c015bddd1b040de5cb3a60b3b1d7f31540c01d723333178797a9029f3f91c975

Analysis

max time kernel
175s
max time network
185s
platform
android_x86
resource
android-x86-arm-20240603-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20240603-enlocale:en-usos:android-9-x86system
submitted
04/06/2024, 15:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
954b1ad511ddbb44d9af8dbb89c8553f_JaffaCakes118.apk
Size 14.9MB
Sample240604-sfvsaabf28
SHA256 c015bddd1b040de5cb3a60b3b1d7f31540c01d723333178797a9029f3f91c975
MD5 954b1ad511ddbb44d9af8dbb89c8553f
SHA1 41e036d833ddc47b634f76ed5e38d3ba9a39add1
SHA512 e5227457d456407b2099be542e892f8766c76796e2c20f9f43a746862ba0333dcbf020e2a18e354ad0c5a81254b5f144ebf239fe3882afc453e00b4d26b84804
SSDEEP 393216:Z6PaKJjKwmMnwgAb1nDIBpdJJYehgzyUNw8wzaZD8cQu7:ZUaKJ+wmMwgAb1DEJKeqOFzax8cT7
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

banker discovery impact persistence

Malware Config

Signatures

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
banker discovery

Security Software Discovery
T1418.001

Queries information about running processes on the device 1 TTPs 2 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.wufan.test20180311202153213:lebian.base
Framework service call	android.app.IActivityManager.getRunningAppProcesses	com.wufan.test20180311202153213

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 1 IoCs

flow	ioc
19	alog.umeng.com

Queries information about active data network 1 TTPs 2 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.wufan.test20180311202153213:lebian.base
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.wufan.test20180311202153213

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.wufan.test20180311202153213

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.wufan.test20180311202153213

Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

impact

Data Encrypted for Impact

T1471

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.wufan.test20180311202153213

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.wufan.test20180311202153213

com.wufan.test20180311202153213
1⤵
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
PID:4294
- cat /sys/class/net/wlan0/address
  2⤵
  PID:4397
- cat /sys/class/net/wlan0/address
  2⤵
  PID:4503
- cat /sys/class/net/wlan0/address
  2⤵
  PID:4521

com.wufan.test20180311202153213:lebian.base
1⤵
- Queries information about running processes on the device
- Queries information about active data network
PID:4328

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

Process Discovery

T1424

Software Discovery

T1418

Security Software Discovery

T1418.001

System Information Discovery

T1426

System Network Connections Discovery

T1421

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Encrypted for Impact

T1471

Replay Monitor

Loading Replay Monitor...

Downloads

ThrowalbeLog.db

Path /data/data/com.wufan.test20180311202153213/databases/ThrowalbeLog.db
Size 4KB
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
MD5 SHA1 SHA512

Submit Download

ThrowalbeLog.db-journal

Path /data/data/com.wufan.test20180311202153213/databases/ThrowalbeLog.db-journal
Size 512B
SHA256 5177b935372e4ec3913df551b30cca4d9d7136cdbf680659e94479fad95fa8a8
MD5 d72eab8c7d62c80a75596ecc5f0420a5
SHA1 acd270ea93fb3906955f3fdb200b0ea1d777ae88
SHA512 52afe2c840d6e8c5a0d4c8f6fc3ff87a4808fe8086b76250c2148ebc5c0348f8ec8f0c76ea948ecb79cbfabfce03058a51073103be9f18043f0bc3720d6c0c66
MD5 SHA1 SHA512

Submit Download

ThrowalbeLog.db-wal

Path /data/data/com.wufan.test20180311202153213/databases/ThrowalbeLog.db-wal
Size 32KB
SHA256 3bc28b67079106a24bb7cdac347af25de6497370abfd7d1213093a37c6908055
MD5 5eab349a4ceec5636306ca2df2fa8b64
SHA1 32794b06ae9cfdb0506b63a9acde098ca51ef694
SHA512 cff795cf2974ad18a665516c3086ceaa51c00896a99bf1a8cecb3bb0dfb539ba9954e79b21126b90928cdfa08afa7cd984b2e8abaa8e31ee0dfdf60dd6c51a28
SSDEEP 12:KwGa0XzdTRmBEyPbP/PYtw4OwCl1EDBOyNTSFbydJexF4bb84riiKj2OVRmBEyPK:Kva0XzyGSP/w59NTpexi+TuGSP/u
MD5 SHA1 SHA512 SSDEEP

Submit Download

mgdb

Path /data/data/com.wufan.test20180311202153213/databases/mgdb
Size 260KB
SHA256 456d1dd37a67a3ec9c9373078b4a05a50dc0efff725da5ea9c8e24ff9cc0ee80
MD5 f19ad37702199ffbe9ea075d2e1f4418
SHA1 bdb621263c6319b387602e9f758832f02d7e49b2
SHA512 ecc51c5b72c235899de2a3e3648b5c5de8c6c4ee78a9214c938a2a60baca39b8f8256f53a975a10208abecfc6b37454f2eddacbe1389f1e7d4328ca31877e8c8
SSDEEP 384:zsfSwMdS83RID22mGwT0OhQwe8UAVNoGwToC7JxFwngREGw2:KG3RID22Sle87XrC7JxRr
MD5 SHA1 SHA512 SSDEEP

Submit Download

mgdb-journal

Path /data/data/com.wufan.test20180311202153213/databases/mgdb-journal
Size 512B
SHA256 f5e56f7476860bc4543f53ced0d4f5371d78253a7d812ea7f5149002a4ae251a
MD5 5b77713f69d8db0345e40222617ad1e1
SHA1 f51e5012e69a35e9ec07e6a3f60c157d2351fdb0
SHA512 c822f9b56a31b33a366afd7e5f6656b3405b36772582078a1e792eaf224f6245bd015dc94de6614042cb102ea04e7c008a931903369a4c2aebd353ff35a1e6ae
MD5 SHA1 SHA512

Submit Download

mgdb-wal

Path /data/data/com.wufan.test20180311202153213/databases/mgdb-wal
Size 402KB
SHA256 308879e745fa6c55678c9ff012e6a22210be161b601b545a655c41e893154242
MD5 17556c3b82aff8518b9908bc444e0e1f
SHA1 a65ab50ba2473145e6cc92fdc559cd1ee4cc1105
SHA512 66fcec0efa643ce85a0e46ef9edd5f105dc7015ba594e204bf31ce90c586984cc9967b3eea83b0984a38a00e5896c4a2808065538c9ed4714b7c25df1b6a87f7
SSDEEP 1536:/qoRTQ3R9wlRgbK3GD22flL7XAC7nxRETx:zGD22flL7XAC7xRo
MD5 SHA1 SHA512 SSDEEP

Submit Download

papa_stat.db

Path /data/data/com.wufan.test20180311202153213/databases/papa_stat.db
Size 28KB
SHA256 ddb9e28cd885e6c4bca188220e6641fcd1f1d1d23e4e5540f54c880daa208627
MD5 aeeac2eb0a200e482d743b8f42eef302
SHA1 cc121befc499a9a3100fb491c225fa3915210499
SHA512 20082dabb079403c0522334af14c02ba2d960d26a61b4eef4ccfd749ae02a1c42bc907410d198de292591ec4ce1622f4d8c22826e61503bfcd552fa2e42d25c1
SSDEEP 48:TiH9qRK9XYiRA6w2wcC2G9qRK9JSnyw2gFBYKonaIyw2ghBYKonkMmWGzTVNTw+n:pA9XYKAT2wcJRA9onywHLoPywHnonAn
MD5 SHA1 SHA512 SSDEEP

Submit Download

papa_stat.db-journal

Path /data/data/com.wufan.test20180311202153213/databases/papa_stat.db-journal
Size 512B
SHA256 4c121ab98a0e13341677f700ac0a0c853d0c1c1363b5cedc8d3891a51a7900aa
MD5 d3a1925cd2de6b14f5bac4bf0391c9a9
SHA1 259aa6c3d22be12c4de027e679c64bbee46877be
SHA512 4784fa134af6a8c6cd34ef32bbb412cc732e3765c55e10825d3d45c099cba1c04ecebabfebbe3acd84337d094327c9e8f5d9eee387c111727fe17ed79fd1652a
MD5 SHA1 SHA512

Submit Download

papa_stat.db-shm

Path /data/data/com.wufan.test20180311202153213/databases/papa_stat.db-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

papa_stat.db-wal

Path /data/data/com.wufan.test20180311202153213/databases/papa_stat.db-wal
Size 406KB
SHA256 90d4d77e876faa66dc96c0ca1b2093441abab0604a29b3bd4edfa7e413954de9
MD5 1acf9483517e5fb7045f760528872698
SHA1 981e307759a771a6cdc59a7ddb09ead2c6656305
SHA512 d83848da4a7aa3543458de41292bbb1dfd9c74796a33e10c2b075adf7c785416ea13d45ba9232e147d12593846e0aa777e352e82e8be31e1937fb8d804436314
SSDEEP 1536:gErEgE9ETYZ7EdIbjW1WEbEaEnE0ErEoE6EuElA2EsEcEMEdEqEhEbEa1ClE9E2D:l
MD5 SHA1 SHA512 SSDEEP

Submit Download

um_cache_1717513556289.env

Path /data/data/com.wufan.test20180311202153213/files/.um/um_cache_1717513556289.env
Size 677B
SHA256 d04b2d29523acb36dbe8f031ea74b01455a2a5c0a9046798d9f747d1f57e894f
MD5 fcbeb4ff9fe3e8c42dd08ab3b8ce31b4
SHA1 d59b041cbf2cd25d12f0d1bfbe4405ad24c33851
SHA512 02a8c00251e1eb706f68b4c376e1e6ad8e6705beb0622b2bfcb135c0a6662ca2966571eff7d90bc6c5551bed7826f85be6267d4ef1a5adab5efc650f7bcabf41
MD5 SHA1 SHA512

Submit Download

share_sdk_1

Path /data/data/com.wufan.test20180311202153213/files/Mob/share_sdk_1
Size 23B
SHA256 65ee797326cb9d94a4c8b13fb114a7273d80af9ae547496bf56556c479f75e4d
MD5 8e24e79baab91c4d0604eaa9006a0cb3
SHA1 e427afc94a4b957a7096f73e395a10ea404c076b
SHA512 45bde5e1b5da5e54f7f5baf24cf4d9158ccf5813f0babc05677437bfedf1d54c4707090a1c425089e8f9582a85fed80b25c1e1f30ec2051afc6fe68bb8a76bae
MD5 SHA1 SHA512

Submit Download

share_sdk_1

Path /data/data/com.wufan.test20180311202153213/files/Mob/share_sdk_1
Size 62B
SHA256 c8bd5c857f8dd4d2d680479d29c5110a9f6780a42b1e0bae437d08108f62eba6
MD5 236fc5b67997bb0107a1acb9c000b549
SHA1 8ccd74cc1e42dfe52cadac3a03f54d7b62188d90
SHA512 3540011ad1e6a368aebf5338a0901608c004558508e63e171ce48b614e738231691f84102becc782a0bb47b186a0131aa586baddbdcb618f4d5a24ef592442d0
MD5 SHA1 SHA512

Submit Download

share_sdk_1

Path /data/data/com.wufan.test20180311202153213/files/Mob/share_sdk_1
Size 86B
SHA256 bd3f01a9e391adebf934753a3b5a05774b1deeb17e766dfaee030e185d1c1386
MD5 f742b4fc3aca35924562580a182ae16a
SHA1 c8ebd8500da844ff276f480a85cefb4742c6786f
SHA512 cc6903e450340efdaa2d89a6da2e72acbbde8688b3d5d24f37a8d83eddd00b795f176fca5fbc74e4d05c7e8ce297357738bff09149402291569789795ff0211b
MD5 SHA1 SHA512

Submit Download

umeng_it.cache

Path /data/data/com.wufan.test20180311202153213/files/umeng_it.cache
Size 310B
SHA256 0c121ebede359bb77d3c8915fabe9a4ba50420aebde3db775018deecc90df5df
MD5 395780df876bba060052b2d1ade4676f
SHA1 923412c57be7ab39c1a2296ed761f421200bef13
SHA512 a7ce84ea1e45b1d04ec2720a6d1d6ae485182eb30792d0b9988914d02e1a61be4ecc4d86243e8f631cf7df3bed70fbfe799f5ff63fb294143fba1447193d82b6
MD5 SHA1 SHA512

Submit Download

.papakey

Path /storage/emulated/0/.papakey
Size 36B
SHA256 df6b82a5712c12272a7208389742b09695621e693a68ccaaf67efd0f948c5f42
MD5 a8b372d9f92591e3ce488ad365cf9397
SHA1 f6ccc1610fc27f95a6f698ccf1e84ea027240cd1
SHA512 25582d7627999e86c1ebae2a2e63efc1af9938fa5029c1fca12417e054d8fceaa688bda412d9e7ab08e2016e406be34111bb35ae14bb6d5446f348d891a714bf
MD5 SHA1 SHA512

Submit Download

sdkinfo.txt

Path /storage/emulated/0/Android/obb/com.wufan.test20180311202153213/sdkinfo.txt
Size 6B
SHA256 91bf44d0a10bdb192c372abd8362e5089b7da61c9dbb2dffc0d936b0f33b5caf
MD5 c7c8d45e0fc1a2ac188f9b0a62f1a797
SHA1 ffe2c07fa6f7f6b99e9be07d89c766dc029b846b
SHA512 6abc5570f847c76a8f091301c26679321be9e27ea4fd07d067227937b3ee7d1a4c6e0020e4bffa769ea0d9355604e390ca29d2c998c2ca49a9341cec57a54755
MD5 SHA1 SHA512

Submit Download

.iew

Path /storage/emulated/0/Mob/.iew
Size 64B
SHA256 2050f5a0e4bce2cc95fedb74e8438f87814131057ba93f8b5e175be144bd5ae9
MD5 d62b25791b9f8972176645601373ffbf
SHA1 03bb840c1867ffda55c486a53fc36a9ad95ef4fc
SHA512 21de1d2fced190df5709a7444cc2300c850537aa91a26a2ddb6d87fe59321f54e1b96e616ad1462f41a1d73db837beaa36333bcd6b7e2be29dd25c261e29c112
MD5 SHA1 SHA512

Submit Download

.mps

Path /storage/emulated/0/Mob/com.wufan.test20180311202153213/cache/comm/.mps
Size 26B
SHA256 7648e772307acf936c331c4ea9d92872b1af6367cbf83f33f569ac204df65595
MD5 840eaa01e5d03fffee257ed5ce4fba9e
SHA1 886bd732b29f6dbdd94b890a2b203c5a276ae773
SHA512 b0a4f9238c4b60bec0cca9c72e551a702a95210a735bd8176c1d5ba741e264d2f1e885d65ed07a88086afd74f69c5e02a92db8068b222a62c6f56762a26b7d4d
MD5 SHA1 SHA512

Submit Download

.di

Path /storage/emulated/0/Mob/comm/.di
Size 57B
SHA256 499576707ce2623293166979e59c832be5b8636c64ad39aa63ebcf961910c35f
MD5 70a42cba408700f9a6c01c7941a8829e
SHA1 eab01cc2c0671538795fb0b1146017dc099d0984
SHA512 8900d4dc8eed0430babbacb72942401bd22ef7fe5430cad90d3ce0c2c53010220d666aa0e2eb1026f3ec81d574c7fa12585b49222a5f15b01637f6ba134fe70c
MD5 SHA1 SHA512

Submit Download

.DEVICES

Path /storage/emulated/0/aray/cache/devices/.DEVICES
Size 32B
SHA256 e5aa7e37a5fe3363d074db87d2aa06897fc4818dfae5352ce3fca8894d830d62
MD5 ab90dbc4c00fbbf827265a24e8bea6ee
SHA1 b2acda42d8204092a054a891ba64b9a0b4dfb26c
SHA512 645a7a25eb101d350189b1cb9237e56e40330ce3b547264101c8f2e37fc4c83c40942666dc82cd366681254d9f8bc958833034f6de226849d8e83b6f5deae629
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads