c3086ceaa51c00896a99bf1a8cecb3bb0dfb539ba9954e79b21126b90928cdfa08afa7cd984b2e8abaa8e31ee0dfdf60dd6c51a28

Download Submit
/data/data/com.wufan.test20180311202153213/databases/mgdb

Filesize
260KB

MD5
f19ad37702199ffbe9ea075d2e1f4418

SHA1
bdb621263c6319b387602e9f758832f02d7e49b2

SHA256
456d1dd37a67a3ec9c9373078b4a05a50dc0efff725da5ea9c8e24ff9cc0ee80

SHA512
ecc51c5b72c235899de2a3e3648b5c5de8c6c4ee78a9214c938a2a60baca39b8f8256f53a975a10208abecfc6b37454f2eddacbe1389f1e7d4328ca31877e8c8

Download Submit
/data/data/com.wufan.test20180311202153213/databases/mgdb-journal

Filesize
512B

MD5
5b77713f69d8db0345e40222617ad1e1

SHA1
f51e5012e69a35e9ec07e6a3f60c157d2351fdb0

SHA256
f5e56f7476860bc4543f53ced0d4f5371d78253a7d812ea7f5149002a4ae251a

SHA512
c822f9b56a31b33a366afd7e5f6656b3405b36772582078a1e792eaf224f6245bd015dc94de6614042cb102ea04e7c008a931903369a4c2aebd353ff35a1e6ae

Download Submit
/data/data/com.wufan.test20180311202153213/databases/mgdb-wal

Filesize
402KB

MD5
17556c3b82aff8518b9908bc444e0e1f

SHA1
a65ab50ba2473145e6cc92fdc559cd1ee4cc1105

SHA256
308879e745fa6c55678c9ff012e6a22210be161b601b545a655c41e893154242

SHA512
66fcec0efa643ce85a0e46ef9edd5f105dc7015ba594e204bf31ce90c586984cc9967b3eea83b0984a38a00e5896c4a2808065538c9ed4714b7c25df1b6a87f7

Download Submit
/data/data/com.wufan.test20180311202153213/databases/papa_stat.db

Filesize
28KB

MD5
aeeac2eb0a200e482d743b8f42eef302

SHA1
cc121befc499a9a3100fb491c225fa3915210499

SHA256
ddb9e28cd885e6c4bca188220e6641fcd1f1d1d23e4e5540f54c880daa208627

SHA512
20082dabb079403c0522334af14c02ba2d960d26a61b4eef4ccfd749ae02a1c42bc907410d198de292591ec4ce1622f4d8c22826e61503bfcd552fa2e42d25c1

Download Submit
/data/data/com.wufan.test20180311202153213/databases/papa_stat.db-journal

Filesize
512B

MD5
d3a1925cd2de6b14f5bac4bf0391c9a9

SHA1
259aa6c3d22be12c4de027e679c64bbee46877be

SHA256
4c121ab98a0e13341677f700ac0a0c853d0c1c1363b5cedc8d3891a51a7900aa

SHA512
4784fa134af6a8c6cd34ef32bbb412cc732e3765c55e10825d3d45c099cba1c04ecebabfebbe3acd84337d094327c9e8f5d9eee387c111727fe17ed79fd1652a

Download Submit
/data/data/com.wufan.test20180311202153213/databases/papa_stat.db-shm

Filesize
32KB

MD5
bb7df04e1b0a2570657527a7e108ae23

SHA1
5188431849b4613152fd7bdba6a3ff0a4fd6424b

SHA256
c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

SHA512
768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

Download Submit
/data/data/com.wufan.test20180311202153213/databases/papa_stat.db-wal

Filesize
406KB

MD5
1acf9483517e5fb7045f760528872698

SHA1
981e307759a771a6cdc59a7ddb09ead2c6656305

SHA256
90d4d77e876faa66dc96c0ca1b2093441abab0604a29b3bd4edfa7e413954de9

SHA512
d83848da4a7aa3543458de41292bbb1dfd9c74796a33e10c2b075adf7c785416ea13d45ba9232e147d12593846e0aa777e352e82e8be31e1937fb8d804436314

Download Submit
/data/data/com.wufan.test20180311202153213/files/.um/um_cache_1717513556289.env

Filesize
677B

MD5
fcbeb4ff9fe3e8c42dd08ab3b8ce31b4

SHA1
d59b041cbf2cd25d12f0d1bfbe4405ad24c33851

SHA256
d04b2d29523acb36dbe8f031ea74b01455a2a5c0a9046798d9f747d1f57e894f

SHA512
02a8c00251e1eb706f68b4c376e1e6ad8e6705beb0622b2bfcb135c0a6662ca2966571eff7d90bc6c5551bed7826f85be6267d4ef1a5adab5efc650f7bcabf41

Download Submit
/data/data/com.wufan.test20180311202153213/files/Mob/share_sdk_1

Filesize
23B

MD5
8e24e79baab91c4d0604eaa9006a0cb3

SHA1
e427afc94a4b957a7096f73e395a10ea404c076b

SHA256
65ee797326cb9d94a4c8b13fb114a7273d80af9ae547496bf56556c479f75e4d

SHA512
45bde5e1b5da5e54f7f5baf24cf4d9158ccf5813f0babc05677437bfedf1d54c4707090a1c425089e8f9582a85fed80b25c1e1f30ec2051afc6fe68bb8a76bae

Download Submit
/data/data/com.wufan.test20180311202153213/files/Mob/share_sdk_1

Filesize
62B

MD5
236fc5b67997bb0107a1acb9c000b549

SHA1
8ccd74cc1e42dfe52cadac3a03f54d7b62188d90

SHA256
c8bd5c857f8dd4d2d680479d29c5110a9f6780a42b1e0bae437d08108f62eba6

SHA512
3540011ad1e6a368aebf5338a0901608c004558508e63e171ce48b614e738231691f84102becc782a0bb47b186a0131aa586baddbdcb618f4d5a24ef592442d0

Download Submit
/data/data/com.wufan.test20180311202153213/files/Mob/share_sdk_1

Filesize
86B

MD5
f742b4fc3aca35924562580a182ae16a

SHA1
c8ebd8500da844ff276f480a85cefb4742c6786f

SHA256
bd3f01a9e391adebf934753a3b5a05774b1deeb17e766dfaee030e185d1c1386

SHA512
cc6903e450340efdaa2d89a6da2e72acbbde8688b3d5d24f37a8d83eddd00b795f176fca5fbc74e4d05c7e8ce297357738bff09149402291569789795ff0211b

Download Submit
/data/data/com.wufan.test20180311202153213/files/umeng_it.cache

Filesize
310B

MD5
395780df876bba060052b2d1ade4676f

SHA1
923412c57be7ab39c1a2296ed761f421200bef13

SHA256
0c121ebede359bb77d3c8915fabe9a4ba50420aebde3db775018deecc90df5df

SHA512
a7ce84ea1e45b1d04ec2720a6d1d6ae485182eb30792d0b9988914d02e1a61be4ecc4d86243e8f631cf7df3bed70fbfe799f5ff63fb294143fba1447193d82b6

Download Submit
/storage/emulated/0/.papakey

Filesize
36B

MD5
a8b372d9f92591e3ce488ad365cf9397

SHA1
f6ccc1610fc27f95a6f698ccf1e84ea027240cd1

SHA256
df6b82a5712c12272a7208389742b09695621e693a68ccaaf67efd0f948c5f42

SHA512
25582d7627999e86c1ebae2a2e63efc1af9938fa5029c1fca12417e054d8fceaa688bda412d9e7ab08e2016e406be34111bb35ae14bb6d5446f348d891a714bf

Download Submit
/storage/emulated/0/Android/obb/com.wufan.test20180311202153213/sdkinfo.txt

Filesize
6B

MD5
c7c8d45e0fc1a2ac188f9b0a62f1a797

SHA1
ffe2c07fa6f7f6b99e9be07d89c766dc029b846b

SHA256
91bf44d0a10bdb192c372abd8362e5089b7da61c9dbb2dffc0d936b0f33b5caf

SHA512
6abc5570f847c76a8f091301c26679321be9e27ea4fd07d067227937b3ee7d1a4c6e0020e4bffa769ea0d9355604e390ca29d2c998c2ca49a9341cec57a54755

Download Submit
/storage/emulated/0/Mob/.iew

Filesize
64B

MD5
d62b25791b9f8972176645601373ffbf

SHA1
03bb840c1867ffda55c486a53fc36a9ad95ef4fc

SHA256
2050f5a0e4bce2cc95fedb74e8438f87814131057ba93f8b5e175be144bd5ae9

SHA512
21de1d2fced190df5709a7444cc2300c850537aa91a26a2ddb6d87fe59321f54e1b96e616ad1462f41a1d73db837beaa36333bcd6b7e2be29dd25c261e29c112

Download Submit
/storage/emulated/0/Mob/com.wufan.test20180311202153213/cache/comm/.mps

Filesize
26B

MD5
840eaa01e5d03fffee257ed5ce4fba9e

SHA1
886bd732b29f6dbdd94b890a2b203c5a276ae773

SHA256
7648e772307acf936c331c4ea9d92872b1af6367cbf83f33f569ac204df65595

SHA512
b0a4f9238c4b60bec0cca9c72e551a702a95210a735bd8176c1d5ba741e264d2f1e885d65ed07a88086afd74f69c5e02a92db8068b222a62c6f56762a26b7d4d

Download Submit
/storage/emulated/0/Mob/comm/.di

Filesize
57B

MD5
70a42cba408700f9a6c01c7941a8829e

SHA1
eab01cc2c0671538795fb0b1146017dc099d0984

SHA256
499576707ce2623293166979e59c832be5b8636c64ad39aa63ebcf961910c35f

SHA512
8900d4dc8eed0430babbacb72942401bd22ef7fe5430cad90d3ce0c2c53010220d666aa0e2eb1026f3ec81d574c7fa12585b49222a5f15b01637f6ba134fe70c

Download Submit
/storage/emulated/0/aray/cache/devices/.DEVICES

Filesize
32B

MD5
ab90dbc4c00fbbf827265a24e8bea6ee

SHA1
b2acda42d8204092a054a891ba64b9a0b4dfb26c

SHA256
e5aa7e37a5fe3363d074db87d2aa06897fc4818dfae5352ce3fca8894d830d62

SHA512
645a7a25eb101d350189b1cb9237e56e40330ce3b547264101c8f2e37fc4c83c40942666dc82cd366681254d9f8bc958833034f6de226849d8e83b6f5deae629

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads